Callback configuration

These instructions apply to 14.0.0. An indirect client needs a callback endpoint to complete authentication. Keep this endpoint outside the security filter and secured actions.

See the pac4j callback documentation for the available options.

In conf/routes:

GET    /callback    @org.pac4j.play.CallbackController.callback(request: Request)

If your authentication protocol posts to the callback (for example SAML POST binding), also add the corresponding POST /callback route. Configure Play's CSRF handling for that protocol endpoint as required; an empty pac4j filter rule does not disable Play's other filters.

The security module examples already bind this controller. To customize that binding, use the following in configure():

Java

final var controller = new org.pac4j.play.CallbackController();
controller.setDefaultUrl("/");
bind(org.pac4j.play.CallbackController.class).toInstance(controller);

Scala

val controller = new org.pac4j.play.CallbackController()
controller.setDefaultUrl("/")
bind(classOf[org.pac4j.play.CallbackController]).toInstance(controller)

The controller receives the shared pac4j Config through Play injection. Configure its session store with config.setSessionStoreFactory(...) in the security module.