{"componentChunkName":"component---src-templates-tag-js","path":"/tags/pac-4-j/","result":{"data":{"site":{"siteMetadata":{"title":"LoginRadius Blog"}},"allMarkdownRemark":{"totalCount":1,"edges":[{"node":{"fields":{"slug":"/engineering/guest-post/add-authentication-to-play-framework-with-oidc-and-loginradius/"},"html":"

In this blog post, I will write a step-by-step tutorial to add Authentication to the Play Framework Application with OIDC and LoginRadius. I will be using pac4j and it's play-pac4j integration in this tutorial. Before jumping into the tutorial, let's learn about few concepts.

\n

What is OpenID Connect (OIDC) Protocol?

\n

OIDC is an authentication protocol that allows users to verify their identity when they are trying to access a protected HTTPS endpoint. OIDC is an evolutionary development of ideas implemented earlier in OAuth and OpenID.

\n

OpenID Connect allows clients to request and receive information about authenticated sessions and end-users. It allows all types of clients, including

\n\n

You can find out more details about OIDC here

\n

What is Play Framework?

\n

Play Framework is an open-source web application framework that follows the model–view–controller architectural pattern. It is written in Scala and usable from other programming languages that are compiled to JVM Bytecode.

\n

It makes it easy to build web applications with Java & Scala. Play is based on a lightweight, stateless, web-friendly architecture. Built on Akka, Play provides predictable and minimal resource consumption (CPU, memory, threads) for highly-scalable applications.

\n

What is pac4j?

\n

pac4j is an easy and powerful security engine for Java to authenticate users, get their profiles and manage authorizations in order to secure web applications and web services.

\n

It provides a comprehensive set of concepts and components. It is based on Java and available under the Apache 2 license. It is available for most frameworks/tools and supports most authentication/authorization mechanisms.

\n

pac4j is supported with most of the Java frameworks like

\n\n

Getting started

\n

There are multiple options you can get started with the Play framework.

\n\n

For this tutorial, I will be using creating a new play project using sbt.

\n

Install sbt on Mac OS

\n
brew install sbt
\n

You can find Installation steps for Windows and Linux here.

\n

Prerequisites

\n

For this tutorial, I will be using

\n\n

Create New Play Project

\n

Create a new java play project using the following command

\n
sbt new playframework/play-java-seed.g8
\n

The above command will prompt you to fill in the project name and project package structure in organization as shown below.

\n
[info] welcome to sbt 1.5.3 (Oracle Corporation Java 11.0.2)\n[info] set current project to new (in build file:/private/var/folders/_9/rcqwq2vx1cl_1sc4xdhb5_5c0000gn/T/sbt_661d1bf7/new/)\n\nThis template generates a Play Java project\n\nname [play-java-seed]: loginradius-play-oidc\norganization [com.example]: com.loginradius.developer\n\nTemplate applied in /Users/vishnuchilamakuru/self/longinradius/./loginradius-play-oidc
\n

Run Play Project

\n

Now that the project is created with a base template. You can test it by running the project using the following command from loginradius-play-oidc folder.

\n
sbt run
\n

Now visit http://localhost:9000, and it should look like this.

\n

\"play-project-homepage.webp\"

\n

Integrate pac4j with Play Project

\n

1. Add pac4j dependencies to build.sbt

\n

Add pac4j dependencies, Java 11 as required, and target version to compile the project in build.sbt.

\n
name := """loginradius-play-oidc"""\norganization := "com.loginradius.developer"\n\nversion := "1.0-SNAPSHOT"\n\nlazy val root = (project in file(".")).enablePlugins(PlayJava)\n\nscalaVersion := "2.13.6"\n\ninitialize := {\n  val _ = initialize.value // run the previous initialization\n  val required = "11"\n  val current  = sys.props("java.specification.version")\n  assert(current == required, s"Unsupported JDK: java.specification.version $current != $required")\n}\n\nscalacOptions += "-target:jvm-11"\n\njavacOptions ++= Seq("-source", "11", "-target", "11")\n\n\nlibraryDependencies ++= Seq(\n  guice,\n  ehcache,\n  "org.pac4j" %% "play-pac4j" % "11.0.0-PLAY2.8",\n  "org.pac4j" % "pac4j-oidc" % "5.1.0",\n  "com.typesafe.play" % "play-cache_2.13" % "2.8.8",\n  "com.fasterxml.jackson.module" %% "jackson-module-scala" % "2.12.3"\n)
\n

2. Create Security Module

\n

Create app/modules/SecurityModule.java. This class configures OIDC, sets up a secure HttpActionAdapter, and registers callback and logout controllers.

