Components and features

Security model

jax-rs-pac4j integrates the pac4j security engine with Jakarta REST.

• A client authenticates a request and produces a user profile. Direct clients authenticate API requests; indirect clients handle browser login flows such as OpenID Connect, SAML or CAS.
• An authorizer checks whether an authenticated user may access a resource, for example by requiring a role.
• A matcher decides whether security should be applied to a request.

Features to register

Choose one environment feature, then enable annotations or a global security filter:

Feature	Purpose
Pac4JServletFeature(config)	Configures pac4j for a Servlet container and supplies an HTTP session store by default.
Pac4JGrizzlyFeature(config)	Configures Jersey on Grizzly without Servlet, including Grizzly sessions.
Pac4JJaxRsFeature(config)	Generic Jakarta REST integration; configure its session store factory explicitly.
Pac4JSecurityFeature()	Activates @Pac4JSecurity, @Pac4JCallback and @Pac4JLogout on resources.
Pac4JSecurityFilterFeature(...)	Applies a security filter globally to the resources served by the runtime.

Jersey profile parameter injection also requires Pac4JValueFactoryProvider.Binder. RESTEasy uses Pac4JProfileInjectorFactory.

See Security configuration for working registrations, including the class registration required with RESTEasy/CDI.

Providers installed by the environment features

The features register a JaxRsConfigProvider for the pac4j Config, plus providers for the request context and session store:

Environment	Context provider	Session store provider
Generic Jakarta REST	JaxRsContextFactoryProvider	JaxRsSessionStoreProvider
Servlet	ServletJaxRsContextFactoryProvider	ServletSessionStoreProvider
Grizzly without Servlet	GrizzlyJaxRsContextFactoryProvider	GrizzlySessionStoreProvider

Prefer the environment features to manually assembling these providers. The Servlet and Grizzly providers set a default session store factory only if the configuration does not already contain one.

Filters

• SecurityFilter performs authentication and authorization, then lets the resource run or returns the appropriate HTTP response.
• CallbackFilter finishes an indirect client's login flow and saves the profile in the session.
• LogoutFilter handles application logout and, when requested, identity provider logout.

The features create and configure these filters. Application resources normally use the annotations rather than constructing filters directly.