Docs

Plain Servlet Applications

Reference for securing Vaadin applications that don’t use Spring.

Vaadin’s view access control works in plain servlet applications. It relies on the user principal and the roles of the servlet request, so it works with any authentication mechanism that sets them, such as the application’s own user store or servlet container authentication.

Setting Up Security
Enabling view access control in a Vaadin application that doesn't use Spring.
Container-Managed Authentication
Letting the servlet container authenticate the users of a plain servlet Vaadin application.

Updated –