{"id":19226637,"url":"https://github.com/simevo/spid-php2","last_synced_at":"2026-06-18T19:32:08.797Z","repository":{"id":83046781,"uuid":"139324607","full_name":"simevo/spid-php2","owner":"simevo","description":" PHP package for SPID authentication based on php-saml","archived":false,"fork":false,"pushed_at":"2018-08-20T21:21:56.000Z","size":541,"stargazers_count":1,"open_issues_count":23,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-02-23T10:26:16.111Z","etag":null,"topics":["php","php-saml","spid"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/simevo.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-07-01T11:46:05.000Z","updated_at":"2022-03-02T09:47:42.000Z","dependencies_parsed_at":null,"dependency_job_id":"263d2301-c790-458e-83c5-38eaf56a81b2","html_url":"https://github.com/simevo/spid-php2","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/simevo/spid-php2","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/simevo%2Fspid-php2","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/simevo%2Fspid-php2/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/simevo%2Fspid-php2/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/simevo%2Fspid-php2/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/simevo","download_url":"https://codeload.github.com/simevo/spid-php2/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/simevo%2Fspid-php2/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34505419,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-18T02:00:06.871Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["php","php-saml","spid"],"created_at":"2024-11-09T15:19:34.504Z","updated_at":"2026-06-18T19:32:08.792Z","avatar_url":"https://github.com/simevo.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cimg src=\"https://github.com/italia/spid-graphics/blob/master/spid-logos/spid-logo-b-lb.png\" alt=\"SPID\" data-canonical-src=\"https://github.com/italia/spid-graphics/blob/master/spid-logos/spid-logo-b-lb.png\" width=\"500\" height=\"98\" /\u003e\n\n[![Join the #spid-perl channel](https://img.shields.io/badge/Slack%20channel-%23spid--perl-blue.svg?logo=slack)](https://developersitalia.slack.com/messages/C7ESTMQDQ)\n[![Get invited](https://slack.developers.italia.it/badge.svg)](https://slack.developers.italia.it/)\n[![SPID on forum.italia.it](https://img.shields.io/badge/Forum-SPID-blue.svg)](https://forum.italia.it/c/spid)\n\n\u003e ⚠️ **WORK IN PROGRESS (but should be useable)** ⚠️\n\n# spid-php2\nPHP package for SPID authentication based on [php-saml](https://github.com/onelogin/php-saml).\n\nThis PHP package is aimed at implementing SPID **Service Providers**. [SPID](https://www.spid.gov.it/) is the Italian digital identity system, which enables citizens to access all public services with a single set of credentials. This package provides a layer of abstraction over the SAML protocol by exposing just the subset required in order to implement SPID authentication in a web application.\n\nFeatures:\n- **routing-agnostic**, can be integrated in any web framework / CMS\n- **sessionless** (apart from a short-lived internal session used to store the request ID and IdP name until the IdP responds)\n- does not currently support Attribute Authority (AA).\n\nAlternatives for PHP:\n- [spid-php](https://github.com/italia/spid-php) based on [SimpleSAMLphp](https://simplesamlphp.org/)\n- [spid-php3](https://github.com/simevo/spid-php3), a lean implementation that does not rely on external SAML packages\n\nAlternatives for other languages:\n- [spid-perl](https://github.com/italia/spid-perl)\n- [spid-ruby](https://github.com/italia/spid-ruby)\n\n## Compliance\n\n|\u003cimg src=\"https://github.com/italia/spid-graphics/blob/master/spid-logos/spid-logo-c-lb.png?raw=true\" width=\"100\" /\u003e\u003cbr /\u003e_Compliance with [SPID regulations](http://www.agid.gov.it/sites/default/files/circolari/spid-regole_tecniche_v1.pdf) (for Service Providers)_|status (! = TODO)|comments|\n|:---|:---|:---|\n|**Metadata:**|||\n|parsing of IdP XML metadata (1.2.2.4)|!|currently you can configure a single IdP supplying its metedata url in the `idp_metadata_url` key of `config.yml`; the implementation of a workflow to configure the metadata for multiple IdPs is underway, see: [#12](https://github.com/simevo/spid-php2/issues/12); the implementation is not currently checking the AgID signature, see: [#17](https://github.com/simevo/spid-php2/issues/17)|\n|parsing of AA XML metadata (2.2.4)||Attribute Authority is unsupported|\n|SP XML metadata generation (1.3.2)|!