pac4j

One Java security framework for every web framework

Authentication and authorization — OpenID Connect, SAML, CAS, OAuth, JWT — with the same security model in Spring Boot, Jakarta EE, Play, Vert.x and 15+ other frameworks.
Change your stack, keep your security code.

Apache 2.0 · Java 17+ (8 and 11 on older lines) · Open source since 2012 · Used by CAS server, Apache Syncope and Apache Knox

Secure a Spring Boot app

One configuration class. Change the client, change the protocol.

@Configuration
public class SecurityConfig extends Pac4jSecurityConfig {

    @Bean
    public Config config() {
        var oidc = new OidcConfiguration()
            .setDiscoveryURI("https://sso.example.org/.well-known/openid-configuration")
            .setClientId("myclient")
            .setSecret("mysecret");
        return new Config("http://localhost:8080/callback", new OidcClient(oidc));
    }

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        addSecurity(registry, "OidcClient").addPathPatterns("/protected/**");
    }
}

The /callback and /logout endpoints are created for you, and ProfileManager gives you the authenticated user.
Same application against a CAS server: new CasClient(casLoginUrl) — against a SAML2 IdP: new SAML2Client(saml2Config). Nothing else changes.

Implementations

Ready to use in most Java frameworks

Also available, on an older pac4j line:

Supported mechanisms

The same security concepts, whatever the implementation

Authentication

OpenID Connect SAML CAS OAuth HTTP LDAP SQL JWT MongoDB IP address Kerberos REST API

Authorization

Roles Anonymous Remember-me Fully authenticated CORS CSRF HTTP Security headers

Advanced

OpenID Federation EUDI Wallet/eIDAS 2.0

Supported by