SimpleSAMLphp works as a PHP-based SAML service provider (SP) between your application and an identity provider (IdP). A reliable deployment exposes only its public directory through Apache or Nginx, uses a correctly configured HTTPS base URL, exchanges metadata with the IdP, and verifies the returned attributes before you protect production routes. This guide walks through that complete process, including reverse proxies, certificates, multiple IdPs, session storage, testing, and upgrades.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What SimpleSAMLphp does in a SAML login
SimpleSAMLphp is server-side PHP software. It does not replace your web server or application; it handles the SAML protocol and gives your application a trusted authentication result. In the common service-provider arrangement, a user visits your application, SimpleSAMLphp redirects the browser to an external IdP, the IdP authenticates the user, and the browser returns a SAML response to the SP. SimpleSAMLphp validates the response and exposes the resulting attributes to your PHP code.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
The SP and IdP must agree on identifiers, endpoints, certificates and accepted bindings. A successful redirect alone is not proof that login is usable: your application also needs the right attribute names and values to create or locate a local account.
The pieces you will configure
- Web server: Apache or Nginx serves the package’s public files and passes PHP requests to a PHP runtime.
- PHP runtime and extensions: install every prerequisite listed for the SimpleSAMLphp release you selected.
- SimpleSAMLphp configuration: normally the distribution’s
configdirectory, or an external directory selected withSIMPLESAMLPHP_CONFIG_DIR. - Authentication source: an entry in
config/authsources.phpusing thesaml:SPtype. - Metadata: your SP metadata must reach the IdP, and the IdP metadata must be loaded by SimpleSAMLphp.
- Application integration: PHP code invokes the named authentication source and consumes the returned attributes.
Check versions and prerequisites first
Release requirements change. The project homepage reported SimpleSAMLphp 2.5.3.1 as the latest release on 2026-08-09, but that number is not a permanent requirement. Check the official release and installation pages immediately before downloading; select the current stable archive or repository version and follow its PHP-version and extension list.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Minimum preparation checklist
- A supported operating system and a PHP-capable Apache or Nginx installation.
- The PHP version and extensions required by the selected SimpleSAMLphp release.
- A DNS name for the SP that users and the IdP can reach consistently.
- A valid TLS certificate for that name. SAML endpoints should be treated as HTTPS URLs in production.
- Administrative access to the IdP so an administrator can register your SP metadata and configure claims.
- A plan for persistent configuration, secrets, certificates, logs and session storage.
- A test account at the IdP and a clear mapping from IdP attributes to your application’s user identifier.
Do not begin troubleshooting SAML assertions while the SimpleSAMLphp environment page still reports missing PHP extensions or packages. Resolve those red checks first; otherwise protocol errors can be symptoms of an incomplete runtime.
Choose a deployment layout
Keep the SimpleSAMLphp source and configuration outside your application source tree where practical. The web server should expose the package’s public directory, not the whole installation. Exposing the parent directory can disclose configuration, metadata, certificates or logs.
| Deployment choice | What the web server does | Important considerations |
|---|---|---|
| Apache with PHP integration | Maps the SimpleSAMLphp URL to the package’s public directory and sends PHP files to the configured PHP handler. |
Ensure directory access rules allow the public files while preventing access to sibling configuration directories. Confirm that rewrite and HTTPS behavior match the package documentation. |
| Nginx with PHP-FPM | Sets the site root to public, serves static files directly and forwards PHP requests to the correct PHP-FPM socket or address. |
Use a location rule that cannot execute or download files from outside public. Pass the original HTTPS information correctly when another proxy terminates TLS. |
| External configuration directory | The application code remains in the installed package while configuration is stored elsewhere. | Set SIMPLESAMLPHP_CONFIG_DIR using the method documented for your release. This makes package upgrades and immutable deployments safer because local settings and metadata are not overwritten. |
Install the SimpleSAMLphp package
- Select and obtain the release. Download the stable archive or check out the supported repository version named by the official installation guide. Verify that the PHP runtime and extensions on the target host satisfy that release.