|the SP metadata is made available at the `/metadata.php` endpoint; it is currently lacking the `AttributeConsumingService` ([#18](https://github.com/simevo/spid-php2/issues/18)) and the optional `Organization` key ([#19](https://github.com/simevo/spid-php2/issues/19))|\n|**AuthnRequest generation (1.2.2.1):**|||\n|generation of AuthnRequest XML|!|the generated AuthnRequest is not 100% compliant, see: [#2](https://github.com/simevo/spid-php2/issues/2)|\n|HTTP-Redirect binding|✓||\n|HTTP-POST binding|||\n|`AssertionConsumerServiceURL` customization|!|the underlying PHP package we are using as a basis for this SDK ([onelogin/php-saml](https://github.com/onelogin/php-saml)) allows customization of the AuthnRequest, but we are not exposing yet this interface; this is tracked in: [#21](https://github.com/simevo/spid-php2/issues/21)|\n|`AssertionConsumerServiceIndex` customization|!|see: [#21](https://github.com/simevo/spid-php2/issues/21)|\n|`AttributeConsumingServiceIndex` customization|!|see: [#21](https://github.com/simevo/spid-php2/issues/21)|\n|`AuthnContextClassRef` (SPID level) customization|!|see: [#21](https://github.com/simevo/spid-php2/issues/21)|\n|`RequestedAuthnContext/@Comparison` customization|||\n|`RelayState` customization (1.2.2)|!|the RelayState parameter is currently sent in clear, see: [#20](https://github.com/simevo/spid-php2/issues/20)|\n|**Response/Assertion parsing**|||\n|verification of `Response/Signature` value (if any)|!|the underlying package can be configured to request a signed Response (`security.wantMessagesSigned` key) but we are not making use of it ATM, see: [#23](https://github.com/simevo/spid-php2/issues/23)|\n|verification of `Response/Signature` certificate (if any) against IdP/\u003cs\u003eAA metadata\u003c/s\u003e|✓|the underlying package checks the signature using the certificate found in the IdP metadata, see: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/Response.php#L369|\n|verification of `Assertion/Signature` value|!|OK but strict mode must be set, see: [#22](https://github.com/simevo/spid-php2/issues/22)|\n|verification of `Assertion/Signature` certificate against IdP/\u003cs\u003eAA metadata\u003c/s\u003e|✓|the underlying package checks the signature using the certificate found in the IdP metadata, see: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/Response.php#L369|\n|verification of `SubjectConfirmationData/@Recipient`|!|the underlying package checks it only if it is present: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/Response.php#L302 but the spec requires it, see: [#25](https://github.com/simevo/spid-php2/issues/25)|\n|verification of `SubjectConfirmationData/@NotOnOrAfter`|!|the underlying package checks it only if it is present: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/Response.php#L308 but the spec requires it, see: [#25](https://github.com/simevo/spid-php2/issues/25)|\n|verification of `SubjectConfirmationData/@InResponseTo`|!|the underlying package checks it only if it is present: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/Response.php#L296 but the spec requires it, see: [#25](https://github.com/simevo/spid-php2/issues/25)|\n|verification of `Issuer`|!|the underlying package checks that if there is any Issuer it is valid: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/Response.php#L265 but the spec requires it, see: [#25](https://github.com/simevo/spid-php2/issues/25)|\n|verification of `Destination`|!|the underlying package checks it only if it is present: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/Response.php#L227 but the spec requires it, see: [#25](https://github.com/simevo/spid-php2/issues/25)|\n|verification of `Conditions/@NotBefore`|!|the underlying package checks it only of it is present: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/Response.php#L909 but the spec requires it, see: [#25](https://github.com/simevo/spid-php2/issues/25)|\n|verification of `Conditions/@NotOnOrAfter`|!|the underlying package checks it only if it is present: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/Response.php#L915 but the spec requires it, see: [#25](https://github.com/simevo/spid-php2/issues/25)|\n|verification of `Audience`|!|the underlying package checks it only if it is present: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/Response.php#L252 but the spec requires it, see: [#25](https://github.com/simevo/spid-php2/issues/25)|\n|parsing of Response with no `Assertion` (authentication/query failure)|✓|the underlying package checks it: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/Response.php#L783|\n|parsing of failure `StatusCode` (Requester/Responder)|!