One Java security framework for every web framework
Authentication and authorization — OpenID Connect, SAML, CAS, OAuth, JWT —
with the same security model in Spring Boot, Jakarta EE, Play, Vert.x and 15+ other frameworks.
Change your stack, keep your security code.
Apache 2.0 · Java 17+ (8 and 11 on older lines) · Open source since 2012 · Used by CAS server, Apache Syncope and Apache Knox
Secure a Spring Boot app
One configuration class. Change the client, change the protocol.
@Configuration
public class SecurityConfig extends Pac4jSecurityConfig {
@Bean
public Config config() {
var oidc = new OidcConfiguration()
.setDiscoveryURI("https://sso.example.org/.well-known/openid-configuration")
.setClientId("myclient")
.setSecret("mysecret");
return new Config("http://localhost:8080/callback", new OidcClient(oidc));
}
@Override
public void addInterceptors(InterceptorRegistry registry) {
addSecurity(registry, "OidcClient").addPathPatterns("/protected/**");
}
}The /callback and /logout endpoints are created for you, and
ProfileManager gives you the authenticated user.
Same application against a CAS server: new CasClient(casLoginUrl) —
against a SAML2 IdP: new SAML2Client(saml2Config). Nothing else changes.
Implementations
Ready to use in most Java frameworks
Also available, on an older pac4j line:
Supported mechanisms
The same security concepts, whatever the implementation