- Extract it outside the application source tree. A location such as
/opt/simplesamlphpor a versioned application directory keeps the identity service separate from business code. Use your platform’s ownership and deployment conventions rather than making the entire tree writable by the web server. - Install dependencies. Follow the release-specific dependency instructions. If your operating system splits PHP extensions into separate packages, install each one listed by the guide and restart PHP-FPM or Apache when required.
- Publish only
public. Create the Apache virtual host or Nginx server block so the public URL points at the package’spublicdirectory. Test that a request reaches SimpleSAMLphp and that requests for configuration files are not served. - Choose the configuration location. Keep the supplied
configdirectory for a simple installation, or copy configuration to a controlled external directory and setSIMPLESAMLPHP_CONFIG_DIR. Preserve the same directory structure expected by the selected release. - Set initial secrets and administrator access. In
config/config.php, replace development values such as the administrative password and secret salt with unique, long random values. Restrict file permissions so ordinary users cannot read them. - Set the canonical URL. Configure
baseurlpathto the complete public HTTPS URL, including the path at which SimpleSAMLphp is mounted. Use the URL a browser should see, not an internal HTTP address. - Run the environment checks. Open the administration interface and use its environment-check page. Correct every missing extension, package, writable runtime directory or URL problem before proceeding to federation.
Set the canonical HTTPS base URL
The baseurlpath value controls links and redirects generated by SimpleSAMLphp. Set it to a canonical HTTPS address such as https://login.example.com/simplesaml/, with the final path matching the public mount point used by the web server.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
This setting remains essential when a reverse proxy or load balancer terminates TLS. The browser is using HTTPS even if the connection from the proxy to PHP is HTTP; SimpleSAMLphp must still generate HTTPS URLs. Configure the proxy and web server to pass the original scheme and host as documented for your stack, then verify in a browser that redirects, metadata links and the assertion-consumer endpoint all use the public HTTPS origin.
Base-URL checks
- Open the service through its public DNS name rather than an internal hostname.
- Confirm that no redirect changes HTTPS to HTTP or adds an unexpected port.
- Check that a path-mounted installation retains its path in every generated link.
- Repeat the test through the same proxy and load-balancer route users will use.
Configure the service provider authentication source
For an application that delegates login to an external IdP, add an entry to config/authsources.php. The type must be saml:SP. Give the source a stable name, because your application will call that name, and assign an entity ID that uniquely identifies this SP to the IdP.
'default-sp' => [
'saml:SP',
'entityID' => 'https://app.example.com/saml/sp',
'privatekey' => 'saml.key',
'certificate' => 'saml.crt',
],The example uses the source name default-sp and an illustrative entity ID. Replace both with values belonging to your deployment. Keep the entity ID stable after registration; changing it creates a different SP in the IdP’s configuration.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Certificates and signing
Provide a certificate and matching private key when your federation requires signed authentication requests, encrypted assertions or another certificate-based function. Store the private key outside the public directory, restrict its permissions, and give the IdP administrator the public certificate or SP metadata as required. Do not email or upload the private key. If the IdP does not require a particular signing or encryption feature, do not add certificate settings merely because the fields exist; follow the federation’s agreed policy.
One IdP or several
A single IdP can be the explicit default for a simple deployment. For several IdPs, create additional authentication-source entries, each with its own stable entity or source settings as appropriate, and configure discovery or an explicit default. Discovery lets the user choose an IdP; an explicit default sends users directly to one provider. Decide which behavior is appropriate before wiring the login button into your application.
