Skip to content

docs: deprecate SSO Kit and add a Spring Security migration guide #5950

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Artur- merged 14 commits into from
Sep 22, 2026
Merged

docs: deprecate SSO Kit and add a Spring Security migration guide #5950

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
65d0d3f
docs: deprecate SSO Kit and add a Spring Security migration guide
totally-not-ai[bot] Sep 5, 2026
c9d4d33
docs: align SSO Kit deprecation wording with AppSec Kit
totally-not-ai[bot] Sep 5, 2026
df61fe5
docs: replace the unsourced Hilla Lit discontinuation claim
totally-not-ai[bot] Sep 5, 2026
81ca9b2
Merge branch 'main' into docs/sso-kit-to-spring-security-migration-guide
Artur- Sep 6, 2026
76514af
docs: reflect the Flow session-expiry and Keycloak role mapping addit…
totally-not-ai[bot] Sep 10, 2026
9b9e80c
docs: rename to VaadinExpiredSessionStrategy and describe the pass-th…
totally-not-ai[bot] Sep 16, 2026
4c157e0
docs: fill the gaps reviewed in the SSO Kit migration guide
totally-not-ai[bot] Sep 21, 2026
2933991
docs: correct the bean and nullability notes in the migration guide
totally-not-ai[bot] Sep 21, 2026
d6a0753
Merge remote-tracking branch 'origin/main' into docs/sso-kit-to-sprin…
totally-not-ai[bot] Sep 21, 2026
e04f027
docs: scope the Hilla parser-packages step to pre-24.7 projects
totally-not-ai[bot] Sep 21, 2026
5da8cf6
docs: document using KeycloakOidcUserMapper with an existing OidcUser…
totally-not-ai[bot] Sep 22, 2026
c90fe69
docs: state the role prefix and decode fallback of the Keycloak mapper
totally-not-ai[bot] Sep 22, 2026
3423e38
Merge remote-tracking branch 'origin/main' into docs/sso-kit-to-sprin…
totally-not-ai[bot] Sep 22, 2026
8b940cb
docs: point Keycloak role mapping at the reference section
totally-not-ai[bot] Sep 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions articles/tools/index.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,11 +83,11 @@


[.card.commercial]
=== SSO Kit
=== SSO Kit (Deprecated)

image::{tools-icon-path-prefix}_images/lock-solid.svg[opts=inline, role=icon,32,32]

Integrate your Vaadin application with third-party identity providers, and give users single sign-on capabilities.
Integrate your Vaadin application with third-party identity providers, and give users single sign-on capabilities. SSO Kit won't be available in Vaadin 26; its major features are now available directly in Spring Security.

Check warning on line 90 in articles/tools/index.adoc

View workflow job for this annotation

GitHub Actions / lint 

[vale] reported by reviewdog 🐶
[Vaadin.Versions] Don't refer to a specific Vaadin version.

Raw Output:
{"message":"[Vaadin.Versions] Don't refer to a specific Vaadin version.","location":{"path":"articles/tools/index.adoc","range":{"start":{"line":90,"column":146},"end":{"line":90,"column":155}}},"severity":"WARNING","code":{"value":"Vaadin.Versions","url":"https://vaadin.com/docs/contributing/docs/styleguide#vaadin-versions"}}

[.sr-only]
<<{tools-path-prefix}sso#,See SSO Kit>>
Expand Down
8 changes: 7 additions & 1 deletion articles/tools/sso/getting-started/hilla.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,18 @@
description: Step-by-step guide on how to use SSO Kit in a Hilla application.
meta-description: Set up Single Sign-On (SSO) in your Vaadin Hilla applications with this comprehensive guide.
order: 100
banner: SSO Kit is deprecated and won't be available in Vaadin 26. See link:../../sso/migrating-to-spring-security[Migrating to Spring Security].

Check warning on line 7 in articles/tools/sso/getting-started/hilla.adoc

View workflow job for this annotation

GitHub Actions / lint 

[vale] reported by reviewdog 🐶
[Vaadin.Versions] Don't refer to a specific Vaadin version.

