# pac4j/pac4j

Security engine for Java (authentication, authorization, multi frameworks): OpenID Connect, SAML2, CAS, OAuth, LDAP, JWT...

Repository: https://github.com/pac4j/pac4j
Canonical: https://ross.abutalabs.com/products/pac4j
Homepage: http://www.pac4j.org
Language: Java
License: Apache-2.0
License Family: permissive
Topics: java, security, authentication, authorization, cas, oauth, saml, openid-connect, j2e, spring-mvc, spring-security, shiro, play-framework, vertx, sparkjava, ratpack, jax-rs, dropwizard, ldap, jwt
Last push: 2026-08-26T14:25:08+00:00

## Health v2 (maintenance only)
Score: 77/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 35, longevity 100
- inputs: {"age_days": 5331, "days_push": 7, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2521, forks 710 (observed 2026-08-28T04:06:58.361691+00:00)

## What it is
pac4j is a Java security engine for authenticating users, managing profiles, and enforcing authorizations across web applications and services. It supports many protocols (OpenID Connect, SAML, CAS, OAuth, JWT, LDAP, Kerberos) and integrates with 15+ Java web frameworks including Spring Boot, Play, and Vert.x.

## Use cases
- add OIDC single sign-on to a Spring Boot app
- integrate SAML2 identity provider login in a Java web app
- delegate authentication to a CAS server from Play or Vert.x
- authenticate users against LDAP or SQL in a Java servlet app
- secure REST APIs with JWT tokens in Java
- swap authentication protocols without rewriting security code
- add OAuth login (Facebook, Twitter) to a Java web framework

## When to choose
- you need a unified security model across multiple Java web frameworks
- you must support enterprise protocols like SAML, CAS, or OpenID Connect
- you want to change identity providers or frameworks without rewriting auth logic
- you need both authentication and fine-grained authorization (roles, CSRF, CORS) in one library

## When to avoid
- you are building a non-JVM application
- you only need a simple session login with no external identity providers
- you want a full out-of-the-box identity server rather than an embedded security engine
- you are locked into Spring Security's native ecosystem and don't need multi-protocol support

## Facets
- artifact type: framework
- maturity: stable
- function: auth, authorization, security, middleware
- domain: security, web-development, backend, developer-tools
- platform: jvm, cross-platform
- tags: java, openid-connect, saml, cas, oauth, jwt, ldap, spring-boot, multi-framework, sso, web-server

## Member repositories
- pac4j/pac4j (main) score 77

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:58.361691+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:25:56.303602+00:00, confidence not recorded.
  - readme: https://github.com/pac4j/pac4j (fetched 2026-08-28T04:06:58.361691+00:00, sha c7f92129cfdf)
  - homepage: http://www.pac4j.org (fetched 2026-08-29T10:08:08.678377+00:00, sha da17a4793404)
  - site_page: https://www.pac4j.org/docs/alldocs.html (fetched 2026-08-29T10:08:08.687464+00:00, sha 30aeab874478)
  - site_page: https://www.pac4j.org/docs/index.html (fetched 2026-08-29T10:08:08.689242+00:00, sha c5c4b33edcc2)
  - site_page: https://www.pac4j.org/docs/the-team.html (fetched 2026-08-29T10:08:08.691929+00:00, sha 1feba64765d9)
- Data as of 2026-08-30T08:39:29.467469+00:00.