$ show bujiio/buji-pac4j
buji-pac4j is a bridge library that integrates pac4j (a comprehensive security library supporting OAuth, CAS, SAML, OpenID Connect, etc.) with Apache Shiro. It automatically pushes pac4j authentication and authorization profiles into the Shiro security context, allowing developers to use pac4j's wide range of authentication mechanisms while leveraging Shiro for authorization and session management. The bridge is implemented as a set of classes that adapt pac4j's session store, profile manager, and framework adapter to Shiro's APIs, plus a custom Realm, SubjectFactory, and Token. It includes sophisticated logic to avoid unnecessary session renewal when the same user's profiles are updated (e.g., after token refresh), demonstrating deep understanding of both frameworks' internals. The library is production-ready, actively maintained, and used in legacy applications that want to adopt pac4j without fully migrating away from Shiro.
The LLM identified 1 files worth highlighting for reuse:
The ShiroHelper utility contains non-trivial logic for populating the Shiro security subject with pac4j profiles while avoiding unnecessary session renewal. Its `refreshProfiles` method compares old and new profile lists by client name and user ID to detect whether the same user is logging in; if so, it updates the existing Pac4jPrincipal's profiles in-place and re-saves the principal in the Shiro session store to reflect changes (e.g., after an access token refresh). This prevents a full `Subject.login` call, which in Shiro v2.2+ would trigger a session ID change (a security measure against session fixation). The pattern of identity comparison and in-place principal update is reusable in any environment where multiple authentication events may occur without needing to reset the entire session.