Stateless SAML: Using Beartropy SAML2 Without a Database

While our Admin UI and Database storage are perfect for multi-tenant apps (where you might have 50 different clients with their own Okta setups), sometimes you just need a simple, hardcoded connection.

Maybe you are building an internal tool, or you follow strict 12-Factor App principles where everything must be in environment variables.

beartropy/saml2 supports a "Database-less" mode out of the box.

1. Switch the Source

Open your config/beartropy-saml2.php (or add to .env) and change the source:

1SAML2_IDP_SOURCE=env

This tells the package: "Ignore the database migrations. Read everything from the environment."

2. Configure the IDP

Now, you can define your single Identity Provider directly in your .env file. No UI required.

1# The ID of the connection
2SAML2_IDP_KEY=corporate-sso
3 
4# The URLs provided by your IT department
5SAML2_IDP_ENTITY_ID=[https://sts.windows.net/5544-3322-11.../](https://sts.windows.net/5544-3322-11.../)
6SAML2_IDP_SSO_URL=[https://login.microsoftonline.com/5544.../saml2](https://login.microsoftonline.com/5544.../saml2)
7 
8# The Certificate (One line)
9SAML2_IDP_CERT="MIICpDCCAYwCCQ..."

3. Deploy

That's it. Your login route will now be active at:

https://your-app.com/saml2/login/corporate-sso

When to use this mode?

• Internal Tools: When you only have one login provider (e.g., Google Workspace).
• CI/CD: Easy to mock or change providers between Staging and Production without touching the DB.
• Zero-Migration Deployments: If you can't run migrations or want to keep your schema clean.

Flexibility is key. Whether you need a dynamic database-driven SaaS setup or a static .env configuration, we have you covered.