\n\n
package modules;\n\nimport com.google.inject.AbstractModule;\n\nimport com.nimbusds.oauth2.sdk.ParseException;\nimport com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;\nimport com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;\nimport com.typesafe.config.Config;\nimport net.minidev.json.JSONObject;\nimport org.pac4j.core.authorization.authorizer.RequireAnyRoleAuthorizer;\nimport org.pac4j.core.client.Clients;\nimport org.pac4j.core.context.session.SessionStore;\nimport org.pac4j.oidc.client.OidcClient;\nimport org.pac4j.oidc.config.OidcConfiguration;\nimport org.pac4j.play.CallbackController;\nimport org.pac4j.play.LogoutController;\nimport org.pac4j.play.http.PlayHttpActionAdapter;\nimport org.pac4j.play.store.PlayCacheSessionStore;\nimport play.Environment;\n\nimport java.util.Optional;\n\npublic class SecurityModule extends AbstractModule {\n\n    private final Config configuration;\n\n    public SecurityModule(final Environment environment, final Config configuration) {\n        this.configuration = configuration;\n    }\n\n    @Override\n    protected void configure() {\n\n        bind(SessionStore.class).to(PlayCacheSessionStore.class);\n\n        final OidcConfiguration oidcConfiguration = new OidcConfiguration();\n        oidcConfiguration.setDiscoveryURI(configuration.getString("oidc.discoveryUri"));\n        oidcConfiguration.setClientId(configuration.getString("oidc.clientId"));\n        oidcConfiguration.setSecret(configuration.getString("oidc.clientSecret"));\n        oidcConfiguration.setClientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);\n\n        addProviderMetadata(oidcConfiguration);\n\n        final OidcClient oidcClient = new OidcClient(oidcConfiguration);\n        oidcClient.addAuthorizationGenerator((ctx, session, profile) -> {\n            profile.addRole("ROLE_ADMIN");\n            return Optional.of(profile);\n        });\n\n        final String baseUrl = configuration.getString("baseUrl");\n        final Clients clients = new Clients(baseUrl + "/callback",  oidcClient);\n\n        final org.pac4j.core.config.Config config = new org.pac4j.core.config.Config(clients);\n        config.addAuthorizer("admin", new RequireAnyRoleAuthorizer("ROLE_ADMIN"));\n        config.setHttpActionAdapter(PlayHttpActionAdapter.INSTANCE);\n        bind(org.pac4j.core.config.Config.class).toInstance(config);\n\n        // callback\n        final CallbackController callbackController = new CallbackController();\n        callbackController.setDefaultUrl("/");\n        bind(CallbackController.class).toInstance(callbackController);\n\n        // logout\n        final LogoutController logoutController = new LogoutController();\n        logoutController.setDefaultUrl("/?defaulturlafterlogout");\n        bind(LogoutController.class).toInstance(logoutController);\n\n    }\n\n    private void addProviderMetadata(OidcConfiguration oidcConfiguration) {\n        JSONObject jsonObj = new JSONObject();\n        jsonObj.appendField("token_endpoint", configuration.getString("oidc.tokenUri"));\n        final OIDCProviderMetadata providerMetaData;\n        try {\n            providerMetaData = OIDCProviderMetadata.parse(jsonObj);\n            oidcConfiguration.setProviderMetadata(providerMetaData);\n        } catch (ParseException e) {\n            e.printStackTrace();\n        }\n    }\n}
\n

3. Create Secured Endpoint in Controller

\n

In app/controllers/HomeController.java add the following methods

\n\n

After adding the above methods HomeController.java looks like this.

