Since the fix for #3637 (commit 1eb676a), the default pac4j URL resolver (io.jooby.internal.pac4j.UrlResolverImpl) rewrites every absolute URL with the host of the current request. It only keeps the path:

var path = absoluteURL ? URI.create(url).getPath() : url;
var requestURL = ((Pac4jContext) context).getContext().getRequestURL(path);

pac4j also uses the URL resolver for URLs that point to external servers. The CAS client is one example: it computes its login URL with it. As a result, the user is redirected to the application itself instead of the CAS server.

Steps to reproduce (Jooby 4.5.4, pac4j 6.5.9):

{
  setSessionStore(SessionStore.memory(Cookie.session("jooby.sid")));
  install(new Pac4jModule()
      .client("/cas/*", conf -> new CasClient(new CasConfiguration("https://www.casserverpac4j.dev/login"))));
  get("/cas/index", ctx -> ctx.getUser().toString());
}

$ curl -s -o /dev/null -w '%{redirect_url}\n' http://localhost:8080/cas/index
http://localhost:8080/login?service=http%3A%2F%2Flocalhost%3A8080%2Fcallback%3Fclient_name%3DCasClient

Expected:

https://www.casserverpac4j.dev/login?service=http%3A%2F%2Flocalhost%3A8080%2Fcallback%3Fclient_name%3DCasClient

The query string of an absolute URL is dropped too, so a login URL like https://cas.example.org/cas/login?locale=fr would lose its parameters even if the host were kept.

Suggested fix: like pac4j's DefaultUrlResolver, only complete relative URLs and return absolute URLs unchanged:

if (isAbsoluteURL(url)) {
  return url;
}

Workaround: set pac4j's resolver on the client: casClient.setUrlResolver(new DefaultUrlResolver(true));. The pac4j Jooby demo currently does this: https://github.com/pac4j/jooby-pac4j-demo