Raw Output:
{"message":"[Vaadin.Versions] Don't refer to a specific Vaadin version.","location":{"path":"articles/tools/sso/getting-started/hilla.adoc","range":{"start":{"line":7,"column":57},"end":{"line":7,"column":66}}},"severity":"WARNING","code":{"value":"Vaadin.Versions","url":"https://vaadin.com/docs/contributing/docs/styleguide#vaadin-versions"}}
banner-id: sso-kit-deprecated
banner-style: caution
---


= Getting Started with SSO Kit (Hilla)
= [deprecated:com.vaadin:vaadin@V25.3]#Getting Started with SSO Kit (Hilla)#
:hilla-react:

:admonition:
include::../index.adoc[tag=deprecation-notice]

.Instructions for Hilla
[NOTE]
This page guides you in getting started with SSO Kit and Hilla. See the guide for <<index#,getting stated with SSO Kit and Vaadin Flow>>.
Expand Down
8 changes: 7 additions & 1 deletion articles/tools/sso/getting-started/index.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,16 @@
description: Step-by-step guide on how to use SSO Kit in a Vaadin Flow application.
meta-description: Get started with Single Sign-On (SSO) integration in your Vaadin Flow applications.
order: 10
banner: SSO Kit is deprecated and won't be available in Vaadin 26. See link:../sso/migrating-to-spring-security[Migrating to Spring Security].

Check warning on line 9 in articles/tools/sso/getting-started/index.adoc

View workflow job for this annotation

GitHub Actions / lint 

[vale] reported by reviewdog 🐶
[Vaadin.Versions] Don't refer to a specific Vaadin version.

Raw Output:
{"message":"[Vaadin.Versions] Don't refer to a specific Vaadin version.","location":{"path":"articles/tools/sso/getting-started/index.adoc","range":{"start":{"line":9,"column":57},"end":{"line":9,"column":66}}},"severity":"WARNING","code":{"value":"Vaadin.Versions","url":"https://vaadin.com/docs/contributing/docs/styleguide#vaadin-versions"}}
banner-id: sso-kit-deprecated
banner-style: caution
---


= Getting Started with SSO Kit (Flow)
= [deprecated:com.vaadin:vaadin@V25.3]#Getting Started with SSO Kit (Flow)#

:admonition:
include::../index.adoc[tag=deprecation-notice]

.Instructions for Vaadin Flow
[NOTE]
Expand Down
24 changes: 20 additions & 4 deletions articles/tools/sso/index.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,35 @@
---
title: SSO Kit
title: SSO Kit (deprecated)

Check warning on line 2 in articles/tools/sso/index.adoc

View workflow job for this annotation

GitHub Actions / lint 

[vale] reported by reviewdog 🐶
[Vaadin.HeadingCase] 'SSO Kit (deprecated)' should be in title case.

Raw Output:
{"message":"[Vaadin.HeadingCase] 'SSO Kit (deprecated)' should be in title case.","location":{"path":"articles/tools/sso/index.adoc","range":{"start":{"line":2,"column":8},"end":{"line":2,"column":28}}},"severity":"WARNING","code":{"value":"Vaadin.HeadingCase","url":"https://vaadin.com/docs/contributing/docs/styleguide#headings"}}
page-title: How to configure single sign-on (SSO) in Vaadin
description: Integrate Vaadin applications with third-party identity providers, and allow your users to benefit from single sign-on capabilities.
meta-description: Learn to set up single sign-on (SSO) for seamless authentication in Vaadin applications for a better user experience.
description: Integrate Vaadin applications with third-party identity providers, and allow your users to benefit from single sign-on capabilities. Deprecated, and won't be available in Vaadin 26.

Check warning on line 4 in articles/tools/sso/index.adoc

View workflow job for this annotation

GitHub Actions / lint 

[vale] reported by reviewdog 🐶
[Vaadin.Versions] Don't refer to a specific Vaadin version.

Raw Output:
{"message":"[Vaadin.Versions] Don't refer to a specific Vaadin version.","location":{"path":"articles/tools/sso/index.adoc","range":{"start":{"line":4,"column":185},"end":{"line":4,"column":194}}},"severity":"WARNING","code":{"value":"Vaadin.Versions","url":"https://vaadin.com/docs/contributing/docs/styleguide#vaadin-versions"}}
meta-description: SSO Kit integrates Vaadin applications with third-party identity providers for single sign-on. It's deprecated and won't be available in Vaadin 26.

