pac4j/pac4j

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

2521 stars · 710 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

pac4j is a Java security engine for authenticating users, managing profiles, and enforcing authorizations across web applications and services. It supports many protocols (OpenID Connect, SAML, CAS, OAuth, JWT, LDAP, Kerberos) and integrates with 15+ Java web frameworks including Spring Boot, Play, and Vert.x.

Use cases

• add OIDC single sign-on to a Spring Boot app
• integrate SAML2 identity provider login in a Java web app
• delegate authentication to a CAS server from Play or Vert.x
• authenticate users against LDAP or SQL in a Java servlet app
• secure REST APIs with JWT tokens in Java
• swap authentication protocols without rewriting security code
• add OAuth login (Facebook, Twitter) to a Java web framework

When to choose

• you need a unified security model across multiple Java web frameworks
• you must support enterprise protocols like SAML, CAS, or OpenID Connect
• you want to change identity providers or frameworks without rewriting auth logic
• you need both authentication and fine-grained authorization (roles, CSRF, CORS) in one library

When to avoid

• you are building a non-JVM application
• you only need a simple session login with no external identity providers
• you want a full out-of-the-box identity server rather than an embedded security engine
• you are locked into Spring Security's native ecosystem and don't need multi-protocol support

Facets

framework · maturity stable

auth authorization security middleware security web-development backend developer-tools jvm cross-platform java openid-connect saml cas oauth jwt ldap spring-boot multi-framework sso web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="pac4j/pac4j")