saml 3.0.0

SAML 3.0.0 is the first stable release of the new SAML 2.0 service provider implementation for Drupal 11.4 and later, built with LightSAML and the Key module.

Requirements

• Drupal 11.4 or later within the Drupal 11 series.
• PHP 8.4 or later.
• Key 1.22 or later and LightSAML 6.1 or later, installed through Composer.

Features

• Multiple identity provider connections with metadata import, service provider metadata, endpoint helpers, and dedicated configuration forms.
• SP-initiated sign-in, optional IdP-initiated sign-in, signed authentication requests, encrypted assertions, and replay protection.
• Single logout through Drupal's normal logout link, logout confirmation form, and SAML endpoints.
• Explicit identity linking, optional user provisioning, configurable user-field mapping, and controlled role synchronization.
• Private signing and decryption keys managed through Key.
• Linked users can edit their email without local password prompts or password-change fields. Configured attribute mappings still apply at subsequent sign-in.
• Drupal entities for identity links and session records, public lifecycle events, object-oriented hooks, and attribute-based public routes.
• Docker and Keycloak development fixtures, including a dedicated SAML administrator account.

Installation

Install with composer require drupal/saml:^3.0, enable the module, and open Configuration → People → SAML Settings. Review connection settings and account-linking policies before enabling a provider.

Upgrading from 2.x

There is no automatic upgrade path from 2.x. Version 3.0.0 is a new implementation. Existing sites must plan and test configuration and identity migration before adopting this release. Keep a working local administrator account and back up site data and configuration.

Validation and scope

The unit and kernel suite contains 187 passing tests with 100% executable-line coverage of the module's PHP code. JavaScript tests enforce 100% line, branch, and function coverage. Drupal coding standards, frontend checks, and static analysis are included in the Drupal.org CI configuration.

Drupal acting as an identity provider and Drupal 12 compatibility are not included in this release.