Check warning on line 5 in articles/tools/sso/index.adoc

View workflow job for this annotation

GitHub Actions / lint 

[vale] reported by reviewdog 🐶
[Vaadin.Versions] Don't refer to a specific Vaadin version.

Raw Output:
{"message":"[Vaadin.Versions] Don't refer to a specific Vaadin version.","location":{"path":"articles/tools/sso/index.adoc","range":{"start":{"line":5,"column":156},"end":{"line":5,"column":165}}},"severity":"WARNING","code":{"value":"Vaadin.Versions","url":"https://vaadin.com/docs/contributing/docs/styleguide#vaadin-versions"}}
section-nav: commercial
order: 90
banner: SSO Kit is deprecated and won't be available in Vaadin 26. See link:./sso/migrating-to-spring-security[Migrating to Spring Security].

Check warning on line 8 in articles/tools/sso/index.adoc

View workflow job for this annotation

GitHub Actions / lint 

[vale] reported by reviewdog 🐶
[Vaadin.Versions] Don't refer to a specific Vaadin version.

Raw Output:
{"message":"[Vaadin.Versions] Don't refer to a specific Vaadin version.","location":{"path":"articles/tools/sso/index.adoc","range":{"start":{"line":8,"column":57},"end":{"line":8,"column":66}}},"severity":"WARNING","code":{"value":"Vaadin.Versions","url":"https://vaadin.com/docs/contributing/docs/styleguide#vaadin-versions"}}
banner-id: sso-kit-deprecated
banner-style: caution
---


= SSO Kit
= [deprecated:com.vaadin:vaadin@V25.3]#SSO Kit#

:commercial-feature: SSO Kit
:kit-start-trial: true
include::{articles}/_commercial-banner.adoc[opts=optional]

// tag::deprecation-notice[]
ifdef::admonition[]
[WARNING]
====
endif::admonition[]
SSO Kit is deprecated and won't be available in Vaadin 26.

Check warning on line 25 in articles/tools/sso/index.adoc

View workflow job for this annotation

GitHub Actions / lint 

[vale] reported by reviewdog 🐶
[Vaadin.Versions] Don't refer to a specific Vaadin version.

Raw Output:
{"message":"[Vaadin.Versions] Don't refer to a specific Vaadin version.","location":{"path":"articles/tools/sso/index.adoc","range":{"start":{"line":25,"column":49},"end":{"line":25,"column":58}}},"severity":"WARNING","code":{"value":"Vaadin.Versions","url":"https://vaadin.com/docs/contributing/docs/styleguide#vaadin-versions"}}

A replacement is already in place: all of the kit's major features are now available directly in Spring Security and in Vaadin's Spring Security integration. See <<{articles}/tools/sso/migrating-to-spring-security#,Migrating from SSO Kit to Spring Security>> for how to move an existing application, and which features you have to build yourself.
ifdef::admonition[]
====
endif::admonition[]
// end::deprecation-notice[]

SSO Kit provides all of the configuration needed to add single sign-on capabilities to your Vaadin applications, based on https://openid.net/connect/[OpenID Connect]. However, it depends on Spring Boot and Spring Security.

The following identity providers are supported:
Expand Down
8 changes: 7 additions & 1 deletion articles/tools/sso/integrations/azure-ad.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,16 @@
meta-description: Learn how to configure Azure AD for secure single sign-on (SSO) in your Vaadin applications.
page-links:
- https://azure.microsoft.com[Azure website]
banner: SSO Kit is deprecated and won't be available in Vaadin 26. See link:../../sso/migrating-to-spring-security[Migrating to Spring Security].

Check warning on line 8 in articles/tools/sso/integrations/azure-ad.adoc

View workflow job for this annotation

GitHub Actions / lint 

[vale] reported by reviewdog 🐶
[Vaadin.Versions] Don't refer to a specific Vaadin version.

