Java security framework for OIDC, SAML and CAS

---

✨ Why pac4j?

• 🧩 One security engine, every framework: the same concepts and the same configuration for Spring Boot, Jakarta EE, Play, Vert.x, Javalin, JAX-RS and many more.
• 🔐 All the major protocols: OpenID Connect, SAML 2, CAS, OAuth 1.0 & 2.0, JWT, LDAP, Kerberos, HTTP... Log in with Keycloak, Microsoft Entra ID, Google, GitHub, Okta, Auth0, any SAML IdP or CAS server.
• 🛡️ Authorization & web security built in: roles, authentication levels, CSRF protection, CORS and security headers.
• 🚀 Ready for the future: OpenID for Verifiable Presentations (EUDI wallet, eIDAS 2.0) and OpenID Federation.
• 🏭 Battle-tested: developed since 2013 and embedded in Apereo CAS, Apache Syncope and Apache Knox.
• 📜 Open source under the Apache 2 license.

⚡ Quick start (Spring Boot + OpenID Connect)

Add the Spring MVC integration and the OpenID Connect module:

<dependency>
    <groupId>org.pac4j</groupId>
    <artifactId>spring-webmvc-pac4j</artifactId>
    <version>8.0.4</version>
</dependency>
<dependency>
    <groupId>org.pac4j</groupId>
    <artifactId>pac4j-oidc</artifactId>
    <version>6.6.1</version>
</dependency>

Then define your identity provider and the URLs to protect:

@Configuration
public class SecurityConfig extends Pac4jSecurityConfig {

    @Bean
    public Config config() {
        final var oidc = new OidcConfiguration()
            .setDiscoveryURI("https://www.casserverpac4j.dev/oidc/.well-known/openid-configuration")
            .setClientId("myclient")
            .setSecret("mysecret")
            .setAllowUnsignedIdTokens(true); // only for this demo server
        return new Config("http://localhost:8080/callback", new OidcClient(oidc));
    }

    @Override
    public void addInterceptors(final InterceptorRegistry registry) {
        addSecurity(registry, "OidcClient").addPathPatterns("/protected/**");
    }
}

That's it: /protected/** now requires an OpenID Connect login, and the user profile is available through the ProfileManager. Switching to Keycloak, Google or Microsoft Entra ID is a matter of changing the client: read the full guide or run the demo.

🧭 Get started with your framework

Framework	Get started
Spring Web MVC / Spring Boot	OpenID Connect guide
Spring Security / Spring Boot	OpenID Connect guide
Spring WebFlux / Spring Boot	OpenID Connect guide
Jakarta EE	OpenID Connect guide
Play 2.x / 3.x	SAML guide
Vert.x	CAS guide
Javalin	SAML guide
JAX-RS	OpenID Connect guide
Dropwizard	OpenID Connect guide
Spark Java	OpenID Connect guide
Undertow	OpenID Connect guide
Apache Shiro	CAS guide
Jooby • http4s • Ratpack • (archived) • (archived)

pac4j also powers the authentication delegation of Apereo CAS, Apache Syncope and Apache Knox.

🔑 Authentication mechanisms

Login protocols	Credentials validation
OpenID Connect • SAML • CAS • OAuth • HTTP • Kerberos • OpenID4VP (EUDI wallet, eIDAS 2.0)	LDAP • SQL • JWT • MongoDB • IP address • REST API

This is the beginning of the README. Read the rest at the original. Read the full README ↗