--- title: OpenID Federation with pac4j and CAS | daily.dev description: This tutorial sets up an OpenID Federation using pac4j as the relying party and two Apereo CAS server nodes, one acting as OpenID Provider and the other as... canonical: https://daily.dev/posts/openid-federation-with-pac4j-and-cas-cxiz3hsif twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OpenID Federation with pac4j and CAS | daily.dev og:description: This tutorial sets up an OpenID Federation using pac4j as the relying party and two Apereo CAS server nodes, one acting as OpenID Provider and the other as... og:url: https://daily.dev/posts/openid-federation-with-pac4j-and-cas-cxiz3hsif og:image: https://api.daily.dev/og/posts/cXIZ3HsiF.png og:image:alt: OpenID Federation with pac4j and CAS og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OpenID Federation with pac4j and CAS **[Foojay.io](https://daily.dev/sources/foojayio)** · 10 min read · 1 upvotes · 0 comments ## Summary This tutorial sets up an OpenID Federation using pac4j as the relying party and two Apereo CAS server nodes, one acting as OpenID Provider and the other as trust anchor. It uses CAS 8.1.0-RC1 with Java 25, spring-webmvc-pac4j 8.0.3 and pac4j-oidc 6.5.6. The setup uses private_key_jwt client authentication with JWKS files instead of a shared client secret. Since pac4j 6.4.0, it supports OpenID Federation as an RP, to the author's knowledge the first Java security library to do so. The guide walks through configuring each node's application.yml, defining subordinate entity statements for the RP and OP, and running all three processes to complete a login via the trust anchor. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I configure pac4j as a relying party for OpenID Federation instead of a shared client secret? Use private_key_jwt client authentication with a dedicated RP JWKS file instead of provisioning a client secret. Set config.setClientAuthenticationMethod(ClientAuthenticationMethod.PRIVATE_KEY_JWT), build a PrivateKeyJwtClientAuthnMethodConfig from the RP JWKS, and set config.setRequestObjectSigningAlgorithm(JWSAlgorithm.RS256). This works with pac4j-oidc 6.5.6 and spring-webmvc-pac4j 8.0.3, supported since pac4j 6.4.0. _Teams wiring up OpenID Federation can track pac4j and CAS version changes like these on daily.dev._ ### Can Apereo CAS act as both an OpenID Provider and a trust anchor in the same federation? Yes, but not on a single CAS node. CAS 8.1 added support for the federated OP role, and a separate CAS instance must run with cas.authn.oidc.federation.role set to TRUST_ANCHOR while another runs with the role set to OPENID_PROVIDER, each with its own JWKS and configuration files. _Developers evaluating Apereo CAS for federated identity can follow version-specific capability changes on daily.dev._ ### How does a trust anchor in OpenID Federation know which relying parties and providers to trust? The trust anchor defines subordinates upfront in a file directory, each described by a JSON file containing the entity's metadata and federation keys. For a relying party, this includes redirect URIs, token endpoint auth method, and JWKS; for a provider, it includes its OIDC metadata and federation keys, retrieved from each entity's .well-known/openid-federation endpoint. _Anyone designing trust chains across identity providers can compare federation setups like this on daily.dev._ ## Similar posts on daily.dev - [How to Secure a Spring Boot Application with OpenID Connect and pac4j](https://daily.dev/posts/how-to-secure-a-spring-boot-application-with-openid-connect-and-pac4j-u4wps0m7j) · Foojay.io · 4 upvotes · 0 comments - [Apache Polaris OIDC with Keycloak and Okta](https://daily.dev/posts/apache-polaris-oidc-with-keycloak-and-okta-cjfeyusju) · Dremio Blog · 0 upvotes · 0 comments - [Authorization using jCasbin](https://daily.dev/posts/authorization-using-jcasbin-4ao8z2ebl) · Baeldung · 6 upvotes · 0 comments - [Self-Hosted Human and Machine Identities in Keycloak 26.4](https://daily.dev/posts/self-hosted-human-and-machine-identities-in-keycloak-26-4-qbyrik6nv) · CNCF · 0 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/openid-federation-with-pac4j-and-cas-cxiz3hsif) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OpenID Federation with pac4j and CAS","url":"https://daily.dev/posts/openid-federation-with-pac4j-and-cas-cxiz3hsif","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/openid-federation-with-pac4j-and-cas-cxiz3hsif"},"datePublished":"2026-10-30T01:33:37.210Z","dateModified":"2026-10-30T01:34:06.630Z","description":"This tutorial sets up an OpenID Federation using pac4j as the relying party and two Apereo CAS server nodes, one acting as OpenID Provider and the other as...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c051dff67010871946fcf64f1b49f275?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c051dff67010871946fcf64f1b49f275?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Foojay.io","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Foojay.io","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/1820f6a6ae944760aa322b67ed85f848","url":"https://daily.dev/sources/foojayio"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/openid-federation-with-pac4j-and-cas-cxiz3hsif","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"java,authentication","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Foojay.io","item":"https://daily.dev/sources/foojayio"},{"@type":"ListItem","position":3,"name":"OpenID Federation with pac4j and CAS"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/openid-federation-with-pac4j-and-cas-cxiz3hsif#faq","mainEntity":[{"@type":"Question","name":"How do I configure pac4j as a relying party for OpenID Federation instead of a shared client secret?","acceptedAnswer":{"@type":"Answer","text":"Use private_key_jwt client authentication with a dedicated RP JWKS file instead of provisioning a client secret. Set config.setClientAuthenticationMethod(ClientAuthenticationMethod.PRIVATE_KEY_JWT), build a PrivateKeyJwtClientAuthnMethodConfig from the RP JWKS, and set config.setRequestObjectSigningAlgorithm(JWSAlgorithm.RS256). This works with pac4j-oidc 6.5.6 and spring-webmvc-pac4j 8.0.3, supported since pac4j 6.4.0. Teams wiring up OpenID Federation can track pac4j and CAS version changes like these on daily.dev."}},{"@type":"Question","name":"Can Apereo CAS act as both an OpenID Provider and a trust anchor in the same federation?","acceptedAnswer":{"@type":"Answer","text":"Yes, but not on a single CAS node. CAS 8.1 added support for the federated OP role, and a separate CAS instance must run with cas.authn.oidc.federation.role set to TRUST_ANCHOR while another runs with the role set to OPENID_PROVIDER, each with its own JWKS and configuration files. Developers evaluating Apereo CAS for federated identity can follow version-specific capability changes on daily.dev."}},{"@type":"Question","name":"How does a trust anchor in OpenID Federation know which relying parties and providers to trust?","acceptedAnswer":{"@type":"Answer","text":"The trust anchor defines subordinates upfront in a file directory, each described by a JSON file containing the entity's metadata and federation keys. For a relying party, this includes redirect URIs, token endpoint auth method, and JWKS; for a provider, it includes its OIDC metadata and federation keys, retrieved from each entity's .well-known/openid-federation endpoint. Anyone designing trust chains across identity providers can compare federation setups like this on daily.dev."}}]} ```