pac4j Release Notes

• Moved most test components from the org.pac4j.test package of the pac4j-core module into the new pac4j-test module (only MockWebContext, MockSessionStore, TestsConstants and TestsHelper remain in pac4j-core)
• Update dependencies. Especially Spring v7: although the project is built against this version, you may use older versions of Spring
• Rework the SpringResourceLoader behavior to improve the OIDC/SAML metadata loading resilience:
  • retry every 2 seconds before anything has been loaded
  • retry every 60 seconds after the first loading and return the old data in case of error
  • the minimumDelayBetweenChangeDetectionInMilliseconds property is deprecated and ignored (with a warning)
• Fix OpenID federation forced signing of the auth request object for explicitly registered clients when it is not mandatory
• OIDC’s login hints can be provided dynamically as a login_hint request attribute
• Only empty credentials or a CredentialsException (from the CredentialsExtractor or the Authenticator) now block further authentication attempts of an indirect client: any other exception allows a retry.
• Added the ConcurrentMapStore, a Store expiring its entries (without any additional dependency), and the AbstractConcurrentMapStore for the values carrying their own expiration date
• The DefaultSessionLogoutHandler now uses a ConcurrentMapStore by default (30 minutes, no maximum size) instead of a GuavaStore: the pac4j-core module no longer needs Guava, unless a GuavaStore is configured
• Updated the JwkHelper:
  • buildSignedJwt can now publish in the x5c header the certificate chain the signing key carries, for the protocols binding the identity of the signer to a certificate rather than to a key
  • the new resolveSigningKey method reads the signing key from a JWKS, or from a keystore when the JWKS is not defined, the logic the OpenID federation used to hold
  • the new generateKey method creates a signature key for a given algorithm, and loadJwkFromOrCreateJwks takes an optional algorithm for the key it creates when none exists yet, the default staying RSA-2048
  • a signing key loaded from a keystore now carries the whole certificate chain of its entry, intermediate authorities included, instead of the certificate of the alias alone
• Added the OpenID4VP protocol support via the new pac4j-openid4vp module and the EudiWalletClient, OpenId4VpClient and OpenId4VpDcApiClient clients (+ OpenId4VpConfiguration and OpenId4VpDcApiConfiguration configurations)
• Added the ResourceProperties to define a resource by its path (new ResourceProperties(path)); the KeystoreProperties and JwksProperties now extend it (new KeystoreProperties(path), new JwksProperties(path)): use getResource(), setResource(...), setPath(...), the getKeystoreResource(), setKeystoreResource(...), setKeystorePath(...), getJwksResource(), setJwksResource(...) and setJwksPath(...) methods being deprecated
• The SAML identity and service provider metadata are now defined by ResourceProperties: use getIdentityProviderMetadata() and getServiceProviderMetadata(), the SAML2Configuration constructors and methods based on a Resource or a path for the keystore or the metadata being deprecated in favor of the SAML2Configuration(KeystoreProperties, ResourceProperties) constructor
• The JWKS of an OpenID federation trust anchor is now defined by JwksProperties: use getJwks() and the OidcTrustAnchorProperties(String, JwksProperties) constructor, the getJwksResource(), setJwksResource(...) and setJwksPath(...) methods and the other constructors being deprecated
• The messages exchanged by the SAML, CAS, OAuth, OpenID Connect and OpenID4VP supports are logged raw on the PROTOCOL_MESSAGE.SAML, PROTOCOL_MESSAGE.CAS, PROTOCOL_MESSAGE.OAUTH, PROTOCOL_MESSAGE.OIDC and PROTOCOL_MESSAGE.OPENID4VP loggers (all children of the PROTOCOL_MESSAGE logger), at DEBUG level, one line per message with its direction, the secrets of the application being masked (see the ProtocolMessages class and the SAML2ProtocolMessages, CasProtocolMessages, OAuthProtocolMessages, OidcProtocolMessages and OpenId4VpProtocolMessages classes): they are no longer logged on the loggers of the SAML, CAS, OAuth and OIDC classes, and SAML2Utils.logProtocolMessage is deprecated
• Normalize path in JEEContext.getPath()
• JwtAuthenticator: reject RSA/EC-only encryption without a signature; warn for other encryption-only configurations

Security fixes/hardenings

• An unsigned SAML LogoutRequest can no longer destroy a session based on the NameID (when the IdP sends no SessionIndex) unless the signature is validated
• Fix an open redirect in the logout
• Fix the reversed profile type check of the CheckProfileTypeAuthorizer (this may change the outcome of existing type checks in both directions)
• The OIDC callback no longer accepts an access token without an authorization code or an ID token
• The UserInfo subject is now compared to the ID token subject if available
• The Keycloak access token is now validated before its roles are added to the profile (no role is added if it cannot be validated)
• Display a warning if no state parameter is enabled for the OAuth 2 protocol
• Upgrade httpclient5 (and httpclient5-cache) to v5.6.4 and httpcore5 to v5.4.3 as a precaution against three CVEs (CVE-2026-54399, CVE-2026-54428, CVE-2026-71290)
• JEESessionStore: Consider invalidated session in set method (handle IllegalStateException)

• Fix OpenID federation explicit registration request Content-Type value to application/entity-statement+jwt
• Fix OpenID federation explicit registration response Content-Type validation to expect application/explicit-registration-response+jwt
• Added missing audience claim to the OpenID federation explicit registration request
• respect scope, token_endpoint_auth_method, request_object_signing_alg, id_token_signed_response_alg and response_types claims from OpenID federation explicit registration response

• Removed the GAE, CouchDB and SpringBoot modules
• Created the org.pac4j.test package for test components in the pac4j-core module instead of test-jar modules
• Removed the shading Maven phase
• Update PMD plugin (v3.28.0)
• Deprecated the “legacy mode” for the (Ldap|Db|Mongo)ProfileService
• Default serializer for (Ldap|Db|Mongo)ProfileService is JsonSerializer (JavaSerializer is deprecated)
• Fix missing JWKS for request object signing
• OpenID Federation support:
  • saves the received secret into a file during an explicit registration
• Generalized the Announcement concept to existing warnings here and there

• Upgrade to Shiro v2.1 for security reasons. Defaults remain the ones of Shiro v1.13 though and will change in a future major version.
• Add the encryptionRequired flag (by default false) for the JWtAuthenticator
• KeystoreGenerator and its implementation FileSystemKeystoreGenerator are now in the core (copy/pasted from the SAML components)

OIDC support

• get/setPreferredJwsAlgorithm is deprecated in favor of get/setIdTokenSigningAlgorithm
• it supports the client_secret_jwt authentication method via the PrivateKeyJwtClientAuthnMethodConfig (PrivateKeyJWTClientAuthnMethodConfig is deprecated)
• it supports the request object signing (on the authorization URL) via the config.setRequestObjectSigningAlgorithm
• it supports the PAR mechanism on the authorization URL
• Support for the OpenID Connect Federation protocol v1.0
• Improve object initialization by avoiding re-entrant calls
• Limit detection change in SpringResourceLoader (interval: 60s)
• The JWKHelper (pac4j-jwt) is deprecated and replaced by JwkHelper (in pac4j-core) for pac4j-jwt and pac4j-oidc
• The pac4j-gae, pac4j-couchdb and pac4j-springboot modules are deprecated and will be removed in the next version 6.5.0
• The pac4j-javaee module is deprecated and you should upgrade to the pac4j-jakartaee module
• The pac4j-config module is deprecated: you should define your pac4j configuration programmatically