Open Source Java Frameworks

Welcome to the home of the Apereo Central Authentication Service project, more commonly referred to as CAS. CAS is an enterprise multilingual single sign-on solution and identity provider for the web and attempts to be a comprehensive platform for your authentication and authorization needs. CAS is an open and well-documented authentication protocol. The primary implementation of the protocol is an open-source Java server component by the same name hosted here, with support for a plethora of additional authentication protocols and features. Monitor and track application and system behavior, statistics and metrics in real-time. Manage and review audits and logs centrally, and publish data to a variety of downstream systems. Manage and register client applications and services with specific authentication policies. Cross-platform client support (Java, .NET, PHP, Perl, Apache, etc).

Fully customizable and localizable controllers and views (e.g. Play Authenticate allows you to define your own controllers and views for every visual step of the signup and/or log in process). Completely dynamic URL generation for all views (uses the route file - means you can adapt the look and feel as much as you like). The sample shows how to do this with Twitter bootstrap. Linking of accounts (e.g. one local user with multiple authentication providers). Linking can be done automatically or after asking the user (default) Merge detection (e.g. a user created two unconnected local accounts) Account merge can be done automatically or after asking the user (default) Tight deadbolt2 authorization integration (Sample included). HTTPS support (for OAuth2 redirect links and email verification). Verification email used by Email/Password provider is fully customizable and localizable and can be sent in either text or HTML or both.

Sureness allows you to security any server written with jvm modern frameworks such as Spring, Spring Boot, Spring WebFlux, Javalin, Quarkus, Micronaut, Solon, Jfinal or Ktor as well as frameworks for Kotlin. The essence of Sureness is to use an interceptor (like a servlet filter or Spring interceptor) to intercept all rest requests for authenticating and authorizing. So no matter any framework, as long as it has an interceptor, it can integrate with sureness. Sureness uses Exception Handling Process, checkIn() will return SubjectSum(user information) when auth success, or throw different types of auth exceptions when auth error. Sureness has a sensible default configuration, is easy to customize, and is not coupled to any one framework, which enables developers to quickly and safely protect their projects in multiple scenarios.

The PKI Framework (PKIF) is a cross-platform library for performing PKIX-compliant certificate processing. It includes support for SCVP, OCSP, CMS and Timestamps. It uses Windows CAPI, NSS or Crypto++ for cryptographic services and hardware support.

Web4thejob is an open source java framework for the rapid development of data-centric web applications. It is ideal for those who seek a component-based event-driven full-stack web development framework, capable of producing elegant desktop-style web applications that can automate any business domain. The framework addresses the automation needs of any business domain introducing "joblets". A joblet encapsulates the relational schema of a business domain using modern orm technology. Joblets are meant to be released by members of the community under the terms of their preference. Joblets guarantee productivity through reusability. The framework is engineered in a multi-layered architecture on top on some of the most recognized open source projects of the global java community; consequently a steep learning curve and an open architecture for binding with other projects are ensured.

Aigebi Rbac a token driven role-based access control engine. It's pure java product. The core rbac engine is deployed as jar. It provides both java API and custom jsp tags. Admin portal is provided to manage rbac data and showcase how to use rbac engine

CincoSecurity module offers big flexibility to protect EJB3 methods, and JSF page elements.It associates a role to each EJB method (fine role) defining a security profile as a set of roles; its use cases manage security profiles and users.Java EE 5 Seam

DNA is an open, flexible and extensible deep network analyzer software server and software architecture for gathering and analyzing network packets, network sessions and applications protocols, passively off enterprise class networks.

Open Source Single Sign-On (SSO) and Identity Management

The objective of the GridTrust project is to develop new Grid Security technologies in order to manage Trust and Security in Grid for the Next Generation Grids from the requirement level down to the application, middleware and foundation levels.

HTMF is a Java Hard Token Management Framework used to manage the complete livecycle of an organizations Smartcards and/or USB dongles. It communicates with the tokens through a PKCS11 interface.

Heimdall is a Java content validation framework that addresses checking of data in distributed software systems. Developers are encouraged to identify potentially untrustworthy data sources, and specify validation rules in XML.

Hippikon is a powerful authorization API that was developed for enterprise software applications and is now provided free under the GNU LGPL. Hippikon may be integrated in any java application or framework to provide complex security models with ease.

IdMUnit is an xUnit automated testing framework for Identity Management solutions.

JConfigura is a library usable in java environments for sharing configuration parameters between different java applications. Moreover it exculpates developers of aspects like property file reading and securing property files with rsa encryption.

The purpose of this project is to demonstrate Information Card interoperability on heterogeneous platforms written using Java language to support Apache Tomcat, JBoss & SUN Application Server platforms running on Linux.

JPA Security is an Access Control Solution for the Java Persistence API. JPA Security enables you to configure access control to your JPA Entity Beans based on the currently authenticated user and its roles via XML or Annotations.

JSSF - Java Server Security Faces it's framework for security layer. With JSP tags and pages/resource access control. Support MyFaces and Sun RI JSF

JSecurity is a powerful and flexible open-source Java security framework that cleanly handles authentication, authorization, enterprise session management, and cryptography services.

A test framework for penetration testing Java classes and methods with randomized parameters and testing the results.

Java Crypt Framework (JCryptFX) is a java-based education project for de-/encrypting streams. It has a implementation of DES and TripleDES in it but the framework user can write own cryptography algorithms and stream types for it - includes a console app

This project can be used to manage plugins in JAVA applications the framework provides checking of electronic signatures as well as hooks for user interaction (for example when certs are found that are not issued from a trusted authority

The Java Object Instance Security Toolkit

Laika analyzes and reports on the interoperability capabilities of EHR systems. This includes the testing for certification of EHR software products and networks.

Mjölnir is a a java-based brute force algorithm for obtaining keystore passwords by brute force. It is multi-threaded