CARVIEW |
Select Language
HTTP/2 200
date: Sun, 27 Jul 2025 11:30:20 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With,Accept-Encoding, Accept, X-Requested-With
x-robots-tag: none
etag: W/"7ef1aeefaa340c698cd6b6761f932371"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
server: github.com
content-encoding: gzip
accept-ranges: bytes
set-cookie: _gh_sess=wSeVS5DGjwursRnoE8%2F5AjulgLvVbP%2Blw7To%2Bvo%2BEXW1PxQth6qgLoMPzp9UTc6lX%2FrwY8F7YFwHhfqk51UUlizHA49AfihO552HyizMqRhA%2BCTR9%2FJwaRYO8NQtJztZxTxN4DyZHek12vE0UofUis0%2BPNDgtvFuo89EtqPHozZ7m805fCNapq%2F04FmWOX%2F4EkAzhSc1KMI4Lj1TGlMo2tEG3Wg7Z09T7hDMTIuhAkQ4CxaxqndUTf2MbUTAmFJFsLi3hunFvG0MZ3lt7sbhiA%3D%3D--zRpAn%2Ft%2BpNBWIXVZ--Ovz522vCzPQ0%2BRgd%2FU%2BtnQ%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _octo=GH1.1.195093866.1753615820; Path=/; Domain=github.com; Expires=Mon, 27 Jul 2026 11:30:20 GMT; Secure; SameSite=Lax
set-cookie: logged_in=no; Path=/; Domain=github.com; Expires=Mon, 27 Jul 2026 11:30:20 GMT; HttpOnly; Secure; SameSite=Lax
x-github-request-id: B13C:21EF6:442EC8:5B922E:68860DCC
Security configuration · pac4j/spring-webmvc-pac4j Wiki · GitHub
Skip to content
Navigation Menu
{{ message }}
-
Notifications
You must be signed in to change notification settings - Fork 27
Security configuration
LELEU Jérôme edited this page Nov 20, 2020
·
4 revisions
You need to define the security configuration (authentication and authorization mechanisms) in a Config
component.
>> Read the documentation of the Config
component.
It can be built via a Spring context file or a Spring configuration class:
<bean id="facebookClient" class="org.pac4j.oauth.client.FacebookClient">
<constructor-arg name="key" value="145278422258960" />
<constructor-arg name="secret" value="be21409ba8f39b5dae2a7de525484da8" />
</bean>
<bean id="twitterClient" class="org.pac4j.oauth.client.TwitterClient">
<constructor-arg name="key" value="CoxUiYwQOSFDReZYdjigBA" />
<constructor-arg name="secret" value="2kAzunH5Btc4gRSaMr7D7MkyoJ5u1VzbOOzE8rBofs" />
</bean>
<bean id="testAuthenticator" class="org.pac4j.http.credentials.authenticator.test.SimpleTestUsernamePasswordAuthenticator">
</bean>
<bean id="formClient" class="org.pac4j.http.client.indirect.FormClient">
<constructor-arg name="loginUrl" value="https://localhost:8080/loginForm" />
<constructor-arg name="usernamePasswordAuthenticator" ref="testAuthenticator" />
</bean>
...
<bean id="clients" class="org.pac4j.core.client.Clients">
<constructor-arg name="callbackUrl" value="https://localhost:8080/callback" />
<constructor-arg name="clients">
<list>
<ref bean="oidClient" />
<ref bean="saml2Client" />
<ref bean="facebookClient" />
<ref bean="twitterClient" />
<ref bean="formClient" />
<ref bean="indirectBasicAuthClient" />
<ref bean="casClient" />
<ref bean="parameterClient" />
<ref bean="directBasicAuthClient" />
<ref bean="casRestBasicAuthClient" />
</list>
</constructor-arg>
</bean>
<bean id="customAuthorizer" class="org.pac4j.demo.spring.CustomAuthorizer">
</bean>
<bean id="config" class="org.pac4j.core.config.Config">
<constructor-arg name="clients" ref="clients" />
<constructor-arg name="authorizers">
<map>
<entry key="custom" value-ref="customAuthorizer" />
</map>
</constructor-arg>
</bean>
See a full example here.
@Configuration
public class Pac4jConfig {
@Value("${salt}")
private String salt;
@Bean
public Config config() {
final OidcConfiguration oidcConfiguration = new OidcConfiguration();
oidcConfiguration.setClientId("167480702619-8e1lo80dnu8bpk3k0lvvj27noin97vu9.apps.googleusercontent.com");
oidcConfiguration.setSecret("MhMme_Ik6IH2JMnAT6MFIfee");
oidcConfiguration.setPreferredJwsAlgorithm(JWSAlgorithm.PS384);
oidcConfiguration.addCustomParam("prompt", "consent");
final GoogleOidcClient oidcClient = new GoogleOidcClient(oidcConfiguration);
oidcClient.setAuthorizationGenerator((ctx, profile) -> { profile.addRole("ROLE_ADMIN"); return profile; });
final SAML2Configuration cfg = new SAML2Configuration(new ClassPathResource("samlKeystore.jks"), "pac4j-demo-passwd", "pac4j-demo-passwd", new ClassPathResource("metadata-okta.xml"));
cfg.setMaximumAuthenticationLifetime(3600);
cfg.setServiceProviderEntityId("https://localhost:8080/callback?client_name=SAML2Client");
cfg.setServiceProviderMetadataResource(new FileSystemResource(new File("sp-metadata.xml").getAbsoluteFile()));
final SAML2Client saml2Client = new SAML2Client(cfg);
...
final CasConfiguration configuration = new CasConfiguration("https://casserverpac4j.herokuapp.com/login");
final CasClient casClient = new CasClient(configuration);
final SecretSignatureConfiguration secretSignatureConfiguration = new SecretSignatureConfiguration(salt);
final SecretEncryptionConfiguration secretEncryptionConfiguration = new SecretEncryptionConfiguration(salt);
final JwtAuthenticator authenticator = new JwtAuthenticator();
authenticator.setSignatureConfiguration(secretSignatureConfiguration);
authenticator.setEncryptionConfiguration(secretEncryptionConfiguration);
ParameterClient parameterClient = new ParameterClient("token", authenticator);
parameterClient.setSupportGetRequest(true);
parameterClient.setSupportPostRequest(false);
final DirectBasicAuthClient directBasicAuthClient = new DirectBasicAuthClient(new SimpleTestUsernamePasswordAuthenticator());
final Clients clients = new Clients("https://localhost:8080/callback", oidcClient, saml2Client, facebookClient,
twitterClient, formClient, indirectBasicAuthClient, casClient, parameterClient, directBasicAuthClient);
final Config config = new Config(clients);
config.addAuthorizer("admin", new RequireAnyRoleAuthorizer("ROLE_ADMIN"));
return config;
}
}
See a full example here.
You can’t perform that action at this time.