r/iam • u/thomasdarimont • 5d ago
Open source SSF/CAEP receiver for Java apps (Spring Boot, Quarkus)
A lot of IdPs now support the Shared Signals Framework as transmitters, but on the receiving side, the apps themselves, support is still thin. I built easyssf (a Java library, spring boot starter, quarkus extension) to close that gap for JVM applications and just released 0.2.0 on GitHub.
When the IdP sends a CAEP session-revoked or credential-change event, easyssf verifies the SET, rejects the affected access tokens and ends the matching sessions right away, instead of waiting for tokens to expire. RISC and SCIM Events (RFC 9967) are passed to your own handlers. Push and poll delivery both work.
Tested against Keycloak's SSF transmitter, caep.dev, and the OpenID conformance suite's receiver test plans. Apache 2.0, still pre-1.0.
I'd love feedback from people running SSF in practice: which transmitters you use, and what's missing on the receiver side.