Free tools Windows power users keep installed
One-click scans. No signup required.
To require an OIDC login for selected Spark Java routes, configure pac4j’s OidcClient, attach a SecurityFilter to the routes you want to protect, and register a callback route that completes sign-in. The key deployment details are exact callback URL registration, explicit coverage of nested Spark paths, and keeping client secrets and tokens on the server.
What the integration does
pac4j-oidc handles the OpenID Connect client flow, while spark-pac4j connects pac4j security to Spark routes. A request to a protected route without an authenticated session is redirected into the provider’s login flow. After the provider returns to the callback, pac4j validates the response, stores the profile in the session, and redirects the user to the page they originally requested.
As an Amazon Associate I earn from qualifying purchases.
Use the provider’s OIDC discovery metadata and authorization-code flow, and confirm that the provider supports the client authentication method and claims your application needs. pac4j documents its generic OIDC client for providers including Keycloak, Google, Microsoft Entra ID, and Okta; provider capabilities and configuration requirements vary. See the pac4j OIDC client reference.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteAlign dependencies and Java versions
The pac4j Spark walkthrough demonstrates Spark 2.9.4, spark-pac4j 6.0.0, pac4j-oidc 6.5.8, and Java 17. These are the versions shown in that guide, not a guarantee that they are the latest available releases. Its guidance is that spark-pac4j 6 targets pac4j 6 and Spark 2.9; the integration brings in the corresponding pac4j-javaee module.
Choose compatible versions together rather than mixing major lines. pac4j’s repository compatibility table lists JDK 17 for pac4j 6.x, JDK 11 for 5.x, and JDK 8 for 4.x. Check the project’s release documentation when upgrading because version availability can change.
Maven dependency example
For the versions used in the guide, declare the OIDC client and Spark integration dependencies:
<dependency>
<groupId>org.pac4j</groupId>
<artifactId>pac4j-oidc</artifactId>
<version>6.5.8</version>
</dependency>
<dependency>
<groupId>org.pac4j</groupId>
<artifactId>spark-pac4j</artifactId>
<version>6.0.0</version>
</dependency>Use these as a guide-aligned example, and verify compatibility against the versions you select.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #2
Configure the OIDC client and callback URL
Create an OidcConfiguration with the identity provider’s discovery URI, client ID, and client secret. Pass it to an OidcClient, then add that client to pac4j’s Config with the callback URL. Discovery metadata supplies the provider endpoints and related configuration. The pac4j guide uses the client name OidcClient; using a consistent name matters because it appears in the callback URL and route filter configuration.
OidcConfiguration oidcConfiguration = new OidcConfiguration();
oidcConfiguration.setDiscoveryURI("https://identity.example/.well-known/openid-configuration");
oidcConfiguration.setClientId(clientId);
oidcConfiguration.setSecret(clientSecret);
OidcClient oidcClient = new OidcClient(oidcConfiguration);
Config config = new Config("https://app.example/callback?client_name=OidcClient");
config.setClients(oidcClient);This illustrates the configuration relationship; use the exact APIs and constructors documented for the pac4j version in your project. Supply secrets from server-side configuration rather than committing them to source code.
Register the exact external callback URI
Register the complete callback URL with the provider, including scheme, host, port if present, path, and pac4j’s ?client_name=OidcClient query parameter. The externally registered value must match the URI the application actually uses. If a reverse proxy terminates TLS or changes host information, configure the application and proxy so the generated callback is the public HTTPS URL. OIDC requests must use HTTPS; see the Spark Platform OIDC security guidance.
Protect only the routes that should require login
Attach pac4j’s SecurityFilter as a Spark before filter, passing the configured OIDC client name. If a request has no authenticated session, the filter starts the provider login flow and prevents the protected route from running. The filter can also receive pac4j authorizers when access depends on roles or other authorization conditions.
SecurityFilter securityFilter = new SecurityFilter(config, "OidcClient");
before("/protected", securityFilter);
before("/protected/*", securityFilter);In the Spark guide, before("/protected") and before("/protected/*") are distinct matches. Add filters for every pattern your application serves; do not assume that protecting a parent path automatically covers every nested route. Also review routes such as alternate HTTP methods and aliases if they expose the same protected data.
Complete the login at the callback route
Register pac4j’s CallbackRoute at the callback path used in the OIDC client configuration. The callback processes the provider’s response, validates it, establishes the profile in the session, and redirects to the originally requested page. The guide enables session renewal on callback to help guard against session fixation.
Rank #4
The default authorization-code flow returns to the callback by GET. Register a POST callback as well when the provider or response mode may use form_post. The pac4j 6.2 clients documentation describes indirect-client flow and callback behavior; configure callback methods to match the response mode supported by your provider.
Read the authenticated profile in application routes
The documented Spark integration runs on Jetty and uses Jetty’s servlet session store by default. In a route that needs user identity or claims, build the web context and session store using the configured factories, then retrieve the profile through ProfileManager. The example casts the profile to OidcProfile; available standard claims depend on the scopes requested. The guide’s default scopes are openid profile email.
Use the session-backed profile for application identity instead of exposing provider tokens to browser code. Request only the scopes your application needs, and check whether the returned profile actually contains the claims required by a given feature.
Best Value
Keep credentials and tokens out of the browser
The Spark Platform documentation warns: “Never provide your access_token, refresh_token or client_secret to a web browser or other end-user agent.” Maintain an application session and keep token data in storage accessible only to the application; do not put access tokens in cookies. Serve OIDC traffic over HTTPS and protect server-side secrets with your deployment’s secret-management practices.
Do not disable ID-token signature validation to accommodate a demo identity provider. The pac4j Spark walkthrough uses a public demo provider that issues unsigned ID tokens and enables setAllowUnsignedIdTokens(true) specifically for that example. Remove that setting for a real provider unless that provider’s own documented requirements deliberately justify it, and never carry demo credentials into a deployment.
Choose local or provider logout deliberately
A local pac4j LogoutRoute removes the application’s profile or session. That does not necessarily end the user’s identity-provider session, so the user may be signed out of the Spark application but still authenticated at the provider.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →When the provider supports OIDC logout, a central logout route can redirect to its end_session_endpoint. Register an allowed post-logout redirect URI with the provider, and verify the provider’s current logout behavior and requirements before relying on it.
Deployment checks
- Confirm Spark,
spark-pac4j, pac4j modules, and Java versions are compatible. - Check that every protected route pattern, including nested paths, has a security filter.
- Verify the public callback URI exactly matches the provider registration, including the client-name query parameter.
- Exercise the callback using the response method and mode configured at the provider.
- Confirm application secrets and token data remain server-side and that OIDC requests use HTTPS.
- Test local logout and provider logout separately, including the post-logout redirect.
These checks follow the configuration and behavior described in the pac4j Spark walkthrough and the Spark Platform security guidance; provider-specific details must be confirmed with the provider.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
