To secure a Play application with SAML, configure it as a service provider (SP): add the Play-pac4j integration and pac4j SAML client, register the SP metadata and callback address with your identity provider (IdP), then protect application actions. The browser is redirected to the IdP when an unauthenticated user reaches a protected action; after sign-in, the IdP posts a SAML response to your callback, where pac4j processes it and makes the resulting profile available to the application.
What you need before configuring SAML
You need a Play application, an IdP that can register an SP, and deployment-specific SAML values: the SP entity ID, callback (Assertion Consumer Service, or ACS) address, keystore credentials, and IdP metadata. The Play application is the SP; it does not become the IdP.
As an Amazon Associate I earn from qualifying purchases.
The official Play SAML guide’s Java example targets Play 3.0, Java 17 or later, and either Scala 2.13 or Scala 3. It lists play-pac4j version 13.0.3-PLAY3.0 and pac4j-saml version 6.5.8, along with Guice and Caffeine. These are example versions for that Play line, not universal recommendations. Use the matching artifact line for your Play release; the guide points Play 2.9 and 2.8 users to corresponding -PLAY2.9 and -PLAY2.8 lines. Check the current compatibility information and align dependencies before copying versions (pac4j SAML client documentation; play-pac4j project).
In sbt, the guide uses the Scala-aware %% notation to select the artifact for the application’s Scala version. Add both the Play integration and SAML client dependencies, retaining required transitive dependencies and checking application exclusions. The guide’s example dependency declarations and setup are at pac4j’s Play SAML guide.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Configure the service provider and its keys
Generate a keystore
The guide generates an RSA key pair in a JKS keystore under Play’s conf directory using Java keytool. Its example uses a 2048-bit key and a validity of 3650 days; these are sample configuration values, not a universal mandate. The SP key pair is used for signing requests and decrypting assertions. Replace the guide’s illustrative alias and passwords, and protect the keystore and credentials as deployment secrets rather than copying demonstration values into production.
Set SAML configuration values
Configure SAML2Configuration with the keystore path and passwords, IdP metadata location, SP entity ID, and path where the SP metadata should be written. The guide’s demo uses test IdP metadata; use metadata from the IdP configured for your application. Entity ID, ACS address, signing and decryption keys, metadata source, and IdP registration must agree for your deployment.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When initialized, the client writes SP metadata to the configured output path in the sample. Register that metadata with the IdP, or enter the corresponding entity ID and ACS URL in the IdP’s SP configuration. The IdP must send its response to the callback address your Play application serves. A mismatched entity ID or unregistered SP metadata can produce an unknown-service-provider error.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Wire pac4j into Play
Create one SAML client and a pac4j Config
Create a SAML2Client from the SAML configuration, then provide it through pac4j’s Config. The example sets the callback base URL with new Config(baseUrl + "/callback", saml2Client); pac4j appends its client-name parameter. Configure the callback URL to match the route and the ACS value registered at the IdP.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Keep and reuse a single SAML2Client instance so its replay-cache state persists between authentications. The SAML reference says to provide a custom replay-cache provider if the integration cannot reuse that instance (pac4j 6.5 SAML reference).
Install a pac4j session store
Pac4j needs a session store for state and profile handling in this Play setup. The Play session cookie alone is not the server-side store pac4j requires. The guide’s sample binds PlayCacheSessionStore to Play’s cache and installs it through config.setSessionStoreFactory. It also describes PlayCookieSessionStore, which stores encrypted state in the cookie without a cache. The guide does not compare their operational trade-offs, so choose based on the storage approach your deployment supports.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Bind callback and logout controllers and add routes
Use Guice bindings for pac4j’s CallbackController and LogoutController, and configure the default destinations and session behavior described in the guide. Add both GET and POST callback routes. Since the IdP sends the SAML assertion in a cross-origin POST, the sample’s POST route uses Play’s + nocsrf modifier; without it, Play’s CSRF filter may reject the callback with HTTP 403.
Protect application routes and read the profile
Choose action-level or URL-pattern protection
For Java actions, the guide demonstrates @Secure(clients = "SAML2Client"). An unauthenticated request to the protected action starts the indirect SAML flow; after successful callback processing, the original requested URL is restored.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
If protection belongs at the routing layer rather than on individual actions, the guide also describes a SecurityFilter for URL-pattern rules. Use authorizers when access should depend on roles or other profile criteria, rather than merely requiring a successful login. Scala developers can follow the Scala demo and library documentation for the corresponding integration.
Use attributes released by the IdP
After callback processing, pac4j provides a SAML profile containing attributes returned by the IdP. Pac4j can map raw attribute identifiers to readable names, but mapping does not cause an IdP to send an attribute: if a value is absent, check whether the IdP’s release policy grants it to this SP as well as whether your mapping is correct.
Distinguish local logout from SAML single logout
The basic /logout route removes the local login; it does not by itself sign the user out of the IdP or other applications. SAML single logout (SLO) is a separate central flow. The guide calls for a central logout controller configured for both local and central logout, IdP metadata that declares SingleLogoutService, and an SP request signature and binding that match the IdP’s expectations. Use local logout when removing the application’s own login is sufficient; configure SLO only when the IdP and its metadata support the required exchange.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Troubleshoot common integration failures
- Startup reports no session store: configure and install a pac4j session store, such as the guide’s cache-backed example.
- The IdP reports an unknown service provider: confirm the SP metadata or entity ID is registered and that the IdP’s SP entry matches the application.
- The callback returns HTTP 403: check that the POST callback route has Play’s
+ nocsrfmodifier. - An authentication-age check fails: check clock synchronization and the configured authentication lifetime. In the guide’s pac4j 6.5.8 example, a maximum authentication lifetime of zero disables that age check; assertion validity timestamps are still checked. Do not treat that sample setting as disabling SAML assertion validation generally.
- An expected profile attribute is missing: verify both the pac4j attribute mapping and the IdP’s attribute-release policy.
For protocol, client configuration, and version-specific details, consult the Play SAML integration guide, SAML client documentation, and versioned pac4j 6.5 SAML reference. Framework compatibility and dependency releases can change, so verify them against the project documentation for the versions your application uses.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
