Groups

Pac4j development mailing list

Contact owners and managers

1–30 of 337

0 selected

Nathan Cailbourdin, Jérôme LELEU4

Nov 14

Possible issue with SAML metadata merge in pac4j >= 6.1.2

Hi, Great! I merged the PR and updated the release notes. A version 6.3.1 release will be cut at the

unread,

Possible issue with SAML metadata merge in pac4j >= 6.1.2

Hi, Great! I merged the PR and updated the release notes. A version 6.3.1 release will be cut at the

Nov 14

kamonkaushals sd, Jérôme LELEU2

Nov 7

Summary After upgrading play-pac4j from 12.0.0-PLAY3.0 to 12.0.1-PLAY3.0 (and higher), responses for pac4j-secured routes reissue cookies on every request: Session cookie is re-set each time with updated nbf/iat. CSRF cookie is also re-set each time

Hi, Sorry for my late reply. It wasn't easy to investigate this problem. It mainly comes from:

unread,

Summary After upgrading play-pac4j from 12.0.0-PLAY3.0 to 12.0.1-PLAY3.0 (and higher), responses for pac4j-secured routes reissue cookies on every request: Session cookie is re-set each time with updated nbf/iat. CSRF cookie is also re-set each time

Hi, Sorry for my late reply. It wasn't easy to investigate this problem. It mainly comes from:

Nov 7

Nicolas Crittin, … Jérôme LELEU11

Oct 23

Non escaped redirect form

Hi, Yes, adding explicit charset seems a better option to me. Thanks. Best regards, Jérôme Le jeu. 23

unread,

Non escaped redirect form

Hi, Yes, adding explicit charset seems a better option to me. Thanks. Best regards, Jérôme Le jeu. 23

Oct 23

Anna Weber, Jérôme LELEU2

Oct 23

Backchannel logout - token validators do not include LogoutTokenValidator - type logout+jwt gets rejected

Hi, It makes sense. Feel free to subit a PR. Thanks. Best regards, Jérôme Le jeu. 23 oct. 2025, 11:46

unread,

Backchannel logout - token validators do not include LogoutTokenValidator - type logout+jwt gets rejected

Hi, It makes sense. Feel free to subit a PR. Thanks. Best regards, Jérôme Le jeu. 23 oct. 2025, 11:46

Oct 23

kamonkaushals sd, Jérôme LELEU5

Oct 13

CsrfTokenGeneratorMatcher sets cookie domain from serverName; incorrect behind API gateways. Please make domain configurable or forward-headers-aware

Hi, Please submit a PR. The discussion will be much easier. Thanks. Best regards, Jérôme Le lun. 13

unread,

CsrfTokenGeneratorMatcher sets cookie domain from serverName; incorrect behind API gateways. Please make domain configurable or forward-headers-aware

Hi, Please submit a PR. The discussion will be much easier. Thanks. Best regards, Jérôme Le lun. 13

Oct 13

Nicolas Crittin, Jérôme LELEU4

Oct 8

Unidentified component on SAML client with Artifact bindings

Done cf. PR #3613 Best Regards Nicolas Le mercredi 8 octobre 2025 à 09:12:25 UTC, lel...@gmail.com a

unread,

Unidentified component on SAML client with Artifact bindings

Done cf. PR #3613 Best Regards Nicolas Le mercredi 8 octobre 2025 à 09:12:25 UTC, lel...@gmail.com a

Oct 8

Ralf Wagner, … Jérôme LELEU6

Sep 15

pac4j-oidc with Keycloak 25+: Problem with ID token after refresh

Hi, Updating the code here is not that easy. But what you propose makes sense to me: a configuration

unread,

pac4j-oidc with Keycloak 25+: Problem with ID token after refresh

Hi, Updating the code here is not that easy. But what you propose makes sense to me: a configuration

Sep 15

Nicolas Crittin, Jérôme LELEU5

Aug 14

Regression on Basic authentication with pac4j 6.2.0

Hi, I just cut the v6.2.1 release. You can get rid of the snapshots now. Thanks. Best regards, Jérôme

unread,

Regression on Basic authentication with pac4j 6.2.0

Hi, I just cut the v6.2.1 release. You can get rid of the snapshots now. Thanks. Best regards, Jérôme

Aug 14

Ádám Csiszár, Jérôme LELEU2

Apr 16

SAML2Client ignores forceReinit in some functions

Hi, Yes, the check on forceReinit is a bit strange, but I guess it's necessary. It's a recent

unread,

SAML2Client ignores forceReinit in some functions

Hi, Yes, the check on forceReinit is a bit strange, but I guess it's necessary. It's a recent

Apr 16

Sakib Hadžiavdić, Jérôme LELEU2

Apr 3

Universal testkit for all frameworks

Hi, Yes, that fully makes sense. Do you mean integration tests (UI) or unit tests? Thanks. Best

unread,

Universal testkit for all frameworks

Hi, Yes, that fully makes sense. Do you mean integration tests (UI) or unit tests? Thanks. Best

Apr 3

Mar 17

discovery uri, seems to be hardcoded

I need to use a different discovery uri for an Azure B2C instance using a custom flow. org.pac4j.oidc

unread,

discovery uri, seems to be hardcoded

I need to use a different discovery uri for an Azure B2C instance using a custom flow. org.pac4j.oidc

Mar 17

yasper katgert, Jérôme LELEU8

Feb 20

Bug in JakarteEE JEEContext::FullRequestURL

Hi, I get it now. Excellent: good catch! I should now be fixed in the latest snapshots thanks to:

unread,

Bug in JakarteEE JEEContext::FullRequestURL

Hi, I get it now. Excellent: good catch! I should now be fixed in the latest snapshots thanks to:

Feb 20

Nicolas Crittin, Jérôme LELEU4

Feb 10

Request InputStream empty

Hi, I reverted my changes. Looks like we need a better solution here... Thanks. Best regards, Jérôme

unread,

Request InputStream empty

Hi, I reverted my changes. Looks like we need a better solution here... Thanks. Best regards, Jérôme

Feb 10

Kaushal Senevirathne, Nicolas Crittin2

Feb 10

direct-client logout when multiple tabs open and redirects to login page.

Hi, When you logout, all tabs should also be logged out too since cookies are common to all tabs, but

unread,

direct-client logout when multiple tabs open and redirects to login page.

Hi, When you logout, all tabs should also be logged out too since cookies are common to all tabs, but

Feb 10

Stéphane Gauchet

12/18/24

pac4j 5.7.7 (SAML and CAS) with JKD 17 and springboot 3.3.3

Hi, Are there any contraindications to use pac4j v5.7.7 (clients SAML and CAS) with JDK 17 and

unread,

pac4j 5.7.7 (SAML and CAS) with JKD 17 and springboot 3.3.3

Hi, Are there any contraindications to use pac4j v5.7.7 (clients SAML and CAS) with JDK 17 and

12/18/24

Stéphane Gauchet, Jérôme LELEU3

12/16/24

Documentation v6 needs upgrade for "how to framework"

All right thanks! i thought that was the docs for only the v6.1.x... Have a good day! Le lundi 16

unread,

Documentation v6 needs upgrade for "how to framework"

All right thanks! i thought that was the docs for only the v6.1.x... Have a good day! Le lundi 16

12/16/24

Stéphane Gauchet, Jérôme LELEU2

12/6/24

replacement of Pac4JHttpServletRequestWrapper

Hi, This class: Pac4JHttpServletRequestWrapper is in the javaee-pac4j or jakartaee-pac4j project.

unread,

replacement of Pac4JHttpServletRequestWrapper

Hi, This class: Pac4JHttpServletRequestWrapper is in the javaee-pac4j or jakartaee-pac4j project.

12/6/24

11/28/24

Re: DirectClient UnsupportedOperationException

Hi, Please open a PR for any change or bugfix with complete stack traces. Thanks. Best regards,

unread,

Re: DirectClient UnsupportedOperationException

Hi, Please open a PR for any change or bugfix with complete stack traces. Thanks. Best regards,

11/28/24

James Nord, Jérôme LELEU2

10/28/24

pac4j oidc swallows important exceptions.

Hi, It makes sense. Please submit PRs to the master and 5.7.x branches. Thanks. Best regards, Jérôme

unread,

pac4j oidc swallows important exceptions.