Raw Output:
{"message":"[Vaadin.Versions] Don't refer to a specific Vaadin version.","location":{"path":"articles/tools/sso/integrations/azure-ad.adoc","range":{"start":{"line":8,"column":57},"end":{"line":8,"column":66}}},"severity":"WARNING","code":{"value":"Vaadin.Versions","url":"https://vaadin.com/docs/contributing/docs/styleguide#vaadin-versions"}}
banner-id: sso-kit-deprecated
banner-style: caution
---


= Azure AD Integration
= [deprecated:com.vaadin:vaadin@V25.3]#Azure AD Integration#

:admonition:
include::../index.adoc[tag=deprecation-notice]

Azure Active Directory (now renamed to https://azure.microsoft.com/en-us/updates/azure-ad-is-becoming-microsoft-entra-id/[Microsoft Entra ID]) is a commercial identification and access management solution. This tutorial shows how to restrict access to a Vaadin view by using SSO Kit together with Azure Active Directory.

Expand Down
8 changes: 7 additions & 1 deletion articles/tools/sso/integrations/index.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,14 @@
description: How to use SSO Kit with vendor-specific tutorials.
meta-description: Learn to set up single sign-on (SSO) for secure and seamless authentication in Vaadin applications.
order: 30
banner: SSO Kit is deprecated and won't be available in Vaadin 26. See link:../sso/migrating-to-spring-security[Migrating to Spring Security].

Check warning on line 7 in articles/tools/sso/integrations/index.adoc

View workflow job for this annotation

GitHub Actions / lint 

[vale] reported by reviewdog 🐶
[Vaadin.Versions] Don't refer to a specific Vaadin version.

Raw Output:
{"message":"[Vaadin.Versions] Don't refer to a specific Vaadin version.","location":{"path":"articles/tools/sso/integrations/index.adoc","range":{"start":{"line":7,"column":57},"end":{"line":7,"column":66}}},"severity":"WARNING","code":{"value":"Vaadin.Versions","url":"https://vaadin.com/docs/contributing/docs/styleguide#vaadin-versions"}}
banner-id: sso-kit-deprecated
banner-style: caution
---

= SSO Kit Integrations
= [deprecated:com.vaadin:vaadin@V25.3]#SSO Kit Integrations#

:admonition:
include::../index.adoc[tag=deprecation-notice]

section_outline::[]
8 changes: 7 additions & 1 deletion articles/tools/sso/integrations/keycloak.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,16 @@ description: Keycloak is an open-source identity and access management solution.
meta-description: Learn how to set up and configure Keycloak Single Sign-On (SSO) integration in your Vaadin applications for secure authentication.
page-links:
- https://www.keycloak.org[Website]
banner: SSO Kit is deprecated and won't be available in Vaadin 26. See link:../../sso/migrating-to-spring-security[Migrating to Spring Security].
banner-id: sso-kit-deprecated
banner-style: caution
---


= Keycloak Integration
= [deprecated:com.vaadin:vaadin@V25.3]#Keycloak Integration#

:admonition:
include::../index.adoc[tag=deprecation-notice]

This demo application showcases a minimal setup of SSO Kit and Keycloak. It consists of two views: a _public view_, which is accessible to every user; and a _private view_, which is protected by the `@PermitAll` security annotation and therefore only accessible by authenticated users.

Expand Down
8 changes: 7 additions & 1 deletion articles/tools/sso/integrations/okta.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,16 @@ description: Okta is a commercial identity and access management solution. This
meta-description: Learn how to set up Okta SSO for secure authentication in your Vaadin applications. Streamline user access with this step-by-step guide.
page-links:
- https://www.okta.com[Okta website]
banner: SSO Kit is deprecated and won't be available in Vaadin 26. See link:../../sso/migrating-to-spring-security[Migrating to Spring Security].
banner-id: sso-kit-deprecated
banner-style: caution
---


= Okta Integration
= [deprecated:com.vaadin:vaadin@V25.3]#Okta Integration#

:admonition:
include::../index.adoc[tag=deprecation-notice]

This tutorial shows how to restrict access to a Vaadin view by using SSO Kit together with Okta.

Expand Down
Loading
Loading