iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If you have Spark Java routes that should require sign-in, use pac4j-oidc to handle OpenID Connect and spark-pac4j to connect that login flow to Spark filters, callbacks, and logout routes. The key pieces are an OIDC client, a protected-route filter, and a callback URL that exactly matches the one registered with your identity provider.
Choose compatible dependencies
The pac4j Spark guide demonstrates Spark 2.9.4, spark-pac4j 6.0.0, pac4j-oidc 6.5.8, and Java 17. These are the versions shown in the guide, not a claim that they are the newest releases. Its compatibility guidance says spark-pac4j 6 targets pac4j 6 and Spark 2.9, and the integration brings in the matching pac4j-javaee module. Check the versions and Java baseline together for your project.
The pac4j compatibility table lists JDK 17 for pac4j 6.x, JDK 11 for 5.x, and JDK 8 for 4.x. See the pac4j repository for its compatibility information.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Add the dependencies for spark-pac4j and pac4j-oidc to your build, using compatible versions. The Spark guide’s example coordinates and wiring are documented in How to secure a Spark Java application with OIDC.
Configure the OIDC client
Create an OidcConfiguration with your provider’s discovery URI, client ID, and client secret. Pass it to an OidcClient, then add that client to pac4j’s Config with the callback URL. Discovery metadata supplies the provider endpoints and configuration; pac4j documents its generic OIDC client for providers including Keycloak, Google, Microsoft Entra ID, and Okta. Provider capabilities and client-authentication options vary, so check the provider’s current documentation as well as the pac4j OIDC client reference.
The Spark tutorial’s demo provider issues unsigned ID tokens and uses setAllowUnsignedIdTokens(true). That is a demo-specific setting: do not carry it into a real deployment unless the provider’s own documentation establishes a deliberate requirement. Never reuse demo credentials in a deployed application.
Rank #2
Use HTTPS for OIDC requests. Keep the client secret and any access or refresh tokens on the server, not in browser-visible storage. Spark Platform’s OpenID Connect documentation recommends a separate application session and keeping token data somewhere accessible only to the application; it specifically warns against putting access tokens in cookies.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Protect the Spark routes that require login
Attach pac4j’s SecurityFilter as a Spark before filter on each route pattern that should require authentication, passing the configured OIDC client name, commonly OidcClient. When a visitor has no authenticated session, the filter starts the provider login flow and prevents the protected route from running. The indirect-client flow and callback behavior are also described in pac4j’s clients documentation.
Do not assume a parent Spark path pattern automatically covers every nested path. The guide distinguishes before("/protected") from before("/protected/*"). Apply filters to the specific patterns your application serves, including nested routes where needed.
If signing in is not enough and a route also requires roles or other authorization checks, define pac4j authorizers and provide them to the filter. Authentication establishes who the user is; an authorizer enforces whether that user can access a particular resource.
Rank #4
Register and handle the callback URI
Register the complete callback URL with the identity provider. The pac4j guide notes that the callback includes the query parameter ?client_name=OidcClient; the external scheme, host, port, path, and query must match the URI the application actually uses. A mismatch can prevent the provider from returning the authorization response to the right endpoint.
Free tools Windows power users keep installed
One-click scans. No signup required.
Register a CallbackRoute at the callback path. The guide describes the default authorization-code response as a GET; also expose POST if your provider or response mode uses form_post. The callback validates the response, stores the authenticated profile in the session, and redirects the user to the originally requested page. Its session-renewal option helps protect against session fixation.
Best Value
Read the authenticated user’s profile
For route code that needs claims, build the web context and session store using the configured factories, then read the profile through ProfileManager. The Spark example casts the profile to OidcProfile. Which standard claims are available depends on the scopes requested; the guide gives openid profile email as the default scopes. Request only the claims your application needs and handle missing optional claims in application logic.
The documented integration runs Spark on Jetty and uses Jetty’s servlet session store by default. The profile is the session-backed application identity; it is not a reason to expose provider tokens to browser code.
Choose local or provider logout
A LogoutRoute can remove the application’s profile and session. This is local logout: it ends the Spark application’s session but may leave the user signed in to the identity provider.
Recommended Free Tools
If the provider supports OIDC logout, a central logout route can redirect to its end_session_endpoint. Register an allowed post-logout redirect URI with the provider. Whether central logout is available, and its precise behavior, depends on the provider.
Quick Recap
Before deploying
- Confirm the Java, Spark,
spark-pac4j, and pac4j versions are compatible. - Use the real provider’s discovery metadata and credentials; remove demo-only unsigned-ID-token settings.
- Register and verify the exact HTTPS callback URI, including the client-name query parameter.
- Test the intended callback method, including POST if using
form_post. - Check every protected route pattern, including nested paths, and verify that unauthorized requests do not reach route handlers.
- Keep client secrets and tokens server-side, and test the session behavior used by the deployment.
- Test local logout separately from provider logout and verify the registered post-logout redirect URI.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
