<dependency>
<groupId>org.pac4j</groupId>
<artifactId>pac4j-core</artifactId>
<version>3.0.0</version>
</dependency>
properties
# Client configuration
client.saml.keystorePath=/path/to/keystore
client.saml.keystorePassword=password
client.saml.applicationId=myApp
# Authentication rules
auth.oauth.callbackUrl=https://example.com/callback
# Authorization rules
authorizer.admin=hasRole('admin')
authorizer.user=hasRole('user')
authorizer.profile=customProfileChecker
import org.pac4j.core.config.Config;
import org.pac4j.core.config.ConfigFactory;
import org.pac4j.core.config.PropertiesConfigFactory;
public class SecurityConfig {
public static Config getConfig() {
ConfigFactory configFactory = new PropertiesConfigFactory("security.properties");
return configFactory.build();
}
}
import org.pac4j.core.config.Config;
import org.pac4j.core.context.Pac4jConstants;
import org.pac4j.core.context.WebContext;
import org.pac4j.core.exception.HttpAction;
import org.pac4j.core.http.adapter.JEEHttpActionAdapter;
import org.pac4j.core.profile.CommonProfile;
import org.pac4j.servlet.ApplicationLogoutController;
import org.pac4j.servlet.CallbackController;
import org.pac4j.servlet.SecurityFilter;
import org.pac4j.servlet.ServletHelper;
import org.pac4j.servlet.SessionStore;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
@WebServlet("/")
public class MyWebApp extends HttpServlet {
private Config config;
@Override
public void init() {
config = SecurityConfig.getConfig();
}
@Override
protected void doGet(HttpServletRequest request, HttpServletResponse response) {
WebContext context = ServletHelperUtils.buildWebContext(request, response, config.getSessionStore());
if (config.getAuthorizers().has("admin")) {
// Check if user has admin role
if (!config.getAuthorizers().get("admin").isAuthorized(context, config.getProfileManager(context, true).get(true))) {
response.sendError(HttpServletResponse.SC_FORBIDDEN);
return;
}
}
// Handle CAS logout
if (ServletHelper.isCASLogoutRequest(context)) {
new ApplicationLogoutController(config, context).logout();
return;
}
// Handle authentication callback
if (context.getRequestParameter(Pac4jConstants.DEFAULT_CLIENT_NAME_PARAMETER).isPresent()) {
new CallbackController(config).callback(context);
return;
}
// Add more protected routes and behaviors here
response.getWriter().print("Hello, World!");
}
}
