Groups

Pac4j development mailing list

Contact owners and managers

1–30 of 338

0 selected

kamonkaushals sd, … Shane McDaniel7

Jan 9

Summary After upgrading play-pac4j from 12.0.0-PLAY3.0 to 12.0.1-PLAY3.0 (and higher), responses for pac4j-secured routes reissue cookies on every request: Session cookie is re-set each time with updated nbf/iat. CSRF cookie is also re-set each time

To be especially clear: A material change from 12.0.0 is the addition of: return playWebContext.

unread,

Summary After upgrading play-pac4j from 12.0.0-PLAY3.0 to 12.0.1-PLAY3.0 (and higher), responses for pac4j-secured routes reissue cookies on every request: Session cookie is re-set each time with updated nbf/iat. CSRF cookie is also re-set each time

To be especially clear: A material change from 12.0.0 is the addition of: return playWebContext.

Jan 9

Alexandre Pique, Jérôme LELEU4

Jan 5

Refresh OIDC token doesn't work with PrivateKeyJWT configuration

Hi, Good! Please submit a PR when you have time. Thanks. Best regards, Jérôme Le lun. 5 janv. 2026 à

unread,

Refresh OIDC token doesn't work with PrivateKeyJWT configuration

Hi, Good! Please submit a PR when you have time. Thanks. Best regards, Jérôme Le lun. 5 janv. 2026 à

Jan 5

Nathan Cailbourdin, Jérôme LELEU4

11/14/25

Possible issue with SAML metadata merge in pac4j >= 6.1.2

Hi, Great! I merged the PR and updated the release notes. A version 6.3.1 release will be cut at the

unread,

Possible issue with SAML metadata merge in pac4j >= 6.1.2

Hi, Great! I merged the PR and updated the release notes. A version 6.3.1 release will be cut at the

11/14/25

Nicolas Crittin, … Jérôme LELEU11

10/23/25

Non escaped redirect form

Hi, Yes, adding explicit charset seems a better option to me. Thanks. Best regards, Jérôme Le jeu. 23

unread,

Non escaped redirect form

Hi, Yes, adding explicit charset seems a better option to me. Thanks. Best regards, Jérôme Le jeu. 23

10/23/25

Anna Weber, Jérôme LELEU2

10/23/25

Backchannel logout - token validators do not include LogoutTokenValidator - type logout+jwt gets rejected

Hi, It makes sense. Feel free to subit a PR. Thanks. Best regards, Jérôme Le jeu. 23 oct. 2025, 11:46

unread,

Backchannel logout - token validators do not include LogoutTokenValidator - type logout+jwt gets rejected

Hi, It makes sense. Feel free to subit a PR. Thanks. Best regards, Jérôme Le jeu. 23 oct. 2025, 11:46

10/23/25

kamonkaushals sd, Jérôme LELEU5

10/13/25

CsrfTokenGeneratorMatcher sets cookie domain from serverName; incorrect behind API gateways. Please make domain configurable or forward-headers-aware

Hi, Please submit a PR. The discussion will be much easier. Thanks. Best regards, Jérôme Le lun. 13

unread,

CsrfTokenGeneratorMatcher sets cookie domain from serverName; incorrect behind API gateways. Please make domain configurable or forward-headers-aware

Hi, Please submit a PR. The discussion will be much easier. Thanks. Best regards, Jérôme Le lun. 13

10/13/25

Nicolas Crittin, Jérôme LELEU4

10/8/25

Unidentified component on SAML client with Artifact bindings

Done cf. PR #3613 Best Regards Nicolas Le mercredi 8 octobre 2025 à 09:12:25 UTC, lel...@gmail.com a

unread,

Unidentified component on SAML client with Artifact bindings

Done cf. PR #3613 Best Regards Nicolas Le mercredi 8 octobre 2025 à 09:12:25 UTC, lel...@gmail.com a

10/8/25

Ralf Wagner, … Jérôme LELEU6

9/15/25

pac4j-oidc with Keycloak 25+: Problem with ID token after refresh

Hi, Updating the code here is not that easy. But what you propose makes sense to me: a configuration

unread,

pac4j-oidc with Keycloak 25+: Problem with ID token after refresh

Hi, Updating the code here is not that easy. But what you propose makes sense to me: a configuration

