PHP SAML Toolkit

The php-saml toolkit (originally from OneLogin, now maintained by the SAML-Toolkits community) lets you add SAML 2.0 single sign-on to PHP software acting as a service provider (SP). It handles the full SAML authentication flow: building and signing AuthnRequests, redirecting users to the identity provider, and validating the signed assertions that come back.

Beyond login, the toolkit covers single logout (SLO), service-provider metadata generation, XML signing and encryption, and identity-provider metadata parsing. Configuration is driven by a settings array describing the SP and IdP, making it straightforward to integrate with any SAML-compliant IdP such as Okta, Azure AD, or ADFS.

What You Get

• A complete SAML 2.0 service-provider implementation for SP-initiated and IdP-initiated SSO
• Signed AuthnRequest generation and signed/encrypted assertion validation
• Single Logout (SLO) support with logout request and response handling
• Service-provider metadata generation and identity-provider metadata parsing
• XML signing and encryption via the bundled xmlseclibs library

Common Use Cases

• Letting enterprise users log into a PHP application through their corporate identity provider
• Integrating a PHP app with IdPs like Okta, Azure AD, OneLogin, or ADFS
• Publishing SP metadata and validating SAML responses and logout messages

Under The Hood

Architecture - The toolkit is organized under lib/Saml2/, with Auth.php as the façade that ties together AuthnRequest, Response, LogoutRequest, LogoutResponse, Settings, Metadata, IdPMetadataParser, and Utils. A settings array is validated by Settings, then Auth drives redirects to the IdP and processes returned assertions; Utils centralizes XML canonicalization, signing, and validation. The extlib/xmlseclibs dependency handles the actual XML digital signature and encryption. Tech Stack - Pure PHP requiring the curl, openssl, dom, and zlib extensions, with xmlseclibs bundled for XML security. Autoloading is classmap-based over lib/Saml, lib/Saml2, and extlib/xmlseclibs. Code Quality - The repository has CI via GitHub Actions, coverage tracking through Coveralls, and a PHPUnit test suite; security fixes (e.g. xmlseclibs CVE updates) are tracked in the CHANGELOG, reflecting an actively security-maintained project. API Design - The public API is compact and imperative: instantiate Auth with settings, call login(), processResponse(), logout(), and processSLO(). Demo apps (demo1, demo2) and extensive README docs illustrate integration, though the settings array and certificate handling impose a moderate learning curve.