SimpleSAMLphp SAML2 library

A PHP library for SAML2 related functionality.

It is used by several products, most notably SimpleSAMLphp and OpenConext.

Before you use it

DO NOT USE THIS LIBRARY UNLESS YOU ARE INTIMATELY FAMILIAR WITH THE SAML2 SPECIFICATION.

If you are not familiar with the SAML2 specification and are simply looking to connect your application using SAML2, you should probably use SimpleSAMLphp.

Note that the HTTP Artifact Binding and SOAP client do not work outside of SimpleSAMLphp.

Which version to pick?

The latest released version (4.x range) is the preferred version. The 3.x branch is our LTS branch and will be supported as long as supported releases of SimpleSAMLphp are using this branch.

All other branches (2.x and earlier) are no longer supported and will not receive any maintenance or (security) fixes. Do not use these versions.

We conform to Semantic Versioning. Be sure to check the UPGRADING.md file if you are upgrading from an older version. Here you will find instructions on how to deal with BC breaking changes between versions.

Usage

• Install with Composer, run the following command in your project:

composer require simplesamlphp/saml2:^4.0

• Provide the required external dependencies by extending and implementing the \SimpleSAML\SAML2\Compat\AbstractContainer then injecting it in the ContainerSingleton (see example below).

• Make sure you've read the security section below.

• Use at will. Example:

    // Use Composers autoloading
    require 'vendor/autoload.php';

    // Implement the Container interface (out of scope for example)
    require 'container.php';
    \SimpleSAML\SAML2\Compat\ContainerSingleton::setContainer($container);

    // Create Issuer
    $issuer = new \SimpleSAML\SAML2\XML\saml\Issuer('https://sp.example.edu');

    // Set up an AuthnRequest
    $request = new \SimpleSAML\SAML2\XML\samlp\AuthnRequest(
        $issuer,
        $container->generateId(),
        null,
        'https://idp.example.edu'
    );

    // Send it off using the HTTP-Redirect binding
    $binding = new \SimpleSAML\SAML2\HTTPRedirect();
    $binding->send($request);

Security

• Should you need to create a DOMDocument instance, use the \SimpleSAML\SAML2\DOMDocumentFactory to create DOMDocuments from either a string (\SimpleSAML\SAML2\DOMDocumentFactory::fromString($theXmlAsString)), a file (\SimpleSAML\SAML2\DOMDocumentFactory::fromFile($pathToTheFile)) or just a new instance (\SimpleSAML\SAML2\DOMDocumentFactory::create()). This in order to protect yourself against the XXE Processing Vulnerability, as well as XML Entity Expansion attacks.

License

This library is licensed under the LGPL license version 2.1. For more details see LICENSE.