SimpleSAMLphp 2 on Ubuntu 24.04 LTS | Support by cloudimg

SAML 2.0 single sign on, ready to federate

SimpleSAMLphp is a PHP implementation of SAML 2.0 that is both an identity provider and a service provider. Stand it up as the identity provider your users sign in to, put it in front of an application that does not speak SAML, or run it as a proxy between the two. It is the standard choice across education and mid market enterprise. This image ships version 2.5.3.1, released 9 August 2026, installed from the official release with its checksum verified at build time. That is the current supported line: the project states that only the current minor version receives fixes, and 2.5 is what its own download page and documentation mark stable.

Your signing key is yours

An identity provider signs assertions with a private key, and every service that trusts it trusts that key. A key baked into a machine image would be shared by everyone who deployed that image, and any of them could mint assertions another customer's services would accept. So this image contains no configuration at all: no config file, no authentication sources, no signing key, no TLS key and no metadata. It carries the application and a set of templates, and your first boot generates the rest. Two virtual machines launched from this image were measured side by side before release: all seventeen per machine secrets differed, and a password taken from one was refused by the other.

The software refuses its own defaults, and this image proves it

SimpleSAMLphp ships a placeholder secret salt and refuses to run until it is replaced, and it stores its administrator password as a hash rather than as text. This image leans on that rather than working around it. First boot generates the salt, and generates the administrator password and hashes it with the project's own tool, reading the password on standard input so it never reaches a command line or a log. The hash shipped on your machine is argon2id. Before release the build asks the stored hash directly whether it accepts the published defaults, including 123, admin and an empty password: every one is refused, and only the generated password is accepted.

What is on it

SimpleSAMLphp 2.5.3.1 on Ubuntu 24.04 LTS with PHP 8.3 from the distribution, no third party package archive. NGINX terminates TLS on port 443 with a certificate generated on your machine at first boot and hands PHP to php-fpm over a local socket. A service provider test bench is registered against the machine's own identity provider, so a complete signed round trip can be proven from a browser or the command line before any real service is connected. The fifteen modules the official release bundles are all present, including LDAP, SQL and RADIUS authentication sources, ready to enable when you connect your own directory.

Exposed surface

Off machine, this image listens on port 22 and port 443, and nothing else, asserted by equality rather than by a list of things to avoid. php-fpm listens on a local socket, not a network port, and there is deliberately no port 80 listener. The administrator console, the diagnostics page and the module and federation listings all require the administrator password, and the one demonstration page the project leaves unauthenticated is refused at the reverse proxy. The proxy overwrites the forwarded client address rather than appending to it, so a remote caller cannot present a loopback address to reach anything gated on one.

Licence

SimpleSAMLphp is published under the GNU Lesser General Public License, version 2.1 or later. The licence text is copied onto the image from the release at build time, together with an inventory of every bundled dependency's licence, because the project notes that some bundled libraries carry other terms. cloudimg is not affiliated with or endorsed by the SimpleSAMLphp project; the name is used only to identify the software this image runs.

Support

24/7 support from cloudimg, and a step by step deployment guide covering first boot, proving a complete SAML round trip, exchanging metadata with a service provider, connecting your own directory, and moving to a real hostname and certificate.