pac4j is a security engine for Java that adds authentication and authorization — across OpenID Connect, SAML 2, CAS, OAuth, JWT, LDAP and more — to any Java framework through one shared API.

What it is

pac4j is an open-source Java security library, developed since 2013 and released under the Apache 2 license, that implements a single set of concepts and configuration and applies them across many frameworks: Spring Boot (Web MVC, Spring Security and WebFlux variants), Jakarta EE, Play 2.x and 3.x, Vert.x, Javalin, JAX-RS, Dropwizard, Spark Java, Undertow, Apache Shiro, Ratpack and Lagom. It acts as a client-side security layer: you declare an identity provider and the URL patterns to protect, and pac4j handles the protocol exchange and hands you the resulting user profile through the ProfileManager.

The concrete problem it solves is that Java applications otherwise need a different security integration for every protocol and every framework. With pac4j, swapping the identity provider — Keycloak, Microsoft Entra ID, Google, GitHub, Okta, Auth0, any SAML IdP or CAS server — is a matter of changing the client configuration rather than rewriting the security layer, and the same configuration approach carries across frameworks.

Key capabilities

• Supports OpenID Connect, SAML 2, CAS, OAuth 1.0 and 2.0, JWT, LDAP, Kerberos and HTTP authentication under one API.
• Provides authorization and web security controls including roles, authentication levels, CSRF protection, CORS and security headers.
• Integrates with Spring Web MVC, Spring Security, Spring WebFlux, Jakarta EE, Play, Vert.x, Javalin, JAX-RS, Dropwizard, Spark Java, Undertow, Apache Shiro, Ratpack and Lagom.
• Ships as Maven modules such as org.pac4j:spring-webmvc-pac4j (8.0.3) and org.pac4j:pac4j-oidc (6.5.9).
• Reads OpenID Connect provider configuration from a discovery endpoint, as in OidcConfiguration.setDiscoveryURI(...) with setClientId and setSecret.
• Intercepts protected paths declaratively, for example addSecurity(registry, "OidcClient").addPathPatterns("/protected/**").
• Implements newer specifications including OpenID for Verifiable Presentations (EUDI wallet, eIDAS 2.0) and OpenID Federation.

Who uses it and how

• Teams securing Spring Boot applications with OpenID Connect, defining a Config bean and adding interceptors so that /protected/** requires login.
• Jakarta EE, Play, Vert.x, Javalin and JAX-RS shops that need SAML or CAS without changing their framework.
• Organizations embedded in larger identity stacks: pac4j is used inside Apereo CAS, Apache Syncope and Apache Knox.
• Developers integrating against enterprise providers such as Keycloak, Microsoft Entra ID, Okta and Auth0, or any SAML IdP or CAS server.
• Framework authors and integrators who want one security abstraction across Spring Boot, Apache Shiro and Undertow deployments.

Getting started

Add org.pac4j:spring-webmvc-pac4j and org.pac4j:pac4j-oidc from Maven Central, then extend Pac4jSecurityConfig, register a Config bean with your OidcClient, and add the security interceptor to the paths you want protected; runnable demos are available in the simple-spring-boot-pac4j-demos repository.

How it compares

pac4j stands alone in this registry as an independent, framework-agnostic security engine; the facts name only the frameworks it plugs into — Spring Security, Apache Shiro, Undertow and others — as integration targets rather than as alternatives. Its distinguishing position is one Apache-2.0-licensed API covering many protocols at once, embedded in projects such as Apereo CAS, Apache Syncope and Apache Knox.

When to use it — and when not

Because pac4j is a client-side library rather than an identity provider, you still need to run or subscribe to an actual IdP — Keycloak, a SAML IdP, a CAS server or a hosted provider — and handle the application-side profile storage yourself. It is a poor fit for teams that want a batteries-included framework security stack with built-in user management, and integrators should note that the README is largely a marketing-style overview with per-framework guides hosted externally on pac4j.org. The project is actively maintained, with five open issues and a push on 30 September 2026, and is licensed under Apache-2.0.

<dependency>
    <groupId>org.pac4j</groupId>
    <artifactId>spring-webmvc-pac4j</artifactId>
    <version>8.0.3</version>
</dependency>
<dependency>
    <groupId>org.pac4j</groupId>
    <artifactId>pac4j-oidc</artifactId>
    <version>6.5.9</version>
</dependency>

@Configuration
public class SecurityConfig extends Pac4jSecurityConfig {

    @Bean
    public Config config() {
        final var oidc = new OidcConfiguration()
            .setDiscoveryURI("https://www.casserverpac4j.dev/oidc/.well-known/openid-configuration")
            .setClientId("myclient")
            .setSecret("mysecret")
            .setAllowUnsignedIdTokens(true); // only for this demo server
        return new Config("http://localhost:8080/callback", new OidcClient(oidc));
    }

    @Override
    public void addInterceptors(final InterceptorRegistry registry) {
        addSecurity(registry, "OidcClient").addPathPatterns("/protected/**");
    }
}