KNOX-3217: Upgrade pac4j to 6.3.0 for JDK17 #1110
Merged
+162
−130
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bonampak
force-pushed
the
pac4j-upgrade-6x
branch
from
d7e64e8 to
987a8a4
Compare
bonampak
force-pushed
the
pac4j-upgrade-6x
branch
from
7aee5d2 to
73ba2e3
Compare
…e-pac4j to 7.1.0. (Instead of the jee-pac4j artifact, javaee-pac4j needs to be used - then jakartaee-pac4j if we migrate to Jakarta). Update opensaml to 4.2.0 and cryptacular to 1.2.5 (from pac4j-saml:5.7.8). Pin net.shibboleth.utilities:java-support to 8.3.1. Fix KnoxSessionStore getSessionId and Pac4jIdentityAdapter removeProfiles call. Corrected Pac4jProviderTest. Pac4jSetCookieResponseWrapper.addCookie() is probably not needed anymore, pac4jcsrf is set in Set-Cookie header and is secure by default (goes through KnoxSessionStore).
…om Shibboleth maven repo. Updated shib-release maven repo URL.
…to 5.1.6. Update cryptacular to 1.2.7 and xmlsec to 4.0.4. org.pac4j.oidc.client.AzureAdClient was removed for AzureAd2Client; AzureAdOidcConfiguration to AzureAd2OidcConfiguration. Pinned managed dependency versions for org.apache.httpcomponents.client5:httpclient5:5.4.3 and org.apache.httpcomponents.core5:5.3.6 should work: org.pac4j:pac4j-saml:jar:6.3.0 would bring in org.apache.httpcomponents.client5:httpclient5:jar:5.3.1, plus a dependency convergence error with org.apache.httpcomponents.core5:httpcore5:jar:5.2.5 and 5.2.4.
…CsrfToken in logout.jsp (added in pac4j 5.0).
…be 1.7, no dependency convergence issues). org.pac4j.pac4j-oidc:6.3.0 needs com.nimbusds:lang-tag:1.7.
…org.nimbus-jose-jwt:10.5 is needed for org.pac4j:pac4j-oidc:6.3.0. org.apereo.cas.client:cas-client-core:4.0.4 would need nimbus-jose-jwt:9.37.3 and org.apache.hadoop:hadoop-auth:3.4.1 would need nimbus-jose-jwt:9.37.2.
bonampak
force-pushed
the
pac4j-upgrade-6x
branch
from
73ba2e3 to
fac3bc8
Compare
moresandeep
approved these changes
Dec 4, 2025
Contributor
moresandeep
left a comment
moresandeep
left a comment
There was a problem hiding this comment.
Looks good, I would suggest we test it with AzureAD2Client before merging.
...-security-pac4j/src/main/java/org/apache/knox/gateway/pac4j/filter/Pac4jIdentityAdapter.java
Outdated
Show resolved
Hide resolved
Contributor
|
@bonampak did you test it with AzureAD? |
Contributor
Author
|
Yes I did. <provider>
<role>federation</role>
<name>pac4j</name>
<enabled>true</enabled>
<param>
<name>pac4j.callbackUrl</name>
<value>https://localhost:8443/gateway/knoxsso/api/v1/websso</value>
</param>
<param>
<name>clientName</name>
<value>AzureAd2Client</value>
</param>
<param>
<name>oidc.type</name>
<value>azure</value>
</param>
<param>
<name>oidc.id</name>
<value>...</value>
</param>
<param>
<name>oidc.secret</name>
<value>...</value>
</param>
<param>
<name>oidc.azure.tenant</name>
<value>...</value>
</param>
<param>
<name>oidc.discoveryUri</name>
<value>https://login.microsoftonline.com/.../v2.0/.well-known/openid-configuration</value>
</param>
<param>
<name>oidc.clientAuthenticationMethod</name>
<value>client_secret_basic</value>
</param>
<param>
<name>oidc.preferredJwsAlgorithm</name>
<value>RS256</value>
</param>
</provider> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
KNOX-3217 - Update pac4j-related libraries to the latest version available.
What changes were proposed in this pull request?
Update javaee-pac4j to 8.1.0, pac4j to 6.3.0 and opensaml to 5.1.6.
How was this patch tested?
Tested with auth0 OIDC client, SAML and OIDC with Keycloak. Tested OIDC and AzureAd2Client with Azure dev account.