spring-security-pac4j | pac4j security library to Spring Security | Authentication library

by pac4j Java Version: 9.0.0 License: Apache-2.0

X-Ray Key Features Code Snippets Community Discussions(1)Vulnerabilities Install Support

kandi X-RAY | spring-security-pac4j Summary

spring-security-pac4j is a Java library typically used in Security, Authentication, Spring Boot applications. spring-security-pac4j has no bugs, it has no vulnerabilities, it has build file available, it has a Permissive License and it has low support. You can download it from GitHub, Maven.

The spring-security-pac4j project is an easy and powerful security library for Spring Security web applications and web services (with or without Spring Boot). It supports authentication and authorization, but also advanced features like session fixation and CSRF protection. It's based on Java 11, Spring Security 5 and on the pac4j security engine v5. It's available under the Apache 2 license. OAuth - SAML - CAS - OpenID Connect - HTTP - Google App Engine - Kerberos - LDAP - SQL - JWT - MongoDB - CouchDB - IP address - REST API. Roles/permissions - Anonymous/remember-me/(fully) authenticated - Profile type, attribute - CORS - CSRF - Security headers - IP address, HTTP method.

Support

Quality

Security

License

Reuse

Support

spring-security-pac4j has a low active ecosystem.

It has 266 star(s) with 83 fork(s). There are 21 watchers for this library.

It had no major release in the last 12 months.

spring-security-pac4j has no issues reported. On average issues are closed in 80 days. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of spring-security-pac4j is 9.0.0

Quality

spring-security-pac4j has 0 bugs and 13 code smells.

Security

spring-security-pac4j has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

spring-security-pac4j code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

spring-security-pac4j is licensed under the Apache-2.0 License. This license is Permissive.

Permissive licenses have the least restrictions, and you can use them in most projects.

Reuse

spring-security-pac4j releases are not available. You will need to build from source code and install.

Deployable package is available in Maven.

Build file is available. You can build the component from source.

spring-security-pac4j saves you 363 person hours of effort in developing the same functionality from scratch.

It has 914 lines of code, 92 functions and 13 files.

It has medium code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi has reviewed spring-security-pac4j and discovered the below as its top functions. This is intended to give you an instant insight into spring-security-pac4j implemented functionality, and help decide if they suit your requirements.

Saves the profiles
Compute the Spring Security Authentication from Pac4j profiles
Performs the login
Compares this token to another RememberMeToken
Builds a list of authorities from a list of profiles
Returns a hashCode instance for the profiles
Removes all profiles
Initializes the security bridge
Get the main profile of the authenticated user
Returns the profile name
Returns a string representation of this object

Get all kandi verified functions for this library.

spring-security-pac4j Key Features

No Key Features are available at this moment for spring-security-pac4j.

spring-security-pac4j Examples and Code Snippets

No Code Snippets are available at this moment for spring-security-pac4j.

Community Discussions

Trending Discussions on spring-security-pac4j

OpenId Connect Identity Provider initiated backchannel logout not working

QUESTION

OpenId Connect Identity Provider initiated backchannel logout not working

Asked 2019-Mar-13 at 17:02

I'm working on a java Spring Boot project that manages users and sessions internally. It relies on OIDC, AWS Cognito being the Identity Provider, for sign-in and, I would hope, sign-out of the users. What I understand from the OIDC Spec for backchannel logout is that:

I must provide an endpoint for logout in my backend application. I am using Pac4J as my OIDC library in a java Spring Boot application, and have enabled the logout endpoint as per the Pac4J Spring Security documentation
The Identity Provider AWS Cognito should send a request to the logout endpoint if the user is signed out from the Identity Provider
When I receive a valid call (as per the OIDC spec) on this endpoint, I must destroy the user's session with my application.

However, the user being logged out of the Identity Provider (AWS Cognito) does not seem to result in a call to the logout endpoint of my application.

I am unable to find documentation for this backchannel behaviour in the AWS Cognito docs.

Have I understood the backchannel logout correctly?
Is this currently unsupported as OIDC logout is still (as of March 12, 2019) in draft status?

...

ANSWER

Answered 2019-Mar-13 at 17:02

I contacted the main developer of Pac4J who was very prompt to reply.

AWS Cognito:

Currently does not seem to support backchannel logout

Pac4J:

Backchannel logout is currently not supported by the library for OIDC, and it isn't on the roadmap either: https://groups.google.com/forum/?fromgroups#!topic/pac4j-users/SD_IgKVZWvM, the /logout referenced in the documentation is for internal (to the app) logout + (if configured) forwarding a logout request to the identity provider. It is NOT a OIDC-backchannel-logout endpoint.

Source https://stackoverflow.com/questions/55119739

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install spring-security-pac4j

You can download it from GitHub, Maven.
You can use spring-security-pac4j like any standard Java library. Please include the the jar files in your classpath. You can also use any IDE and you can run and debug the spring-security-pac4j component as you would do with any other Java program. Best practice is to use a build tool that supports dependency management such as Maven or Gradle. For Maven installation, please refer maven.apache.org. For Gradle installation, please refer gradle.org .

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: