Merge pull request #11148 from mendix/kv-mendixsso-deprecation

Mendix SSO deprecation

Author: Karuna-Mendix

content/en/docs/catalog/register/register-data.md

@@ -98,11 +98,12 @@ The Catalog supports the following methods:
 
 * **Basic authentication** – Authenticate from a username and password
 * **Active session** – For Mendix services, authenticate from the open and active browser session
-* **Mendix SSO** – For Mendix services, authenticate from single sign-on using the [Mendix SSO](/appstore/modules/mendix-sso/) module
 * **OAuth** – Authenticate with [OAuth](https://oauth.net/)
 * **OpenID Connect** – Authenticate with [OpenID Connect](https://openid.net/connect/), built on top of [OAuth 2.0](https://oauth.net/2/) and used with the [OIDC SSO](/appstore/modules/oidc/) module
 * **Other** – Specify other ways to authenticate, including custom modules
 
+You can also use **Mendix SSO** for Mendix services, but be aware that this module is deprecated as of May 1, 2026.
+
 Fill in as many details as you can to ensure that consuming developers can easily authenticate themselves to consume your service. 
 
 ##### Selecting a Marketplace Module (Optional)

content/en/docs/control-center/people/groups.md

@@ -14,6 +14,10 @@ A member in Control Center means a user of the Mendix platform who participates
 
 A Mendix Admin can set up **App Access Groups**, which consist of end-users (who are active users of Mendix Platform in your company) who will have access to [Mendix SSO](/appstore/modules/mendix-sso/)-enabled apps with specific environments and roles.
 
+{{% alert color="warning" %}}
+The Mendix SSO module has been deprecated as of May 1, 2026. As part of this deprecation, **App Access Groups** are also deprecated. You may alternatively use [OIDC SSO](/appstore/modules/oidc/), [SAML](/appstore/modules/saml/), or [LDAP](/appstore/modules/ldap/) for Mendix SSO. For **App Access Groups**, use user groups or roles configured within your Identity Provider (IdP) of choice.
+{{% /alert %}}
+
 ## Adding Access Group
 
 To create a new group, click **Add Access Group**  on the upper-right corner and then enter the **Name** and **Description**.
@@ -25,7 +29,7 @@ Click a group name on the list to bring up the group details pop-up window. Then
 {{< figure src="/attachments/control-center/people/groups/access-group.jpg" class="no-border" >}}
 
 {{% alert color="warning" %}}
-You can only add apps that utilize [Mendix SSO](/appstore/modules/mendix-sso/) to App Access Groups.
+You can only add apps that utilize [Mendix SSO](/appstore/modules/mendix-sso/) to App Access Groups. However, this module is deprecated as of May 1, 2026. You may alternatively use [OIDC SSO](/appstore/modules/oidc/), [SAML](/appstore/modules/saml/), or [LDAP](/appstore/modules/ldap/).
 {{% /alert %}}
 
 When you select groups in the list, Mendix Platform users in your company, or accessible apps in the group details page, a context menu will appear with options for exporting item details to an *.xlsx* file, deleting access groups, removing the Mendix Platform users in your company from access groups, and removing accessible apps.

content/en/docs/control-center/security/set-up-sso-byoidp.md

@@ -45,7 +45,8 @@ BYOIDP SSO has the following features:
 * When you add a domain to your company account, it is automatically added to the active IdP configuration. 
 * External users (with domains that are not part of your company) are unaffected. They still have access based on the way they normally sign in to Mendix.
 * When BYOIDP is used, a session at Mendix is valid for one hour. After the session has expired, Mendix will request a new `ID_token` from your IdP. If the user still has a session at your IdP, the token will be issued without any user input and the platform user continues to have access to the Mendix Platform. The effect of this mechanism is that users have access to the Mendix Platform as long as the session at your IdP is valid.
-* You can also use the [Mendix SSO](/appstore/modules/mendix-sso/) module in your non-production apps to provide an SSO experience. With BYOIDP, authentication of end-users of these apps will also be delegated by BYOIDP SSO. The end-users of these apps need to [sign up for a Mendix account](https://signup.mendix.com/) before they can sign in to your app.
+
+You can also use the [Mendix SSO](/appstore/modules/mendix-sso/) module in your non-production apps to provide an SSO experience. With BYOIDP, authentication of end-users of these apps will also be delegated by BYOIDP SSO. The end-users of these apps need to [sign up for a Mendix account](https://signup.mendix.com/) before they can sign in to your app. However, this module is deprecated as of May 1, 2026. You may alternatively use [OIDC SSO](/appstore/modules/oidc/), [SAML](/appstore/modules/saml/), or [LDAP](/appstore/modules/ldap/) to delegate login to your IdP directly rather than via the platform services.
 
 #### Technical Integration
 

content/en/docs/deployment/mendix-cloud-deploy/mendix-sso.md

@@ -13,6 +13,10 @@ description: "Use the Mendix SSO module to add Single Sign-on to your app using
 
 The [Mendix SSO](/appstore/modules/mendix-sso/) module enables your app end-users to sign in with their Mendix account when your app is deployed to Mendix Cloud.
 
+{{% alert color="warning" %}}
+This module is deprecated as of May 1, 2026. You may alternatively use [OIDC SSO](/appstore/modules/oidc/), [SAML](/appstore/modules/saml/), or [LDAP](/appstore/modules/ldap/).
+{{% /alert %}}
+
 {{% alert color="warning" %}}
 Because your app end-users are signing in with a Mendix account, they will all need to [sign up for a Mendix account](https://signup.mendix.com/) before they can sign in to your app.
 

content/en/docs/developerportal/settings/_index.md

@@ -82,6 +82,10 @@ Specific steps for configuring different cloud platforms are provided here:
 
 ## Access Management {#managing-app-users}
 
+{{% alert color="warning" %}}
+The Mendix SSO module has been deprecated as of May 1, 2026. As part of this deprecation, **Access Management** is also deprecated. You may alternatively use [OIDC SSO](/appstore/modules/oidc/), [SAML](/appstore/modules/saml/), or [LDAP](/appstore/modules/ldap/) for Mendix SSO. For **Access Management**, use user groups or roles configured within your Identity Provider (IdP) of choice.
+{{% /alert %}}
+
 On the **Access Management** tab, you can manage and invite app users. App users are end-users who can access the deployed app on specific environments. They can use and test your deployed app, and provide feedback.
 
 To manage users or invite users for an app deployed on a specific environment, click **Manage Users** or **Invite Users** for that environment. For more information, see the [Managing Users](#manage-users) and [Inviting Users](#invite-users) sections on this page.

content/en/docs/marketplace/genai/reference-guide/mcp-modules/mcp-server.md

@@ -57,7 +57,7 @@ The selected microflow must adhere to the following principles:
 * The Input type should be `MCPServer` and/or `System.HttpRequest`, to extract required values, such as HttpHeaders, from the request.
 * The return value needs to be a `System.User` object which represents the user who sent the request.
 
-Within your microflow, you can implement your custom logic to authenticate the user. For example, you can use username and password (basic auth), Mendix SSO, or external identity providers (IdP) as long as a `User` is returned. Note that the example authentication microflow within the module only implements basic authentication.
+Within your microflow, you can implement your custom logic to authenticate the user. For example, you can use username and password (basic auth) or external identity providers (IdP) as long as a `User` is returned. Note that the example authentication microflow within the module only implements basic authentication.
 
 The `User` returned in the microflow is used for all subsequent prompt and tool microflows within the same session. This makes the `currentUser` and `currentSession` variables available, allowing you to apply entity access for user-based access control based on the default Mendix entity access settings.
 

content/en/docs/marketplace/platform-supported-content/modules/administration.md

@@ -23,7 +23,8 @@ The [Administration](https://marketplace.mendix.com/link/component/23513) module
 * [Atlas Core](https://marketplace.mendix.com/link/component/117187): required for the Administration module versions 4.0.0 and above
 * [Combo Box](https://marketplace.mendix.com/link/component/219304): required for the Administration module versions 4.0.0 and above
 * [Atlas UI Resources](https://marketplace.mendix.com/link/component/104730): required for the Administration module versions 3.0.0 and below
-* [Mendix SSO](https://marketplace.mendix.com/link/component/111349): required for the Administration module versions 1.3.X (for example 1.3.2) and 2.1.X (for example 2.1.2)
+
+You also need the [Mendix SSO](https://marketplace.mendix.com/link/component/111349) module for the Administration module versions 1.3.X (for example 1.3.2) and 2.1.X (for example 2.1.2). However, this module is deprecated as of May 1, 2026. You may alternatively use [OIDC SSO](/appstore/modules/oidc/), [SAML](/appstore/modules/saml/), or [LDAP](/appstore/modules/ldap/).
 
