Mark SSO login as removed

docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md

@@ -63,7 +63,6 @@ The output for this action will look like the following:
 result:
   new-config: |-
     canonical-livepatch-server-k8s:
-      auth.sso.url: login.ubuntu.com
       database.connection-lifetime-max: 30m
       database.connection-pool-max: 15
       machine-reports.database.cleanup-interval: 6h
@@ -90,6 +89,10 @@ result:
 
 The K8s charm compatible configuration is in the `new-config` field, with deprecated and unknown configuration keys listed in `removed-keys` and `unrecognized-keys` respectively.
 
+```{note}
+The action output may include `auth.sso.*` keys if your reactive charm had SSO configured. Ubuntu SSO authentication has been removed; remove any such keys before applying the configuration.
+```
+
 The whole output for the action can also be taken and the new configuration portion written into a new YAML file with:
 
 ```bash
@@ -100,7 +103,6 @@ With the above example, the resulting configuration file will contain:
 
 ```yaml
 canonical-livepatch-server-k8s:
-  auth.sso.url: login.ubuntu.com
   database.connection-lifetime-max: 30m
   database.connection-pool-max: 15
   machine-reports.database.cleanup-interval: 6h

docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md

@@ -79,10 +79,10 @@ The script creates or overwrites the output file specified by the `-o` parameter
 | event_bus_client_key | machine-reports.event-bus.client-key | |
 | event_bus_ca_cert | machine-reports.event-bus.ca-cert | |
 | event_bus_brokers | machine-reports.event-bus.brokers | |
-| auth_lp_teams | auth.sso.teams | Make sure this is set to true: auth.sso.enabled |
-| auth_sso_public_key | auth.sso.public-key | |
-| auth_sso_location | auth.sso.url | |
-| auth_basic_users | auth.basic.users | Make sure that auth.basic.enable is set to true |
+| auth_lp_teams | **Removed** | **Removed.** Ubuntu SSO authentication is no longer available for on-premises deployments. Use `auth.basic.*` instead. |
+| auth_sso_public_key | **Removed** | **Removed.** See above. |
+| auth_sso_location | **Removed** | **Removed.** See above. |
+| auth_basic_users | auth.basic.users | Make sure that auth.basic.enabled is set to true |
 | | | |
 | swift_container_name | patch-storage.swift-container | |
 | swift_auth_url | patch-storage.swift-auth-url | |

docs/server/how-to-guides/security/setup-administration-tool.md

@@ -22,10 +22,7 @@ sudo snap alias canonical-livepatch-server-admin.livepatch-admin livepatch-admin
 
 ## Authentication
 
-The Livepatch administration tool can authenticate with the Livepatch Server in two ways:
-
-* Ubuntu SSO
-* Username and password
+The Livepatch administration tool authenticates with the Livepatch Server using Basic Auth (username and password).
 
 (server-how-to-guides-password-authentication)=
 
@@ -63,22 +60,10 @@ export LIVEPATCH_URL={haproxy URL or unit IP}
 livepatch-admin login --auth <username>:<password>
 ```
 
-## Ubuntu SSO authentication
-
-Ubuntu SSO authentication uses membership in public Launchpad groups to gate access. The Launchpad groups that have administrator privileges are specified using charmed operator configuration:
-
-```
-juju config livepatch auth_lp_teams='https://launchpad.net/~<team>'
-```
-
-Multiple teams can be specified as a comma-separated list.
-
-When logging in, user interaction is required:
+## Ubuntu SSO authentication (removed)
 
+```{note}
+Ubuntu SSO authentication has been removed. Use password (Basic Auth) authentication instead.
 ```
-export LIVEPATCH_URL={haproxy URL}
-
-livepatch-admin login
 
-To login please visit http://127.0.0.1:44035
-```
+Ubuntu SSO authentication was previously supported but has been removed and is no longer available for on-premises deployments.

docs/server/reference/platform/configuration.md

@@ -66,16 +66,24 @@ The following sections describe the available configuration values.
 
 ### Admin authentication
 
-The following values configure authentication to the server's admin endpoints. Only Basic Auth and Ubuntu SSO authentication are supported.
+The following values configure authentication to the server's admin endpoints. Ubuntu SSO authentication has been removed; only Basic Auth is supported. The `auth.sso.*` keys below are retained for legacy configuration/migration reference and are ignored by the server.
 
-- SSO Teams represent Launchpad teams.
 - Basic Auth configuration accepts a comma-separated list of users. See the [admin tool setup guide](/server/how-to-guides/security/setup-administration-tool.md#password-authentication) for details.
 - Basic Auth passwords must be bcrypt hashed.
 
 | Name | Description | Values |
 | ---- | ----------- | ------ |
 | `auth.basic.enabled` | Enable Basic Auth. | `bool` |
 | `auth.basic.users` | Comma-separated list of user objects. | `<user1>:<bcrypt hashed password>, <user2>:<bcrypt hashed password>` |
+
+#### Ubuntu SSO authentication (removed)
+
+```{note}
+Ubuntu SSO authentication has been removed. Use Basic Auth instead.
+```
+
+| Name | Description | Values |
+| ---- | ----------- | ------ |
 | `auth.sso.enabled` | Enable Ubuntu SSO authentication. | `bool` |
 | `auth.sso.teams` | SSO authentication configuration listing authorised teams. | `https://launchpad.net/~team-1,https://launchpad.net/~team-2` |
 | `auth.sso.url` | URL for SSO authentication. | `login.ubuntu.com` |