Exchange and load SAML metadata
Metadata is the contract that lets the two sides find and trust one another. The SP metadata exposed by the SimpleSAMLphp federation or administration interface contains the entity ID, assertion-consumer endpoint and, when configured, certificate information. Give that metadata to the IdP administrator through your organization’s approved channel.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Ask the IdP administrator for the IdP metadata in the format supported by your selected SimpleSAMLphp release. Load it using the documented metadata configuration, normally in the metadata area of the configuration directory. A file-based arrangement is transparent and easy to review in version control; automated metadata management can reduce manual updates when the federation publishes signed, changing metadata, but it introduces a refresh process that must be monitored.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Metadata approach | Advantages | Operational risks |
|---|---|---|
| File-based metadata | Simple to audit, review and promote between environments; changes are explicit. | Signing-certificate rotations and endpoint changes require a controlled file update and reload. |
| Automated metadata management | Can track published changes and reduce repetitive manual imports. | Network failures, stale data, signature-validation errors or an unmonitored refresh job can interrupt federation. |
Do not invent metadata values. Entity IDs, SSO endpoints, certificates and bindings must come from the IdP’s administrator or its published metadata. After loading the data, compare the IdP entity ID and certificate with what the IdP administrator says was registered.
Connect your PHP application
Use the SimpleSAMLphp authentication API rather than implementing SAML XML processing in application code. The source name passed to the API must exactly match the entry in authsources.php.
require_once '/path/to/simplesamlphp/src/_autoload.php';
$auth = new SimpleSAMLAuthSimple('default-sp');
$auth->requireAuth();
$attributes = $auth->getAttributes();The installation’s autoloader path and integration details vary with the package layout, so follow the application-integration instructions for your release. After requireAuth() returns, map only the attributes you have agreed with the IdP administrator. Typical application decisions include which claim is the immutable user key, which claim supplies an email address, and which claim controls roles. Treat missing, duplicated or unexpectedly formatted values as an account-provisioning error rather than silently creating a second account.
Attribute mapping checklist
- Write down the exact attribute names, including case and namespace.
- Choose a stable identifier that does not change when a display name changes.
- Define behavior when an optional claim is absent.
- Normalize values only according to an agreed rule; do not trim or lowercase identifiers blindly.
- Authorize roles from an explicit, controlled claim and fail closed when it is missing.
Test authentication before protecting production routes
- Test the environment. Use the administration interface’s environment checks and clear all red indicators.
- Test the authentication source. Start the source test from the SimpleSAMLphp interface. The browser should reach the expected HTTPS base URL and then the IdP.
- Complete a real IdP login. Use a dedicated test account. Confirm that the browser returns to the registered assertion-consumer endpoint without a scheme, host or path mismatch.
- Inspect the result. Review the attributes displayed by the test interface and compare them with the names and values your application expects. Do not copy production secrets into a test page or share personally identifiable values in tickets.
- Test the application integration. Call the authentication source from a non-production route, create or locate the local account, and verify logout and session behavior.
- Protect a production route last. Apply the login requirement only after the end-to-end test succeeds and an administrator has a recovery path.
The IdP must recognize the exact SP entity ID and assertion-consumer endpoint from your metadata. A successful login at the IdP followed by an SP error usually means those registrations, metadata, certificates, clock settings or endpoint URLs do not match.
Choose session storage deliberately
SimpleSAMLphp can use PHP sessions and other supported handlers, including database- or Redis-backed designs, depending on the release and installed modules. The right choice depends on whether requests can reach different web servers and how much session state you need to retain.
| Handler pattern | Best fit | Trade-off |
|---|---|---|
| PHP file sessions | One server or a deployment with shared session storage already provided by the platform. | Local files can disappear during a restart or fail when a load balancer sends later requests to another node. |
| Database sessions | Teams that already operate a highly available relational database and need centralized persistence. | Every session operation adds database work, and connection or schema problems affect login. |
| Redis or another supported shared handler | Multiple web nodes needing fast, centralized, expiring session state. | Requires a correctly secured, monitored service and a clear eviction and persistence policy. |
Whichever handler you select, protect the session cookie with HTTPS, use the release’s recommended cookie settings, synchronize system clocks, and test a login while routing requests across every production node.
