To add browser-based SAML single sign-on to Javalin, configure a pac4j SAML2Client with your service provider (SP) keys and identity provider (IdP) metadata, protect the routes that require authentication, and register a POST callback for the IdP’s assertion. You must also register the SP metadata and matching entity ID with the IdP. The exact dependency versions matter: the pac4j integration README maps javalin-pac4j 8 to Javalin 7, pac4j 6 and Java 17, while its 7.x line is mapped to Javalin 5.6, pac4j 6 and Java 17. Check the project’s current compatibility guidance before choosing versions.
Choose compatible versions before configuring SAML
The integration’s compatibility table is the starting point, not a guarantee that a listed version is the latest. The official Javalin SAML tutorial shows Javalin 7.0.1, javalin-pac4j 8.0.0 and pac4j-saml 6.5.8. Treat that set as the tutorial’s documented example. Resolve a compatible, currently released dependency set for your application using the javalin-pac4j README and your build’s dependency repository.
As an Amazon Associate I earn from qualifying purchases.
| javalin-pac4j line | Javalin | pac4j | Java |
|---|---|---|---|
| 8 | 7 | 6 | 17 |
| 7 | 5.6 | 6 | 17 |
These are the combinations documented by the README; confirm the specific artifact versions and requirements before upgrading or starting a project.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Create and protect the SP key material
A SAML service provider needs key material for signing and encryption operations. The pac4j Javalin tutorial demonstrates generating a keystore with Java’s keytool. Use the tutorial’s command as an example of the process, adapting its options to your organization’s certificate and IdP requirements rather than treating demo settings as production defaults.
#1 Best Overall
- Standard OATH compliant TOTP token (time based)
- 6-digit OTP code with countdown time bar
- Zero footprint: no need for the end user to install any software
- Secure, sturdy, and long-life hardware design
- Easy to use - Portable key chain design. These tokens will only work with Symantec VIP Access. These tokens will not work for any other Multi-Factor Authentication services, besides Symantec VIP Access.
Store the keystore and its passwords as deployment-managed secrets. Do not carry tutorial passwords into production or commit private keys to source control. pac4j also documents an option to create a keystore automatically in a writable resource, but production deployments should have an intentional key lifecycle and protected storage for signing keys. See the pac4j SAML client reference for configuration options.
Configure a SAML2Client from SP and IdP data
Create a SAML2Configuration with the keystore location, store and private-key passwords, IdP metadata, SP entity ID and SP metadata output location. Use those settings to construct one SAML2Client, then add that client to pac4j’s Config. The client name must also be consistent with the callback configuration used by the integration.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
After a successful authentication, pac4j provides a SAML2Profile. Application code can use that specific profile when it needs SAML-specific attributes, or the common UserProfile abstraction when it only needs general profile information.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRegister matching SP metadata with the IdP
Exchange metadata with the IdP before testing login. Register the generated SP metadata at the IdP, and keep the SP entity ID and assertion consumer service (ACS) URL aligned with the values configured in the application. The ACS is the callback endpoint to which the IdP posts the SAML response.
Rank #3
- OTP token that provides secure remote access with strong authentication
- Easy to use and easy to carry
- Expected battery life is approximately 7 years
An IdP error such as “unknown service provider” commonly means that the SP has not been registered or that the entity ID being sent does not match the registered SP. Compare the configured entity ID, generated metadata and IdP registration rather than changing unrelated route code.
Protect routes and register the callback and logout handlers
Authentication, assertion handling and logout are separate integration responsibilities. The javalin-pac4j README describes the Javalin handlers; the framework-specific tutorial shows them in a SAML flow.
Rank #4
- Works with authentication systems that support TOTP tokens: Google, Facebook, Coinbase, GDAX, Dropbox, GitHub, Kickstarter, Microsoft, TeamViewer, etc.
- Programmable an unlimited number of times. Features syncable clock to prevent issues with drift
- About half the size of a credit card and just as thick-easily keep multiple cards in wallet
- Works with "Token2 Token Burner" or "Protectimus TOTP Burner", both available in the Google Play Store. Now also iOS compatible (iPhone 7 and later)
- More secure than software token as your codes cannot be intercepted by malware on your phone.
- Protect selected routes: attach a Javalin
beforehandler usingSecurityHandlerto paths that require authentication. - Receive the SAML response: register the callback handler for the indirect SAML flow on a route reachable with HTTP POST. The IdP posts its assertion to the ACS, so the callback path must match the URL configured for the SP and registered in IdP metadata.
- Handle logout: add
LogoutHandlerand choose whether your application needs local logout only or global logout through the IdP.
Check Javalin’s route matching carefully. The tutorial notes that /protected and /protected/* are distinct patterns. Protect the base route and any nested paths your application intends to restrict; protecting one pattern does not imply the other is covered.
Preserve replay-cache state across authentications
Keep one SAML2Client instance so its replay cache retains state between authentications. Creating clients per request without a state design can lead to intermittent replay or state failures. The pac4j SAML reference documents a custom ReplayCacheProvider for deployments that cannot retain a single client instance, including architectures that need an alternative shared-state arrangement.
Verify bindings against the actual identity provider
Do not assume a tutorial’s test IdP behaves like your production IdP. Use the organization’s actual IdP metadata and confirm its endpoint URLs and supported bindings. Provider-specific behavior matters: pac4j’s reference notes that its SimpleSAMLphp case requires HTTP-POST bindings for both SSO and SLO, while SimpleSAMLphp may expose only HTTP-Redirect by default. Enable the required binding and register the SP entity ID at that IdP.
Quick Recap
Troubleshoot common integration failures
- “Unknown service provider” from the IdP: compare the application’s SP entity ID and ACS URL with the SP metadata registered at the IdP.
- An anonymous request reaches a protected page: verify that the Javalin
beforehandler covers both the base path and intended nested route patterns. - The callback is rejected or never completes: check that the callback accepts POST, its URL matches the configured ACS, and the SAML client name agrees with pac4j’s callback configuration.
- The IdP rejects an endpoint or binding: inspect the IdP metadata and required bindings; in the documented SimpleSAMLphp case, SSO and SLO need HTTP-POST.
- Replay or state failures occur intermittently: retain one client instance or use a custom replay-cache provider with state shared appropriately for the deployment.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
