https://www.pac4j.org/blog.html News, guides and tutorials about pac4j, the security engine for Java. en Wed, 26 Aug 2026 13:58:35 +0000 https://www.pac4j.org/blog/nlnet_eudiwallet.html https://www.pac4j.org/blog/nlnet_eudiwallet.html Wed, 26 Aug 2026 00:00:00 +0000 Jérôme LELEU pac4j has been awarded a grant by NLnet through the NGI0 Commons Fund, which supports open technologies working towards a free, open and sovereign internet. The grant is dedicated to a single goal: bringing EUDI Wallet / eIDAS 2.0 support to pac4j. The official announcement on nlnet.nl. Why it matters The eIDAS 2.0 regulation requires every EU member state to provide its citizens with a Europea... https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html Mon, 24 Aug 2026 00:00:00 +0000 Jérôme LELEU A few security fixes/hardenings have been applied in version 6.5.6. To stay safe, you SHOULD upgrade: the pac4j-core dependency the pac4j-oidc dependency if you use the OIDC protocol the pac4j-saml dependency if you use the SAML protocol. No additional details will be shared in this post. These vulnerabilities were discovered by Joshua Rogers of AISLE Research. This is the fourth security advis... https://www.pac4j.org/blog/jwks_explained_what_every_developer_should_know.html https://www.pac4j.org/blog/jwks_explained_what_every_developer_should_know.html Mon, 01 Jun 2026 00:00:00 +0000 Jérôme LELEU When it comes to security, certificates have been used everywhere since the early days of the web. While storing them in PEM/DER format has always been complicated, things have become much easier with the modern JWKS (J for JSON) format. And you’re probably already using JWKS without knowing it, every time you validate a JWT from Google, GitHub, or your identity provider. 1) A word about crypto... https://www.pac4j.org/blog/more_openid_federation_with_pac4j_and_connect2id.html https://www.pac4j.org/blog/more_openid_federation_with_pac4j_and_connect2id.html Mon, 18 May 2026 00:00:00 +0000 Jérôme LELEU I strongly recommend that you read the first article about the OpenID Federation protocol. This new article dives deeper into the OpenID Federation support in pac4j and Connect2id. You should download and use the latest versions of both software (at least version 6.5.1 for pac4j). 1) Let’s log in (again) a) Calling the login page As we have previously seen, the first login generates several log... https://www.pac4j.org/blog/security-advisory-pac4j-core-csrf.html https://www.pac4j.org/blog/security-advisory-pac4j-core-csrf.html Wed, 13 May 2026 00:00:00 +0000 Jérôme LELEU A security vulnerability affecting the CSRF support in the pac4j-core module has been identified and fixed. To stay safe, you MUST upgrade: If you use the 5.x line: upgrade to 5.7.11 (or newer) If you use the 6.x line: upgrade to 6.5.1 (or newer) No additional details will be shared in this post. This vulnerability was discovered by James Love. https://www.pac4j.org/blog/what_s_new_in_pac4j_v6_4_and_v6_5.html https://www.pac4j.org/blog/what_s_new_in_pac4j_v6_4_and_v6_5.html Mon, 04 May 2026 00:00:00 +0000 Jérôme LELEU 1) Removal of the “old” modules The pac4j-gae module dedicated to the old Google App Engine authentication mechanism has been deprecated in v6.4.0 and removed in v6.5.0. The pac4j-couch module to support CouchDB as an identity storage has been deprecated in v6.4.0 and removed in v6.5.0. 2) Configuration via Java To address any Java environment, pac4j configurations must be defined via Java code... https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html Thu, 02 Apr 2026 00:00:00 +0000 Jérôme LELEU A security vulnerability affecting the CSRF support in the pac4j-core module has been identified and fixed. To stay safe, you SHOULD upgrade: If you use the 5.x line: upgrade to 5.7.10 (or newer) If you use the 6.x line: upgrade to 6.4.1 (or newer) Another security vulnerability affecting the LdapProfileService in the pac4j-ldap module has been identified and fixed. To stay safe, you MUST upgra... https://www.pac4j.org/blog/openid_federation_with_pac4j_and_connect2id.html https://www.pac4j.org/blog/openid_federation_with_pac4j_and_connect2id.html Wed, 01 Apr 2026 00:00:00 +0000 Jérôme LELEU Since version 6.4.0, pac4j supports the OpenID (Connect) Federation specification. The OpenID Connect (for short, OIDC) support in pac4j (pac4j-oidc module) is strongly based on the Nimbus libraries: <dependency> <groupId>com.nimbusds</groupId> <artifactId>oauth2-oidc-sdk</artifactId> </dependency> <dependency> <groupId>com.nimbusds</groupId&gt... https://www.pac4j.org/blog/security-advisory-pac4j-jwt-jwtauthenticator.html https://www.pac4j.org/blog/security-advisory-pac4j-jwt-jwtauthenticator.html Sun, 01 Mar 2026 00:00:00 +0000 Jérôme LELEU A security vulnerability affecting the JwtAuthenticator in the pac4j-jwt module has been identified and fixed. To stay safe, you MUST upgrade: If you use the 4.x line: upgrade to 4.5.9 (or newer) If you use the 5.x line: upgrade to 5.7.9 (or newer) If you use the 6.x line: upgrade to 6.3.3 (or newer) No additional details will be shared in this post. This vulnerability was discovered by CodeAnt... https://www.pac4j.org/blog/what_s_new_in_pac4j_v6.html https://www.pac4j.org/blog/what_s_new_in_pac4j_v6.html Mon, 01 Jan 2024 00:00:00 +0000 Jérôme LELEU 1) Java version First of all, pac4j v6 is based on the JDK 17 (LTS). It means that you must pick the right pac4j version according to your JDK: pac4j v4.x for JDK 8 pac4j v5.x for JDK 11 pac4j v6.x for JDK 17 2) Renaming/cleaning Several components have been removed or renamed. Notice that: the LogoutHandler is now the SessionLogoutHandler the pac4j-cas, pac4j-saml and pac4j-springboot are the ... https://www.pac4j.org/blog/what_s_new_with_spring_and_pac4j.html https://www.pac4j.org/blog/what_s_new_with_spring_and_pac4j.html Thu, 01 Sep 2022 00:00:00 +0000 Jérôme LELEU pac4j is a security framework available for many frameworks in the Java ecosystem. Unlike other Java security libraries which are dedicated to one framework, pac4j is composed of a security engine (the “core” pac4j project) and many specific implementations. pac4j being a security engine for many implementations allows developers to only learn one security model for all the frameworks and switc... https://www.pac4j.org/blog/jakartaee_is_coming.html https://www.pac4j.org/blog/jakartaee_is_coming.html Fri, 01 Apr 2022 00:00:00 +0000 Jérôme LELEU For a long time, the Java Enterprise Edition has lived its life under the umbrella of Sun Microsystems then Oracle. But the project is now hosted by the Eclipse Foundation. While the transition started smoothly, things have come to a breaking point when the javax.servlet package has been moved to the jakarta.servlet package. Several voices have been raised to request the support of JakartaEE in... https://www.pac4j.org/blog/cve_2021_44878_is_this_serious.html https://www.pac4j.org/blog/cve_2021_44878_is_this_serious.html Tue, 01 Mar 2022 00:00:00 +0000 Jérôme LELEU A few weeks ago, a security vulnerability was published about pac4j: CVE-2021-44878. I have received many questions and requests related to this security vulnerability and I’d like to publicly reply to them. Here is the description of the CVE: Pac4j v5.1 and earlier allows (by default) clients to accept and successfully validate ID Tokens with “none” algorithm (i.e., tokens with no signature) w... https://www.pac4j.org/blog/jee_pac4j_vs_pac4j_jee.html https://www.pac4j.org/blog/jee_pac4j_vs_pac4j_jee.html Wed, 01 Dec 2021 00:00:00 +0000 Jérôme LELEU With pac4j v5.2, there is a very important new dependency: pac4j-jee. Though, there already exists a jee-pac4j artifact and this may seem confusing! Let’s come back to the basics: unlike any other security framework, pac4j is first of all a security engine agnostic to any framework and it’s hosted in the Github project: https://github.com/pac4j/pac4j 1) pac4j-XXX dependencies = protocol support... https://www.pac4j.org/blog/what_s_new_in_pac4j_v5.html https://www.pac4j.org/blog/what_s_new_in_pac4j_v5.html Fri, 01 Jan 2021 00:00:00 +0000 Jérôme LELEU One of the primary goals of pac4j has always been to be easy. One must admit that over the versions, it has gained some complexity and weight and time has come for cleaning. Version 5 will be focused on cleaning with breaking changes as was the version 4.1 (with non-breaking changes). The documentation will be updated too. 1) Java upgrade pac4j v5 is now based on Java 11. 