What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For a browser-facing Vert.x application, use pac4j’s indirect CasClient through vertx-pac4j. Set the CAS login URL and callback, register the exact callback service URL with CAS, install Vert.x session handling before pac4j, and protect the routes that require authentication. Complete login with CallbackHandler and configure logout for the scope you need. Keep synchronous security work off the Vert.x event loop.
Which CAS flow fits your Vert.x application?
Choose the client based on how the application interacts with CAS:
As an Amazon Associate I earn from qualifying purchases.
| Use case | pac4j approach | Key consideration |
|---|---|---|
| Browser-based single sign-on | Indirect CasClient |
Uses a browser session and redirects the user to CAS for login. |
| A CAS-authenticated web application calling another CAS-protected service on a user’s behalf | Configure proxy-ticket support with CasProxyReceptor; protect the receiving service with DirectCasProxyClient |
Restrict accepted proxy chains to the callers intended for your deployment. |
| A service validates credentials through CAS REST | A CAS REST client | The CAS REST feature must be enabled, and the service accepts credentials. |
| CAS is used as an OIDC or SAML identity provider | Use pac4j’s OIDC or SAML support | Choose the client for the protocol the deployment actually uses. |
The steps below cover browser SSO, where the user has a browser session and CAS returns the browser to the application with a service ticket.
Set compatible dependencies and versions
The pac4j Vert.x integration guide’s example lists Vert.x Web 5.1.5, vertx-pac4j 7.0.3, and pac4j-cas 6.5.8. The guide says vertx-pac4j 7 targets Vert.x 5 and pac4j 6. Treat these as documented example versions, not a promise that they are the latest compatible releases. Check the project’s release information when choosing versions for a new application. pac4j’s Vert.x integration guide and the vertx-pac4j project provide the implementation context.
Add Vert.x Web, vertx-pac4j, and pac4j-cas to the application. Keep their versions aligned with the Vert.x and pac4j versions supported by the integration you select.
Configure the CAS client and callback
Create a pac4j Config with an application callback URL and a CasClient that points to the CAS login endpoint. For example, the integration guide shows a client constructed with new CasClient(new CasConfiguration("https://your-cas.example/login")). CAS 3.0 is the documented default protocol; explicitly configure another supported protocol if your server requires it. See the pac4j CAS client reference.
Rank #2
Register the complete callback service URL in the CAS service registry. pac4j appends ?client_name=CasClient when it constructs the service value, so the service pattern must match the URL CAS receives, including that suffix. Also set the service’s attribute-release and proxy policies according to what the application needs; successful login alone does not guarantee that CAS releases particular attributes.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsInstall sessions, protect routes, and complete login
Session handling, route protection, and callback processing are distinct responsibilities. Install the session handler before pac4j so the same session state is available on protected routes and at the callback.
- Install session support first. Add Vert.x
SessionHandlerto the router before pac4j handlers and back pac4j withVertxSessionStore. For a multi-instance deployment, use a clustered Vert.x session store so session state is available across instances. - Protect the routes that need authentication. Use
SecurityHandlerwith theCasClient. An unauthenticated browser is redirected to CAS; after login, CAS returns it to the registered callback with a service ticket. - Process the callback. Use
CallbackHandlerto validate the ticket, save the resulting profile, and redirect the user to the destination. The callback can renew the session identifier, helping protect against session fixation. - Move synchronous security work off the event loop. The integration guide notes that
SecurityHandlerinvokes synchronous pac4j logic. Register that work with Vert.x’s blocking handler mechanism. The guide says callback and logout handlers already useexecuteBlockinginternally.
See the integration guide for the Vert.x handler setup and the project documentation for the library’s handler support.
Use CAS profiles and authorize access separately
After a successful CAS login, pac4j returns a CasProfile. Its identifier is the CAS principal, commonly a username. Other profile attributes depend on the CAS service’s attribute-release policy, so inspect what the application actually receives rather than assuming a requested role or attribute will be present. An empty attributes map can mean the service did not release the expected values.
Rank #4
Authentication establishes who signed in; authorization decides what that identity may do. Configure SecurityHandlerOptions to select clients and authorizers. Use an authorizer for checks such as requiring an administrator role, instead of treating a valid CAS login as permission to use every protected operation. pac4j documents authorizers for roles, permissions, profile attributes, CSRF, security headers, and other checks in its vertx-pac4j project documentation.
Choose local or central logout
Use LogoutHandler to end the application’s local session and remove the application profile. If users must also leave the CAS single sign-on session, enable central logout and make sure CAS permits the return URL. If the return URL is dynamic, validate it against an application-owned pattern rather than accepting arbitrary destinations. The pac4j integration guide describes the local and central logout setup.
Quick Recap
Best Value
Fix common CAS and Vert.x failures
- “Application Not Authorized to Use CAS”: Compare the service registry entry with the complete callback service URL, including
?client_name=CasClient, and check that the registered service pattern matches. See the CAS client reference. - Login loops or lost state: Confirm that Vert.x
SessionHandleris installed and runs before pac4j on both the protected route and callback. - Expected profile attributes are missing: Check the CAS service’s attribute-release policy. A
CasProfileonly contains attributes released to that service. - Requests are slow or blocked: Make sure synchronous ticket-validation work is not running on the Vert.x event loop.
- Logout ends only the application session: Configure central logout if the CAS SSO session must also end, and verify that CAS allows the return URL.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