9/15/25

Nicolas Crittin, Jérôme LELEU5

8/14/25

Regression on Basic authentication with pac4j 6.2.0

Hi, I just cut the v6.2.1 release. You can get rid of the snapshots now. Thanks. Best regards, Jérôme

unread,

Regression on Basic authentication with pac4j 6.2.0

Hi, I just cut the v6.2.1 release. You can get rid of the snapshots now. Thanks. Best regards, Jérôme

8/14/25

Ádám Csiszár, Jérôme LELEU2

4/16/25

SAML2Client ignores forceReinit in some functions

Hi, Yes, the check on forceReinit is a bit strange, but I guess it's necessary. It's a recent

unread,

SAML2Client ignores forceReinit in some functions

Hi, Yes, the check on forceReinit is a bit strange, but I guess it's necessary. It's a recent

4/16/25

Sakib Hadžiavdić, Jérôme LELEU2

4/3/25

Universal testkit for all frameworks

Hi, Yes, that fully makes sense. Do you mean integration tests (UI) or unit tests? Thanks. Best

unread,

Universal testkit for all frameworks

Hi, Yes, that fully makes sense. Do you mean integration tests (UI) or unit tests? Thanks. Best

4/3/25

3/17/25

discovery uri, seems to be hardcoded

I need to use a different discovery uri for an Azure B2C instance using a custom flow. org.pac4j.oidc

unread,

discovery uri, seems to be hardcoded

I need to use a different discovery uri for an Azure B2C instance using a custom flow. org.pac4j.oidc

3/17/25

yasper katgert, Jérôme LELEU8

2/20/25

Bug in JakarteEE JEEContext::FullRequestURL

Hi, I get it now. Excellent: good catch! I should now be fixed in the latest snapshots thanks to:

unread,

Bug in JakarteEE JEEContext::FullRequestURL

Hi, I get it now. Excellent: good catch! I should now be fixed in the latest snapshots thanks to:

2/20/25

Nicolas Crittin, Jérôme LELEU4

2/10/25

Request InputStream empty

Hi, I reverted my changes. Looks like we need a better solution here... Thanks. Best regards, Jérôme

unread,

Request InputStream empty

Hi, I reverted my changes. Looks like we need a better solution here... Thanks. Best regards, Jérôme

2/10/25

Kaushal Senevirathne, Nicolas Crittin2

2/10/25

direct-client logout when multiple tabs open and redirects to login page.

Hi, When you logout, all tabs should also be logged out too since cookies are common to all tabs, but

unread,

direct-client logout when multiple tabs open and redirects to login page.

Hi, When you logout, all tabs should also be logged out too since cookies are common to all tabs, but

2/10/25

Stéphane Gauchet

12/18/24

pac4j 5.7.7 (SAML and CAS) with JKD 17 and springboot 3.3.3

Hi, Are there any contraindications to use pac4j v5.7.7 (clients SAML and CAS) with JDK 17 and

unread,

pac4j 5.7.7 (SAML and CAS) with JKD 17 and springboot 3.3.3

Hi, Are there any contraindications to use pac4j v5.7.7 (clients SAML and CAS) with JDK 17 and

12/18/24

Stéphane Gauchet, Jérôme LELEU3

12/16/24

Documentation v6 needs upgrade for "how to framework"

All right thanks! i thought that was the docs for only the v6.1.x... Have a good day! Le lundi 16

unread,

Documentation v6 needs upgrade for "how to framework"

All right thanks! i thought that was the docs for only the v6.1.x... Have a good day! Le lundi 16

12/16/24

Stéphane Gauchet, Jérôme LELEU2

12/6/24

replacement of Pac4JHttpServletRequestWrapper

Hi, This class: Pac4JHttpServletRequestWrapper is in the javaee-pac4j or jakartaee-pac4j project.

unread,

replacement of Pac4JHttpServletRequestWrapper

Hi, This class: Pac4JHttpServletRequestWrapper is in the javaee-pac4j or jakartaee-pac4j project.

12/6/24

11/28/24

Re: DirectClient UnsupportedOperationException

Hi, Please open a PR for any change or bugfix with complete stack traces. Thanks. Best regards,

unread,

Re: DirectClient UnsupportedOperationException

Hi, Please open a PR for any change or bugfix with complete stack traces. Thanks. Best regards,

11/28/24

James Nord, Jérôme LELEU2

10/28/24

pac4j oidc swallows important exceptions.