|the underlying package checks it if it is present: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/Response.php#L456 but the spec requires it, see: [#25](https://github.com/simevo/spid-php2/issues/25)|\n|verification of `RelayState` (saml-bindings-2.0-os 3.5.3)|✓|this is currently checked in the user code: https://github.com/simevo/spid-php2/blob/master/www2/index.php#L78|\n|**Response/Assertion parsing for SSO (1.2.1, 1.2.2.2, 1.3.1):**|||\n|parsing of `NameID`|✓|the underlying package offers three functions to access the `NameID`: `getNameId`, `getNameIdFormat` and `getNameIdNameQualifier`, that can be used in the user code: https://github.com/simevo/spid-php2/blob/master/www2/index.php#L74|\n|parsing of `AuthnContextClassRef` (SPID level)|!|to be implemented, see: [#24](https://github.com/simevo/spid-php2/issues/24)|\n|parsing of attributes|✓|the underlying package offers the `getAttributes` function to access the attributes, that can be used in the user code: https://github.com/simevo/spid-php2/blob/master/www2/index.php#L73|\n|**Response/Assertion parsing for attribute query (2.2.2.2, 2.3.1):**|||\n|parsing of attributes||Attribute Authority is unsupported|\n|**LogoutRequest generation (for SP-initiated logout):**|||\n|generation of LogoutRequest XML|✓||\n|HTTP-Redirect binding|✓||\n|HTTP-POST binding|||\n|**LogoutResponse parsing (for SP-initiated logout):**|||\n|parsing of LogoutResponse XML|✓||\n|verification of `LogoutResponse/Signature` value (if any)|!|the underlying package can be configured to request a signed LogoutResponse (`security.wantMessagesSigned` key) but we are not making use of it ATM, see: [#23](https://github.com/simevo/spid-php2/issues/23)|\n|verification of `LogoutResponse/Signature` certificate (if any) against IdP metadata|✓|the underlying package checks the signature using the certificate found in the IdP metadata, see: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/LogoutResponse.php#L180|\n|verification of `Issuer`|!|the underlying package checks it only if it is present: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/LogoutResponse.php#L152, whereas the spec requires it, see: [#25](https://github.com/simevo/spid-php2/issues/25)|\n|verification of `Destination`|!|the underlying package checks it only if it is present: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/LogoutResponse.php#L162, whereas the spec requires it, see: [#25](https://github.com/simevo/spid-php2/issues/25)|\n|PartialLogout detection||the underlying package does not support partial logout|\n|**LogoutRequest parsing (for third-party-initiated logout):**||\n|parsing of LogoutRequest XML|✓||\n|verification of `LogoutRequest/Signature` value (if any)|!|the underlying package can be configured to request a signed LogoutRequest (`security.wantMessagesSigned` key) but we are not making use of it ATM, see: [#23](https://github.com/simevo/spid-php2/issues/23)|\n|verification of `LogoutRequest/Signature` certificate (if any) against IdP metadata|✓|the underlying package checks the signature using the certificate found in the IdP metadata, see: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/LogoutRequest.php#L385|\n|verification of `Issuer`|!|the underlying package checks it only if it is present: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/LogoutRequest.php#L370, whereas the spec requires it, see: [#25](https://github.com/simevo/spid-php2/issues/25)|\n|verification of `Destination`|!|the underlying package checks it only if it is present: https://github.com/onelogin/php-saml/blob/master/lib/Saml2/LogoutRequest.php#L358, whereas the spec requires it, see: [#25](https://github.com/simevo/spid-php2/issues/25)|\n|parsing of `NameID`|✓|the underlying package offers the `getNameId` function to access the `NameID`, that could be used in the user code|\n|**LogoutResponse generation (for third-party-initiated logout):**||\n|generation of LogoutResponse XML|✓||\n|HTTP-Redirect binding|✓||\n|HTTP-POST binding|||\n|PartialLogout customization||the underlying package does not support partial logout|\n|**AttributeQuery generation (2.2.2.1):**||\n|generation of AttributeQuery XML||Attribute Authority is unsupported|\n|SOAP binding (client)||Attribute Authority is unsupported|\n\n## Repository layout\n\n* [bin/](bin/) auxiliary scripts\n* [example/](example/) contains a demo application\n* [src/](src/) contains the implementation\n* [test/](test/) will contain the unit tests\n\n## Getting Started\n\nTested on amd64 Debian 9.5 (stretch, current stable) and 10 (buster, current unstable) with PHP 7.0-7.2.