Stack Overflow
Stack Overflow

Questions tagged [pac4j]

Pac4j is an open source security framework for java applications handling authentication and authorisation created and maintained by CAS in the cloud.

77 questions
7
votes
1 answer

OpenId Connect Identity Provider initiated backchannel logout not working

I'm working on a java Spring Boot project that manages users and sessions internally. It relies on OIDC, AWS Cognito being the Identity Provider, for sign-in and, I would hope, sign-out of the users. What I understand from the OIDC Spec for…
Tobias Roland
  • 1,182
  • 1
  • 13
  • 35
4
votes
0 answers

Pac4j + Play framework hot class reloading issue

We are using Play framework (v2.8.16) with Pac4j (v10.0.2) as the security framework running on OpenJDK 12. Our application is a Java app and we are using Play's multi-module setup. In Play's development mode there is a hot code reloading feature…
jdo
  • 71
  • 5
2
votes
1 answer

Could not find net.shibboleth.tool:xmlsectool:2.0.0

Story: My Java is Gradle based project. Using pac4j dependency Here is my gradle configuration: compile ('org.pac4j:pac4j-saml:3.0.0-RC1'){ exclude group: 'com.google.guava', module: 'guava' exclude group: 'org.apache.santuario', module:…
Dupinder Singh
  • 7,175
  • 6
  • 37
  • 61
2
votes
0 answers

play framework 2, make a custom sql based authenticator with pac4j

=== Update 20190327 === Thanks for the comments but the demo didn't help much. After digging into the source code I got a better understanding of the framework. What I need is A custom Client that extends the BasicClient so that a custom…
h--n
  • 5,903
  • 4
  • 31
  • 32
1
vote
1 answer

Disabling the session store with pac4j-saml?

I'm trying to disable the session store as I do not require it for my use case where we are the SP and the IdP sends the SAMLResponse identifying the subject which allows me to create a jwt for my user. I am using dropwizard-pac4j (if that matters)…
Mustafa Shabib
  • 798
  • 12
  • 35
1
vote
1 answer

Use of @RolesAllowed and Pac4J

My application is currently protected by BASIC authentication configured by the web.xml descriptor. It contains a REST API with resources protected by the annotation @RolesAllowed. The users are stored in a simple SQL database which is used in a…
tlegrand
  • 776
  • 1
  • 8
  • 14
1
vote
1 answer

Malformed "Accept" header sent in requests to OIDC Provider

We use Pac4j v5.7.0 in Magnolia CMS for our SSO module. When requesting the configuration metadata of an OIDC Provider (a Content-type: application/json document), Magnolia sends the following Accept header: text/html, image/gif, image/jpeg, *;…
Rich
  • 71
  • 6
1
vote
1 answer

Getting ID Token for Logout

My project overrides the built-in OidcLogoutActionBuilder with a custom implementation. Specifically, we override the getLogoutAction method for getting a RedirectionAction. In the base method, the idToken JWT is retrieved in this line. It checks…
oblivion54
  • 11
  • 1
1
vote
2 answers

Keycloak Bad token response, error=not_allowed when user doesn't have the offline_access role

We have a JSF Application running on a tomcat 9 and we are using keycloak (v10.0.2) for login. Because keycloak deprecated their tomcat-adapter we would like to switch from the keycloak tomcat-adapter to pac4j. So I've created the following…
JavaMan
  • 1,142
  • 12
  • 22
1
vote
0 answers

Pac4j OIDC logout does not allow Ajax call?

Hi I am using Pac4j to do login logout. It has this class called OidcLogoutActionBuilder, where inside it checks specifically if the request is an Ajax request (e.g. from SPA), it will reply with 403. I wonder why is it? Would it be just some…
user1589188
  • 5,316
  • 17
  • 67
  • 130
1
vote
0 answers

what is the usage of the SessionStore in the isAuthorized method in pac4j 5.3.1

I'm getting 403 forbidden error for the external requests. And found the authorization is failing from the isAuthorized method inside the CsrfAuthorizer.class which is derived from pac4j. And I compared the pack4j version 4.3.1, the isAuthorized…
Linidu Praneeth Gunathilaka
  • 147
  • 10
1
vote
2 answers

Play/Scala: use orElse to compose with ActionBuilder?

We use play-pac4j for our authentication in our play application. We would like to have the same route/controller endpoint but with a different behaviour dependending on the user Role. Conceptually, this would do something like: val ACTION_ONE:…
JR Utily
  • 1,792
  • 1
  • 23
  • 38
1
vote
0 answers

What does renewSession do in pac4j?

I was wondering what the impact of setRenewSession(false). I can see it used in DefaultCallbackLogic and it is mentioned in the doc, but I cannot really understand what's the effect it has and in which use case I should set it.
stackoverflowed
  • 686
  • 8
  • 22
1
vote
1 answer

Is there a way to use pac4j AnonymousClient as fallback with other direct clients?

I have an app using pac4j with a JWT client (i.e. a direct) and I would like to use AnonymousClient as fallback. How can I make sure AnonymousClient will be called AFTER JwtClient? Is DefaultSecurityLogic respecting the order the clients are…
stackoverflowed
  • 686
  • 8
  • 22
1
vote
1 answer

How to use DbProfileService from PAC4J framework

I'm trying to implement security layer with PAC4J framework, using users from DB. PAC4J documentation recomends DbProfileService, but I don't know how to use it. Where to define it? In the ConfigFactory? final DirectBasicAuthClient…
carduque
  • 188
  • 1
  • 14
1
2 3 4 5 6