Hi, It makes sense. Please submit PRs to the master and 5.7.x branches. Thanks. Best regards, Jérôme

unread,

pac4j oidc swallows important exceptions.

Hi, It makes sense. Please submit PRs to the master and 5.7.x branches. Thanks. Best regards, Jérôme

10/28/24

James Nord, Jérôme LELEU2

10/8/24

5.7.x branch and status

Hi, This is what you are looking for: https://www.pac4j.org/docs/backward-compatibility.html By

unread,

5.7.x branch and status

Hi, This is what you are looking for: https://www.pac4j.org/docs/backward-compatibility.html By

10/8/24

Eugen Stan, Jérôme LELEU3

8/27/24

Documentation website has same title

Hi, Thank you. It's good enough for me. I refetched content and titles updated. Unfortunatelly,

unread,

Documentation website has same title

Hi, Thank you. It's good enough for me. I refetched content and titles updated. Unfortunatelly,

8/27/24

James Carter, Jérôme LELEU3

8/9/24

InitializableObject: thread safety concerns

Hi, It makes sense. Thanks. Best regards, Jérôme Le ven. 9 août 2024 à 13:25, James Carter <

unread,

InitializableObject: thread safety concerns

Hi, It makes sense. Thanks. Best regards, Jérôme Le ven. 9 août 2024 à 13:25, James Carter <

8/9/24

Arjan van de Kamp2

7/15/24

Fix for curly braces in Microsoft issuer UR

https://github.com/pac4j/pac4j/pull/2960 Op zondag 14 juli 2024 om 17:57:29 UTC+2 schreef Arjan van

unread,

Fix for curly braces in Microsoft issuer UR

https://github.com/pac4j/pac4j/pull/2960 Op zondag 14 juli 2024 om 17:57:29 UTC+2 schreef Arjan van

7/15/24

Arjan van de Kamp

7/14/24

Fix for curly braces in Microsoft issuer URL

Hi, I am currently working on a project where we use Microsoft as an OpenID provider. Recently, we

unread,

Fix for curly braces in Microsoft issuer URL

Hi, I am currently working on a project where we use Microsoft as an OpenID provider. Recently, we

7/14/24

Jeff Grossman, Jérôme LELEU3

7/14/24

Pac4J 6.0.3 and OIDC and JWT

Hello, My apologies for letting this dangle so long. In the end, we did not try the new snapshot. I

unread,

Pac4J 6.0.3 and OIDC and JWT

Hello, My apologies for letting this dangle so long. In the end, we did not try the new snapshot. I

7/14/24

7/4/24

Incorrect IdP metadata resolver initialization in SAML2Configuration

Hi, I noticed that in v6.0.4.1, it became impossible to properly set an IdP metadata resource on an

unread,

Incorrect IdP metadata resolver initialization in SAML2Configuration

Hi, I noticed that in v6.0.4.1, it became impossible to properly set an IdP metadata resource on an

7/4/24

Ioan Eugen Stan, Jérôme LELEU3

6/28/24

pac4j for clojure ring + reitit WIP

Thank you, I will do it privatly first and when it's ready we can transfer it to pac4j. Thank you

unread,

pac4j for clojure ring + reitit WIP

Thank you, I will do it privatly first and when it's ready we can transfer it to pac4j. Thank you

6/28/24

Ioan Eugen Stan, Jérôme LELEU3

6/27/24

Does JBCryptPasswordEncoder reuse the same salt?

Merci :) Pe luni, 24 iunie 2024, la 19:00:48 UTC+3, lel...@gmail.com a scris: Hi, I'm in line.

unread,

Does JBCryptPasswordEncoder reuse the same salt?

Merci :) Pe luni, 24 iunie 2024, la 19:00:48 UTC+3, lel...@gmail.com a scris: Hi, I'm in line.

6/27/24

Fabio, Jérôme LELEU2

6/10/24

buji-pac4j with shiro 2.0

Hi, Nothing is planned yet. Feel free to submit a PR for that. Thanks. Best regards, Jérôme Le ven. 7

unread,

buji-pac4j with shiro 2.0

Hi, Nothing is planned yet. Feel free to submit a PR for that. Thanks. Best regards, Jérôme Le ven. 7

6/10/24

Search

Clear search

Close search

Google apps

Main menu