Troubleshoot common failures
| Symptom | Likely cause | What to check |
|---|---|---|
| Environment page shows red checks | Missing PHP extension, package, permission or runtime directory. | Install the exact prerequisite named by the release, restart the PHP handler if necessary, and rerun the checks before testing SAML. |
| Redirect uses HTTP or an internal host | Incorrect baseurlpath or missing proxy scheme/host forwarding. |
Set the canonical HTTPS URL and verify the reverse-proxy configuration and browser-visible redirects. |
| IdP says the request is for an unknown service | The entity ID or endpoint in the IdP does not match the SP metadata currently deployed. | Regenerate or view the current SP metadata, compare values character for character, and have the IdP administrator update its registration. |
| Assertion signature or decryption failure | Wrong certificate, stale IdP metadata, missing private key or an unsupported signing/encryption requirement. | Reload trusted metadata, verify the certificate-key pair and permissions, and compare the federation’s signing policy with the SP configuration. |
| Login succeeds but attributes are empty | The IdP did not release the claims, or the application is requesting the wrong names. | Inspect the authentication-source test output, confirm attribute release at the IdP, and update the application’s mapping. |
| Works on one node only | Sessions or configuration differ between nodes. | Use shared session storage where required, deploy identical configuration and metadata, and verify clocks and secrets are consistent. |
| Metadata link or ACS URL is wrong | The package is mounted at a different path than the configured base URL, often behind a proxy. | Check the public path, web-server root and baseurlpath; repeat the test through the public hostname. |
Secure the installation for production
- Serve the service exclusively over HTTPS and redirect or block plain HTTP.
- Expose only the package’s
publicdirectory; keep configuration, keys and logs outside the document root. - Replace default administrative credentials and secret values before allowing federation traffic.
- Use least-privilege ownership and permissions. The web process should write only directories that the release explicitly requires.
- Limit access to the administrative interface by network policy, VPN or another control appropriate to your organization.
- Protect private keys, back them up securely and rotate them according to your federation’s certificate policy.
- Keep IdP metadata current and validate signatures when your federation publishes signed metadata.
- Do not log complete SAML assertions or unnecessary personal data. Restrict diagnostic logging after troubleshooting.
- Synchronize clocks on the web server, proxy and IdP-facing systems; SAML validity windows depend on accurate time.
- Document the emergency administrator account, IdP contact, metadata location and rollback procedure.
Upgrade and maintain SimpleSAMLphp
Before each upgrade, read the release notes and verify the new PHP and extension requirements. Keep the existing configuration and metadata in a separate, backed-up location, deploy the new package alongside the old one, and switch the web-server target only after validation.
- Record the currently deployed version, configuration location, enabled modules, metadata sources and session handler.
- Back up configuration, metadata, certificates and any session-related settings. Never include private keys in an unprotected backup.
- Install the new release in a new directory rather than overwriting the live tree.
- Compare your existing
config.phpwith the new distribution template. Carry settings forward deliberately; do not assume every option or default is unchanged. - Review whether configuration or metadata formats changed and update them according to the release notes.
- Run environment checks and a complete IdP login against the new directory in a staging or controlled route.
- Cut over the web server, monitor authentication and keep the previous release available for a planned rollback window.
Release numbers and prerequisites are volatile. Recheck the official download and release pages at every deployment instead of treating 2.5.3.1 as a timeless baseline.
Quick Recap
Production readiness checklist
- The selected release and its PHP prerequisites are documented.
- Only
publicis exposed by Apache or Nginx. baseurlpathis the canonical HTTPS URL, including any mount path.- Administrative password, secret salt and private keys are unique and protected.
- The
saml:SPauthentication source has a stable name and entity ID. - SP metadata was registered at the IdP, and current IdP metadata is loaded locally.
- Certificate and signing or encryption requirements match the federation agreement.
- Environment checks are clean.
- A real test account completed login, and required attributes were verified.
- The application handles missing or malformed attributes safely.
- Session behavior works across every production node.
- Monitoring, backup, upgrade and rollback procedures are written down.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