 ## Installation
 
@@ -147,6 +148,10 @@ If you run the app and log in as a user with the Administrator role, you can see
 
 ## Using Supporting Microflows with Mendix SSO {#use-with-mendix-sso}
 
+{{% alert color="warning" %}}
+The Mendix SSO module is deprecated as of May 1, 2026. You may alternatively use [OIDC SSO](/appstore/modules/oidc/), [SAML](/appstore/modules/saml/), or [LDAP](/appstore/modules/ldap/).
+{{% /alert %}}
+
 The [Administration](https://marketplace.mendix.com/link/component/23513) module versions 1.3.X (for example, 1.3.2) and 2.1.X (for example, 2.1.2) contain a set of microflows to configure Mendix SSO to use **Administration.Account** as the user entity. To use the supporting microflows with Mendix SSO, follow these steps:
 
 1. Make sure that your app contains the Mendix SSO module. If it does not, import the [Mendix SSO](https://marketplace.mendix.com/link/component/111349) module from the Marketplace.

content/en/docs/marketplace/platform-supported-content/modules/mendix-feedback.md

@@ -221,33 +221,24 @@ The Mendix Feedback widget is easy to set up and automatically attaches addition
 
 You can configure the widget for certain actions in your app. All the configuration properties are explained on the various tabs of the properties dialog box for the widget. The feedback feature requires the following properties to be set:
 
-* **Project** tab
+1. **Project** tab
     * **App ID** – the unique identifier of your app, which you can find under **Project ID** in your app’s [Settings](/developerportal/general-settings/) in [Apps](https://sprintr.home.mendix.com/)l
 
         {{% alert color="info" %}}The original value of **App ID** is 1, but this value should automatically change to your correct app ID. If it does not change automatically, see [Updating App ID](#legacy-update-app-id) below.
         {{% /alert %}}
 
         **Allow screenshots** – controls whether the app user can take a screenshot or not
-* **Advanced** tab
+2. **Advanced** tab
     * **Feedback server location** – the URL of the feedback server (usually `https://feedback-api.mendix.com`), which you should only change when you are using a different environment
     * **Screenshot Foreign Rendering**
         * **No** (default)
         * **Yes** – only used when the page includes sensitive information
 
-* **Authentication** tab
+3. **Authentication** tab
 
-    {{% alert color="info" %}}For the best user experience, your are strongly encouraged to apply Mendix SSO to your app and connect the Mendix SSO module to the Mendix Feedback widget version 8.2.1 or above. Choose only one of the authentication methods: either **MendixSSO** or **Custom Authentication**.</br></br>You need to enter the value of authentication items manually as currently the widget does not support a drop-down menu for selecting microflow or the attributes of an entity.{{% /alert %}}
+    {{% alert color="info" %}}For the best user experience, configure your app to use the Mendix Feedback widget version 8.2.1 or above with a supported authentication method. Enter the value of authentication items manually as currently the widget does not support a drop-down menu for selecting microflow or the attributes of an entity.{{% /alert %}}
 
-    * **MendixSSO** – if Mendix SSO is applied and the following settings are configured correctly, the end-user can leave feedback without having to enter their name and email address
-        * **ID token microflow** – recommended that you select the **DS_GetCurrentIdToken** microflow from the Mendix SSO module. 
-        {{% alert color="info" %}}If you are using MendixSSO 3, follow the [Create a New Microflow to Retrieve DecryptedToken](#create-a-new-microflow-to-retrieve-decryptedtoken) section below.{{% /alert %}}
-        * **Decrypted Token Value** – recommended that you select the **Value** attribute from it (the default if **Value** in the MendixSSO module). 
-
-        See the screenshot below for an example:
-
-        {{< figure src="/attachments/appstore/platform-supported-content/modules/mendix-feedback/mendixsso-authentication.png" class="no-border" >}}
-
-    * **Custom Authentication** – if you are using an SSO solution other than the Mendix SSO module, you should configure the following settings. With these settings, you can provide a microflow that should return a valid username and email when the end-user is signed in with your authentication solution. If the end-user is not signed in (meaning the **User Object Provider** microflow returns an empty username or an invalid email address) the end-user will have to manually enter their name and email address when they leave feedback.
+    * **Custom Authentication**: This is the recommended authentication method. With these settings, you can provide a microflow that should return a valid username and email when the end-user is signed in with your authentication solution. If the end-user is not signed in (meaning the **User Object Provider** microflow returns an empty username or an invalid email address) the end-user will have to manually enter their name and email address when they leave feedback.
         * **User object microflow** – selects the microflow that returns **User** entity from your module
         * **User object** – selects the **User** entity
         * **User name attribute**– selects the attribute of **name** from the **User** entity
@@ -257,6 +248,20 @@ You can configure the widget for certain actions in your app. All the configurat
 
