docs: deprecate SSO Kit and add a Spring Security migration guide - #5950
Open
totally-not-ai[bot] wants to merge 6 commits into
Open
totally-not-ai[bot] wants to merge 6 commits into
totally-not-ai[bot] wants to merge 6 commits into
Conversation
SSO Kit isn't available in Vaadin 26, so every application using it has to move to Spring Security's OpenID Connect support before upgrading. There was no documentation for that move. Marks every SSO Kit page as deprecated using the same banner and admonition pattern as the other deprecated tools, and adds a migration guide that maps each kit feature to its replacement, gives the security configuration that replaces the auto-configuration, and documents the features that have no drop-in replacement.
Contributor
Preview DeploymentThis PR has been deployed for preview. URL: https://docs-preview-pr-5950.fly.dev Changed pagesAdded content is highlighted in green; removed content is marked in red on each page.
Built from f4de13e |
Uses the future tense "won't be available in Vaadin 26" throughout, since Vaadin 26 doesn't exist yet, and states the deprecation in the landing page description as well as the meta description so it shows in navigation and in search results. Also labels the SSO Kit card on the tools overview page as deprecated and mentions that its features are now in Spring Security, so the signal is visible before anyone opens the section.
The Hilla Lit client section asserted that Hilla with Lit is discontinued, which isn't documented anywhere. Replaces it with what the Upgrading Guide actually says: the router Hilla Lit views use is deprecated and no longer actively maintained, and moving Lit views to React is the recommendation.
…ions vaadin/flow#25625 adds UidlExpiredSessionStrategy and makes VaadinSecurityConfigurer install it by default, and vaadin/flow#25627 adds KeycloakOidcUserMapper behind a keycloakRoleMapping() opt-in. Both were ported from SSO Kit, so two of the migration gaps close. Moves the two features out of the gaps section and into the migration steps that need them, with a since badge for the version they arrive in and the previous manual approach kept in a note for earlier versions. Updates the feature mapping table and the checklist to match.
github-project-automation
Bot
moved this to 🔎Iteration reviews
in Vaadin Flow | Hilla | Kits ongoing work
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SSO Kit won't be available in Vaadin 26, so every application using it has to move to Spring Security's OpenID Connect support. This marks all SSO Kit pages as deprecated and adds a new guide that explains how to make that move.
What changed
Documentation only. No code, API, or build changes — nothing can break at runtime.
Content change readers will notice: the SSO Kit section is now presented as deprecated. Its pages keep working and still describe the kit, but each one now opens with a deprecation warning pointing at the new guide.
articles/tools/sso/migrating-to-spring-security.adoc:spring-boot-starter-oauth2-client, keep thespring.security.oauth2.client.*properties, replace the auto-configuration with an explicitSecurityFilterChainusingVaadinSecurityConfigurer, and — only if needed — add back-channel logout, concurrent session control, and Keycloak role mapping.@vaadin/sso-kit-client-reactwith@vaadin/hilla-react-auth, writing your own browser-callable service for user info, and usingViewConfigfor route protection.VaadinExpiredSessionStrategy,keycloakRoleMapping()), with asincebadge and the older manual approach kept in a note for earlier versions.index,theming, both getting-started pages, and the four integration pages): acautionbanner in the front matter, a[deprecated:...]title badge, and a shared deprecation admonition included fromindex.adocvia an AsciiDoc tag. This follows the same pattern used for other deprecated tools.articles/tools/index.adoc): the SSO Kit card is labelled "(Deprecated)" and says the features are now in Spring Security, so the signal shows before anyone opens the section.description, andmeta-descriptionnow state the deprecation, so it appears in navigation and search results. Wording uses the future tense ("won't be available in Vaadin 26") to match the AppSec Kit pages.@vaadin/routeris deprecated and no longer actively maintained, and moving Lit views to React is the recommendation.