2) Removed The pac4j-s... https://www.pac4j.org/blog/what_s_new_in_pac4j_v4_1.html https://www.pac4j.org/blog/what_s_new_in_pac4j_v4_1.html Tue, 01 Sep 2020 00:00:00 +0000 Jérôme LELEU One of the primary goals of pac4j has always been to be easy. One must admit that along the versions, it has gained some complexity and weight and time has come for cleaning. Version 4.1 will be focused on cleaning (with non-breaking changes) and version 5 as well (with breaking changes). The documentation will be updated too. Removed The InternalAttributeHandler component has been removed: it ... https://www.pac4j.org/blog/pac4j_v4_is_coming.html https://www.pac4j.org/blog/pac4j_v4_is_coming.html Sat, 01 Feb 2020 00:00:00 +0000 Jérôme LELEU A few days ago, I released pac4j v4.0.0-RC3 as well as three of the main implementations: buji-pac4j v5.0.0-RC3 spring-webmvc-pac4j v4.0.0-RC3 play-pac4j v9.0.0-RC3 based on it. We are close to the final release which should happen in a month or two. It’s high time for testing, but also to take a closer look at what’s new in pac4j v4. Although pac4j v3 is a very mature version, several major ne... https://www.pac4j.org/blog/a-brief-history-of-the-security-protocols.html https://www.pac4j.org/blog/a-brief-history-of-the-security-protocols.html Sun, 01 Sep 2019 00:00:00 +0000 Jérôme LELEU This is certainly the number one presentation I make when doing consulting missions for my clients. While most people I meet have some knowledge about the security protocols, they generally lack the historical background, the broader vision and the hindsight that would help them make the best choices. So let’s talk about the security protocols and let’s try to make it a little funny, right? 1) ... https://www.pac4j.org/blog/spring-webmvc-pac4j-vs-spring-security-round-2-rest-apis.html https://www.pac4j.org/blog/spring-webmvc-pac4j-vs-spring-security-round-2-rest-apis.html Fri, 01 Feb 2019 00:00:00 +0000 Jérôme LELEU 1) Introduction Last year, I wrote a blog post on the Spring Boot security and why you should choose the spring-webmvc-pac4j implementation over the Spring Security library. It was greatly inspired by a request from a customer looking for the right security library for his Spring Boot project. It was really focused on UI authentication with the CAS protocol in action. The advantage was for the ... https://www.pac4j.org/blog/why-you-choose-cas-as-your-sso-system.html https://www.pac4j.org/blog/why-you-choose-cas-as-your-sso-system.html Mon, 01 Oct 2018 00:00:00 +0000 Jérôme LELEU Most of the customers for whom I work have already chosen the CAS server and its ecosystem when I come in to help them. Yet, from time to time, I’m contacted earlier in the decision process when the client is still thinking about the products and protocols he wants to use. Advocating for the CAS server is an easy task for me, even if generally, technical reasons are just a small part of the gam... https://www.pac4j.org/blog/understanding-the-callback-endpoint.html https://www.pac4j.org/blog/understanding-the-callback-endpoint.html Fri, 01 Jun 2018 00:00:00 +0000 Jérôme LELEU This is one of the most important concepts in pac4j and unfortunately, there are still many questions about it on the pac4j-users mailing list. So let’s focus on this topic. Overview pac4j splits the authentication processes (we say clients) into two kinds: for web services (direct clients) for UI (indirect clients). For most situations, it makes things much easier compared to other security fr... https://www.pac4j.org/blog/spring-boot-security-choose-spring-webmvc-pac4j.html https://www.pac4j.org/blog/spring-boot-security-choose-spring-webmvc-pac4j.html Mon, 01 Jan 2018 00:00:00 +0000 Jérôme LELEU Recently, a client asked me to write a secured Spring Boot webapp sample to interact with his CAS server. He requested me to use Spring Security and I proposed that he test pac4j as well. He was reluctant at first, but agreed to give it a try. pac4j is not only a security library, it’s a security framework/engine implemented for many environments. Generally, for a Spring Boot webapp, the first ... https://www.pac4j.org/blog/yet-another-jwt-library-pac4j-jwt-for-java.html https://www.pac4j.org/blog/yet-another-jwt-library-pac4j-jwt-for-java.html Fri, 01 Sep 2017 00:00:00 +0000 Jérôme LELEU pac4j is a security engine for Java which supports authentication/authorization and is available for many frameworks: JEE, Play, Vertx, Spring Security, Shiro and Ratpack to name only a few. Regarding authentication, one very common use case is to have a user authenticating via a browser (Facebook login for example) and then turn his identity into something usable for calling web services. This...