         {{< figure src="/attachments/appstore/platform-supported-content/modules/mendix-feedback/custom-authentication.png" class="no-border" >}}
 
+    * **MendixSSO**:
+
+    {{% alert color="info" %}}The Mendix SSO module is deprecated as of May 1, 2026. **Custom Authentication** is the recommended approach going forward. You may alternatively use [OIDC SSO](/appstore/modules/oidc/), [SAML](/appstore/modules/saml/), or [LDAP](/appstore/modules/ldap/) modules for authentication integration.{{% /alert %}}
+    
+    If Mendix SSO is applied and the following settings are configured correctly, the end-user can leave feedback without having to enter their name and mail address.
+      * **ID token microflow** – recommended that you select the **DS_GetCurrentIdToken** microflow from the Mendix SSO module.
+    {{% alert color="info" %}}If you are using MendixSSO 3, follow the [Create a New Microflow to Retrieve DecryptedToken](#create-a-new-microflow-to-retrieve-decryptedtoken) section below.{{% /alert %}}
+
+      * **Decrypted Token Value** – recommended that you select the **Value** attribute from it (the default if **Value** in the MendixSSO module).    
+       
+    See the screenshot below for an example:
+
+    {{< figure src="/attachments/appstore/platform-supported-content/modules/mendix-feedback/mendixsso-authentication.png" class="no-border" >}}
+
 ### Usage
 
 #### Adding the Widget to Your app

content/en/docs/marketplace/platform-supported-content/modules/mendix-sso.md

@@ -1,13 +1,22 @@
 ---
 title: "Mendix SSO"
 url: /appstore/modules/mendix-sso/
+deprecated: true
 description: "Describes the configuration and usage of the Mendix SSO module, which is available in the Mendix Marketplace."
 #If moving or renaming this doc file, implement a temporary redirect and let the respective team know they should update the URL in the product. See Mapping to Products for more details.
 #Please do not rename the anchor #supplements in this document as it is used in links from the module release notes.
 ---
 
 ## Introduction
 
+{{% alert color="warning" %}}
+This module is deprecated as of May 1, 2026, and will be removed from the public Marketplace on November 1, 2026.  
+
+To ensure uninterrupted single sign-on functionality for end users, Mendix recommends migrating to the [OIDC SSO](/appstore/modules/oidc/) module, which requires configuring an identity provider (IdP). 
+
+If an external IdP is not available, you may alternatively use local in-app credentials or implement a custom SSO solution using the [OIDC Provider](/appstore/services/oidc-provider/) module.
+{{% /alert %}}
+
 With the [Mendix SSO](https://marketplace.mendix.com/link/component/111349/) module, you can utilize single sign-on functionality by directly integrating with the Mendix identity provider and leveraging the [OpenID Connect](https://openid.net/connect/) framework.
 
 This module allows end-users to sign in with their Mendix account with the click of a button, instead of requiring their local user credentials. This module avoids having to deal with local user management or password reset flows for the test and acceptance phases of your app development.

content/en/docs/marketplace/platform-supported-content/modules/oidc.md

@@ -30,10 +30,9 @@ The module version 4.1.1 is a special release intended only for Mendix version 1
 The OIDC SSO module works with both web/responsive applications and progressive web apps (PWA).
 {{% /alert %}}
 
-Alternatives to using OIDC SSO for managing single sign-on are:
+Alternatives you can use [SAML](https://marketplace.mendix.com/link/component/1174) for managing single sign-on if your IdP supports the SAML protocol but not the OIDC protocol.
 
-* [SAML](https://marketplace.mendix.com/link/component/1174) – if your IdP supports the SAML protocol but not the OIDC protocol
-* [Mendix SSO](https://marketplace.mendix.com/link/component/111349) – if your app is targeted at end-users that have signed up to the Mendix platform
+You can also use the [Mendix SSO](https://marketplace.mendix.com/link/component/111349) if your app is targeted at end-users that have signed up to the Mendix platform. However, this module is deprecated as of May 1, 2026. You may alternatively use [SAML](/appstore/modules/saml/), or [LDAP](/appstore/modules/ldap/).
 
 ### Typical Usage Scenarios