Migration guide

-> 9.x

Version 6 of pac4j is now required.

Permissions are now handled via pac4j user attributes. profile.addPermission("PERM1"); is replaced by profile.addAttribute(Pac4jRealm.SHIRO_PERMISSIONS, Arrays.asList("PERM1"));.

-> 8.x

The JEE filters (io.buji.pac4j.filter.*Filter) have been removed and the security components of the pac4j security library (for example: javaee-pac4j ands its org.pac4j.jee.filter.*Filter) must be used instead.

The callback endpoint must be explicitly defined in your shiro.ini configuration.

-> 7.x

The pac4j-javaee artifact is pulled instead of the pac4j-jee artifact: JEE components are now in the org.pac4j.jee package.

-> 6.1+

The pac4j-jee artifact is pulled instead of the pac4j-core artifact.

5.x -> 6.x

Version 5.x of pac4j is now required. JDK 11 is required too.

The multiProfile and saveInSession options are now removed from the filters and handled at the Client level.

4.x -> 5.x

Version 4.x of pac4j is now required.

3.x -> 4.x

Version 3.x of pac4j is now required.

2.x -> 3.x

Version 2.x of pac4j is now required.

From the deprecated shiro-cas module (CAS support)

Instead of using the shiro-cas module, you need to use the buji-pac4j library and the pac4j-cas module. Though, the way both implementations work is close.

The CasFilter is replaced by the CallbackFilter which has the same role (receiving callbacks from identity providers), but not only for CAS.

The CasRealm is replaced by the Pac4jRealm and the CasSubjectFactory by the Pac4jsubjectFactory.

Finally, you must use the SecurityFilter to secure an url, in addition of the default Shiro filters (like roles).

2.0 -> 2.2

The config, clients, pac4jRealm, pac4jSubjectFactory and callbackFilter components are available by default (they are automatically loaded thanks to the Pac4jIniEnvironment component).

1.4 - > 2.0

The buji-pac4j library strongly changes in version 2:

• the core and servlet modules are merged back into one main module
• the ClientRealm is replaced by the Pac4jRealm and the ClientToken by the Pac4jToken
• the ClientUserFilter, ClientPermissionsAuthorizationFilter and ClientRolesAuthorizationFilter.java are removed, more generally replaced by the SecurityFilter which ensures the url security (as usually in the pac4j world)
• the CallbackFilter replaces the ClientFilter to finish the login process for indirect clients (as usually in the pac4j world).