Hi, It makes sense. Please submit PRs to the master and 5.7.x branches. Thanks. Best regards, Jérôme

10/28/24

James Nord, Jérôme LELEU2

10/8/24

5.7.x branch and status

Hi, This is what you are looking for: https://www.pac4j.org/docs/backward-compatibility.html By

unread,

5.7.x branch and status

Hi, This is what you are looking for: https://www.pac4j.org/docs/backward-compatibility.html By

10/8/24

Eugen Stan, Jérôme LELEU3

8/27/24

Documentation website has same title

Hi, Thank you. It's good enough for me. I refetched content and titles updated. Unfortunatelly,

unread,

Documentation website has same title

Hi, Thank you. It's good enough for me. I refetched content and titles updated. Unfortunatelly,

8/27/24

James Carter, Jérôme LELEU3

8/9/24

InitializableObject: thread safety concerns

Hi, It makes sense. Thanks. Best regards, Jérôme Le ven. 9 août 2024 à 13:25, James Carter <

unread,

InitializableObject: thread safety concerns

Hi, It makes sense. Thanks. Best regards, Jérôme Le ven. 9 août 2024 à 13:25, James Carter <

8/9/24

Arjan van de Kamp2

7/15/24

Fix for curly braces in Microsoft issuer UR

https://github.com/pac4j/pac4j/pull/2960 Op zondag 14 juli 2024 om 17:57:29 UTC+2 schreef Arjan van

unread,

Fix for curly braces in Microsoft issuer UR

https://github.com/pac4j/pac4j/pull/2960 Op zondag 14 juli 2024 om 17:57:29 UTC+2 schreef Arjan van

7/15/24

Arjan van de Kamp

7/14/24

Fix for curly braces in Microsoft issuer URL

Hi, I am currently working on a project where we use Microsoft as an OpenID provider. Recently, we

unread,

Fix for curly braces in Microsoft issuer URL

Hi, I am currently working on a project where we use Microsoft as an OpenID provider. Recently, we

7/14/24

Jeff Grossman, Jérôme LELEU3

7/14/24

Pac4J 6.0.3 and OIDC and JWT

Hello, My apologies for letting this dangle so long. In the end, we did not try the new snapshot. I

unread,

Pac4J 6.0.3 and OIDC and JWT

Hello, My apologies for letting this dangle so long. In the end, we did not try the new snapshot. I

7/14/24

7/4/24

Incorrect IdP metadata resolver initialization in SAML2Configuration

Hi, I noticed that in v6.0.4.1, it became impossible to properly set an IdP metadata resource on an

unread,

Incorrect IdP metadata resolver initialization in SAML2Configuration

Hi, I noticed that in v6.0.4.1, it became impossible to properly set an IdP metadata resource on an

7/4/24

Ioan Eugen Stan, Jérôme LELEU3

6/28/24

pac4j for clojure ring + reitit WIP

Thank you, I will do it privatly first and when it's ready we can transfer it to pac4j. Thank you

unread,

pac4j for clojure ring + reitit WIP

Thank you, I will do it privatly first and when it's ready we can transfer it to pac4j. Thank you

6/28/24

Ioan Eugen Stan, Jérôme LELEU3

6/27/24

Does JBCryptPasswordEncoder reuse the same salt?

Merci :) Pe luni, 24 iunie 2024, la 19:00:48 UTC+3, lel...@gmail.com a scris: Hi, I'm in line.

unread,

Does JBCryptPasswordEncoder reuse the same salt?

Merci :) Pe luni, 24 iunie 2024, la 19:00:48 UTC+3, lel...@gmail.com a scris: Hi, I'm in line.

6/27/24

Fabio, Jérôme LELEU2

6/10/24

buji-pac4j with shiro 2.0

Hi, Nothing is planned yet. Feel free to submit a PR for that. Thanks. Best regards, Jérôme Le ven. 7

unread,

buji-pac4j with shiro 2.0

Hi, Nothing is planned yet. Feel free to submit a PR for that. Thanks. Best regards, Jérôme Le ven. 7

6/10/24

Norman Lorenz, Jérôme LELEU6

5/30/24

No ID in profile created by OidcProfileCreator

Hi, Excellent! The fix has been ported forward to the master branch. Thanks. Best regards, Jérôme Le

unread,

No ID in profile created by OidcProfileCreator

Hi, Excellent! The fix has been ported forward to the master branch. Thanks. Best regards, Jérôme Le

5/30/24

Search

Clear search

Close search

Google apps

Main menu