Open Source Java Frameworks

Spring Security is a powerful and highly customizable authentication and access-control framework. It is the de-facto standard for securing Spring-based applications. Spring Security is a framework that focuses on providing both authentication and authorization to Java applications. Like all Spring projects, the real power of Spring Security is found in how easily it can be extended to meet custom requirements. Spring Security uses a Gradle-based build system. In the instructions, ./gradlew is invoked from the root of the source tree and serves as a cross-platform, self-contained bootstrap mechanism for the build. Be sure that your JAVA_HOME environment variable points to the jdk-11 folder extracted from the JDK download.

Welcome to the home of the Apereo Central Authentication Service project, more commonly referred to as CAS. CAS is an enterprise multilingual single sign-on solution and identity provider for the web and attempts to be a comprehensive platform for your authentication and authorization needs. CAS is an open and well-documented authentication protocol. The primary implementation of the protocol is an open-source Java server component by the same name hosted here, with support for a plethora of additional authentication protocols and features. Monitor and track application and system behavior, statistics and metrics in real-time. Manage and review audits and logs centrally, and publish data to a variety of downstream systems. Manage and register client applications and services with specific authentication policies. Cross-platform client support (Java, .NET, PHP, Perl, Apache, etc).

This project develops a secure P2P framework in Java (SePP). Existing P2P frameworks are not covering security by design but rather implement only some high layer security mechanisms. It has been developed as part of the EU project SMEPP (www.smepp.org)

IdMUnit is an xUnit automated testing framework for Identity Management solutions.

The purpose of this project is to demonstrate Information Card interoperability on heterogeneous platforms written using Java language to support Apache Tomcat, JBoss & SUN Application Server platforms running on Linux.

Open Legacy Storage Document: Generic Document Archiving on Disk and Network(using MINA) Framework in Java for huge number of docs(up to 2^192 documents), efficient(Java NIO), crypto, net transfert, web retrieve, J2EE and eMail archiving compatible.

The objective of the GridTrust project is to develop new Grid Security technologies in order to manage Trust and Security in Grid for the Next Generation Grids from the requirement level down to the application, middleware and foundation levels.

The PKI Framework (PKIF) is a cross-platform library for performing PKIX-compliant certificate processing. It includes support for SCVP, OCSP, CMS and Timestamps. It uses Windows CAPI, NSS or Crypto++ for cryptographic services and hardware support.

Aigebi Rbac a token driven role-based access control engine. It's pure java product. The core rbac engine is deployed as jar. It provides both java API and custom jsp tags. Admin portal is provided to manage rbac data and showcase how to use rbac engine

CincoSecurity module offers big flexibility to protect EJB3 methods, and JSF page elements.It associates a role to each EJB method (fine role) defining a security profile as a set of roles; its use cases manage security profiles and users.Java EE 5 Seam

DNA is an open, flexible and extensible deep network analyzer software server and software architecture for gathering and analyzing network packets, network sessions and applications protocols, passively off enterprise class networks.

Open Source Single Sign-On (SSO) and Identity Management

HTMF is a Java Hard Token Management Framework used to manage the complete livecycle of an organizations Smartcards and/or USB dongles. It communicates with the tokens through a PKCS11 interface.

Heimdall is a Java content validation framework that addresses checking of data in distributed software systems. Developers are encouraged to identify potentially untrustworthy data sources, and specify validation rules in XML.

Hippikon is a powerful authorization API that was developed for enterprise software applications and is now provided free under the GNU LGPL. Hippikon may be integrated in any java application or framework to provide complex security models with ease.

JConfigura is a library usable in java environments for sharing configuration parameters between different java applications. Moreover it exculpates developers of aspects like property file reading and securing property files with rsa encryption.

JPA Security is an Access Control Solution for the Java Persistence API. JPA Security enables you to configure access control to your JPA Entity Beans based on the currently authenticated user and its roles via XML or Annotations.

JSSF - Java Server Security Faces it's framework for security layer. With JSP tags and pages/resource access control. Support MyFaces and Sun RI JSF

JSecurity is a powerful and flexible open-source Java security framework that cleanly handles authentication, authorization, enterprise session management, and cryptography services.

A test framework for penetration testing Java classes and methods with randomized parameters and testing the results.

Java Crypt Framework (JCryptFX) is a java-based education project for de-/encrypting streams. It has a implementation of DES and TripleDES in it but the framework user can write own cryptography algorithms and stream types for it - includes a console app

This project can be used to manage plugins in JAVA applications the framework provides checking of electronic signatures as well as hooks for user interaction (for example when certs are found that are not issued from a trusted authority

The Java Object Instance Security Toolkit

Laika analyzes and reports on the interoperability capabilities of EHR systems. This includes the testing for certification of EHR software products and networks.

Mjölnir is a a java-based brute force algorithm for obtaining keystore passwords by brute force. It is multi-threaded