\n\n### Prerequisites\n\n```sh\nsudo apt install composer make openssl php-curl php-zip php-xml\n```\n\n### Configuring and Installing\n\nBefore using this package, you must:\n\n1. Install prerequisites with composer\n\n2. Download and verify the Identity Provider (IdP) metadata files; it is advised to place them in a separate directory, for example [example/idp_metadata/](example/idp_metadata/). A convenience tool is provided for this purpose: [bin/download_idp_metadata.php](bin/download_idp_metadata.php).\n\n3. Generate key and certificate for the Service Provider (SP) and patch the php-saml package to comply with the SPID standard.\n\nAll steps can be performed in an unattended fashion with:\n```sh\ncomposer install --no-dev\nmake\npushd example \u0026\u0026 ../bin/download_idp_metadata.php \u0026\u0026 popd\n```\n\n**NOTE**: during testing, it is highly adviced to use the test Identity Provider [spid-testenv2](https://github.com/italia/spid-testenv2).\n\n### Usage\n\nAll classes provided by this package reside in the `Italia\\Spid2` namespace.\n\nLoad them using the composer-generated autoloader:\n```php\nrequire_once(__DIR__ . \"/../vendor/autoload.php\");\n```\n\nThe main class is `Italia\\Spid2\\Sp` (service provider), sample instantiation:\n\n```php\n$settings = [\n    'spEntityId' =\u003e \"https://sp.example.com\",\n    'idpMetadataFolderPath' =\u003e $home . \"/idp_metadata\",\n    'idpList' =\u003e array(\n        'testenv2'\n     ),\n     ...\n];\n$sp = new Italia\\Spid2\\Sp($settings);\n```\n\nThe service provider is now ready for use, as in:\n```php\n// shortname of IdP, same as the name of corresponding IdP metadata file, without .xml\n$idpName = 'testenv';\n// return url\n$returnTo = 'https://example.com/return_to_url';\n// SPID level (1, 2 or 3)\n$spidLevel = 1;\n$sp-\u003elogin($idpName, $returnTo, $spidLevel);\n...\n$attributes = $sp-\u003egetAttributes();\nvar_dump($attributes);\n$sp-\u003elogout();\n```\n\n### Example\n\nA basic demo application is provided in the [example/](example/) directory.\n\nTo use:\n\n1. in `example/settings.php`:\n\n  - adapt the base url (`$base`) to your needs (use am IP address or a FQDN that is visible to the IdP)\n  - make sure the IdP metadata corresponding to the IdPs listed in the `idpList` key are present in `example/idp_metadata`\n\n2. in `example/login.php` change the IdP that will be used to login\n\n3. Serve the `example` dir from your preferred webserver\n\n4. visit https://sp.example.com/metadata.php to get the SP (Service Provider) metadata, then copy these over to the IdP and register the SP\n\n5. visit: https://sp.example.com and click `login`.\n\nThis screencast shows what you should see if all goes well:\n\n![img](images/screencast.gif)\n\n## Troubleshooting\n\nIt is advised to install a browser plugin to trace SAML messages:\n\n- Firefox:\n\n  - [SAML-tracer by Olav Morken, Jaime Perez](https://addons.mozilla.org/en-US/firefox/addon/saml-tracer/)\n  - [SAML Message Decoder by Magnus Suther](https://addons.mozilla.org/en-US/firefox/addon/saml-message-decoder-extension/)\n\n- Chrome/Chromium:\n\n  - [SAML Message Decoder by Magnus Suther](https://chrome.google.com/webstore/detail/saml-message-decoder/mpabchoaimgbdbbjjieoaeiibojelbhm)\n  - [SAML Chrome Panel by MLai](https://chrome.google.com/webstore/detail/saml-chrome-panel/paijfdbeoenhembfhkhllainmocckace)\n  - [SAML DevTools extension by stefan.rasmusson.as](https://chrome.google.com/webstore/detail/saml-devtools-extension/jndllhgbinhiiddokbeoeepbppdnhhio)\n\nIn addition, you can use the [SAML Developer Tools](https://www.samltool.com/online_tools.php) provided by onelogin to understand what is going on\n\n## Testing\n\n### Unit tests\n\nLaunch unit tests with PHPunit:\n```\nphpunit --stderr --testdox tests\n```\n\n### Linting\n\nThis project complies with the [PSR-2: Coding Style Guide](https://www.php-fig.org/psr/psr-2/).\n\nLint the code with:\n```\n./vendor/bin/phpcs --standard=PSR2 xxx.php\n```\n\n## Contributing\n\nFor your contributions please use the [git-flow workflow](https://danielkummer.github.io/git-flow-cheatsheet/).\n\n## See also\n\n* [SPID page](https://developers.italia.it/it/spid) on Developers Italia\n\n## Authors\n\nLorenzo Cattaneo and Paolo Greppi.\n\n## License\n\nCopyright (c) 2018, simevo s.r.l.\n\nLicense: BSD 3-Clause, see [LICENSE](LICENSE) file.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsimevo%2Fspid-php2","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsimevo%2Fspid-php2","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsimevo%2Fspid-php2/lists"}