Security

These guides show how to secure a Vaadin application with Spring Security: how users log in and out, and how to restrict what each user can see and do.

Read them in order. Add Login and Add Logout set up authentication. Protect Views controls which views each user can open, and what they can do in them. Protect Services enforces the same rules in the application services, including rules about individual records. Protect both: the views decide what users can reach through the user interface, and the services are the actual security boundary.

Add Login uses an in-memory user store, which you should only use for development and testing. Connect an Identity Provider replaces it with the accounts at an identity provider, such as Keycloak. It maps the provider’s roles to the roles that your views and services check, and ends the session at the provider when users log out.

To verify the security rules with automated tests, see Test View Access Control and Testing Method Security.