\n
package controllers;\n\nimport com.google.inject.Inject;\nimport org.pac4j.core.context.session.SessionStore;\nimport org.pac4j.core.profile.ProfileManager;\nimport org.pac4j.core.profile.UserProfile;\nimport org.pac4j.play.context.PlayContextFactory;\nimport org.pac4j.play.java.Secure;\nimport org.pac4j.play.store.PlayCacheSessionStore;\nimport play.mvc.*;\n\nimport java.util.ArrayList;\nimport java.util.List;\n\n/**\n * This controller contains an action to handle HTTP requests\n * to the application's home page.\n */\npublic class HomeController extends Controller {\n\n    /**\n     * An action that renders an HTML page with a welcome message.\n     * The configuration in the <code>routes</code> file means that\n     * this method will be called when the application receives a\n     * <code>GET</code> request with a path of <code>/</code>.\n     */\n    public Result index() {\n        return ok(views.html.index.render());\n    }\n\n    @Secure(clients = "OidcClient")\n    public Result oidcIndex(Http.Request req) {\n        return protectedIndex(req);\n    }\n\n    public Result protectedIndex(Http.Request req) {\n        return ok(views.html.protectedindex.render(getProfiles(req)));\n    }\n\n    @Inject\n    private SessionStore sessionStore;\n\n    private List<UserProfile> getProfiles(Http.Request req) {\n        final ProfileManager profileManager = new ProfileManager(PlayContextFactory.INSTANCE.newContext(req), sessionStore);\n        final List<UserProfile> profiles = new ArrayList<>();\n        if (profileManager.getProfile().isPresent()) {\n            profiles.add(profileManager.getProfile().get());\n        }\n        return profiles;\n    }\n\n}
\n

4. Create Views

\n\n
@()\n\n@main("Welcome to Play") {\n  <h1>Welcome to Play!</h1>\n\n  <a href="oidc/index.html">Protected URL by OIDC</a>\n}
\n\n
@(profileList: java.util.List[org.pac4j.core.profile.UserProfile])\n@import scala.collection.JavaConverters._\n@profiles() = { @profileList.toList }\n<h1>Protected Area</h1>\n<a href="..">Back</a>\n<ul>\n    <li><a href="/logout?url=/?forcepostlogouturl">Logout</a></li>\n</ul>\n\n<p>\n    profiles: @profiles\n</p>
\n

5. Configure Routes

\n

Now we already added methods in HomeController.java and configured callback, logout controllers in SecurityModule.java. Let's configure the routes to map to these methods in conf/routes.

\n\n
# Routes\n# This file defines all application routes (Higher priority routes first)\n# ~~~~\n\n# An example controller showing a sample home page\nGET     /                           controllers.HomeController.index\nGET     /oidc/index.html            controllers.HomeController.oidcIndex(request: Request)\nGET     /protected/index.html       controllers.HomeController.protectedIndex(request: Request)\nGET     /callback                   @org.pac4j.play.CallbackController.callback(request: Request)\nPOST    /callback                   @org.pac4j.play.CallbackController.callback(request: Request)\nGET     /logout                     @org.pac4j.play.LogoutController.logout(request: Request)\n\n\n# Map static resources from the /public folder to the /assets URL path\nGET     /assets/*file               controllers.Assets.versioned(path="/public", file: Asset)
\n

6. Add Application Configuration variables

\n

Finally, configure the variables mentioned in SecurityModule.java in conf/application.conf as follows.

\n
play {\n  modules {\n    enabled += modules.SecurityModule\n  }\n}\n\nbaseUrl = "http://localhost:9000"\n\noidc.discoveryUri = "https://cloud-api.loginradius.com/sso/oidc/v2/{loginradius-site-name}/{loginradius-app-name}/.well-known/openid-configuration"\noidc.clientId = "{clientId}"\noidc.clientSecret = "{clientSecret}"\noidc.tokenUri = "https://cloud-api.loginradius.com/sso/oidc/v2/{loginradius-site-name}/token"
\n

Create an OIDC app in LoginRadius

\n

Login to your LoginRadius account or signup here if you don't have one.

\n

Once you log in you can see by default, one application will be created for you. Otherwise, you can create a new application here from the following screen by clicking New App.

\n

\"loginradius-dashboard.webp\"

\n

I will be using the existing application itself for this demo as I am using a free plan. In the free plan, you can create only one application (no need for card details).

\n

Upgrade your application subscription to the Developer Pro Plan to configure OIDC. (Developer Pro Plan is available with 21 days trial).

\n

\"loginradius-upgrade-subscription-1.webp\"

\n

\"loginradius-upgrade-subscription-2.webp\"

\n

Now click on Select & Configure on your application and navigate to the Integration Section and Configure Open ID configuration. You can find step-by-step details to configure OIDC here.

\n

Once you configure these conf/application.conf will look something like this.

\n
# This is the main configuration file for the application.\n# https://www.playframework.com/documentation/latest/ConfigFile\n\nplay {\n  modules {\n    enabled += modules.SecurityModule\n  }\n}\n\nbaseUrl = "http://localhost:9000"\n\noidc.discoveryUri = "https://cloud-api.loginradius.com/sso/oidc/v2/dev-svv3qlcj2y/pac4j-play-loginradius-demo/.well-known/openid-configuration"\noidc.clientId = "8ce24413-9b7e-4282-9f5b-e0e5ec13a42a"\noidc.clientSecret = "c9c61f6e-325f-40d6-89fd-696d17f970eb"\noidc.tokenUri = "https://cloud-api.loginradius.com/sso/oidc/v2/dev-svv3qlcj2y/token"\n# Site Name - dev-svv3qlcj2y\n# App Name - pac4j-play-loginradius-demo
\n

Time to test complete Integration

\n

Let's run our application using sbt clean run and visit http://localhost:9000. The Home page will look like this.

\n

Home Page

\n

\"home-page.webp\"

\n

LoginRadius Auth Page (IDX)

\n

Now click on the protected url by OIDC link on the home page that will redirect you to the LoginRadius Auth Page (IDX), which you configured.

\n

\"loginradius-consent-page.webp\"

\n

Redirect to Protected Index Page

\n

On successful login from the above step, you will be redirected to the protectedindex.scala.html page.

\n

\"loginradius-protected-index-page.webp\"

\n

Logout Action

\n

play-pac4j provides out of the box LogoutController which can be used to handle logout flows. It has logout functionality which has the logout logic implementation to clear the session. Below is the sample logout functionality from org.pac4j.play.LogoutController play-pac4j module.

\n
    public CompletionStage<Result> logout(final Http.Request request) {\n\n        final HttpActionAdapter bestAdapter = FindBest.httpActionAdapter(null, config, PlayHttpActionAdapter.INSTANCE);\n        final LogoutLogic bestLogic = FindBest.logoutLogic(logoutLogic, config, DefaultLogoutLogic.INSTANCE);\n\n        final WebContext context = FindBest.webContextFactory(null, config, PlayContextFactory.INSTANCE).newContext(request);\n\n        return CompletableFuture.supplyAsync(() -> (Result) bestLogic.perform(context, sessionStore, config, bestAdapter, this.defaultUrl,\n                this.logoutUrlPattern, this.localLogout, this.destroySession, this.centralLogout), ec.current());\n    }
\n

So to use this LogoutController, we just need to initialize it and define logout route for the same in our routes. We already initialized LoginController in SecurityModule.java.

\n

a. Initialize LogoutController

\n\n
    // logout\n    final LogoutController logoutController = new LogoutController();\n    logoutController.setDefaultUrl("/?defaulturlafterlogout");\n    bind(LogoutController.class).toInstance(logoutController);
\n

b. Define Route for LogoutController

\n\n
GET     /logout                     @org.pac4j.play.LogoutController.logout(request: Request)
\n

On Clicking logout in our application, the session will be cleared and you will be redirected to the Home page based on our configuration.

\n

Source Code

\n

You can see the full source code for the application developed in this tutorial on GitHub.

\n","frontmatter":{"date":"June 25, 2021","updated_date":null,"title":"Add Authentication to Play Framework With OIDC and LoginRadius","tags":["OIDC","Java","pac4j","Play Framework","Authentication"],"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/20973f3ab172cea4306baad7dd6cba11/58556/pac4j-authentication.webp","srcSet":"/static/20973f3ab172cea4306baad7dd6cba11/61e93/pac4j-authentication.webp 200w,\n/static/20973f3ab172cea4306baad7dd6cba11/1f5c5/pac4j-authentication.webp 400w,\n/static/20973f3ab172cea4306baad7dd6cba11/58556/pac4j-authentication.webp 800w,\n/static/20973f3ab172cea4306baad7dd6cba11/210c1/pac4j-authentication.webp 900w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Vishnu Chilamakuru","github":"vishnuchilamakuru","avatar":null}}}}]}},"pageContext":{"tag":"pac4j"}},"staticQueryHashes":["1171199041","1384082988","2100481360","23180105","528864852"]}