KEYCLOAK-2377

docbook/auth-server-docs/reference/en/en-US/modules/MigrationFromOlderVersions.xml

@@ -104,6 +104,14 @@
                     with mongo and infinispan under modules keycloak-model-mongo and keycloak-model-infinispan.
                 </para>
             </simplesect>
+            <simplesect>
+                <title>For adapters, session id changed after login</title>
+                <para>
+                    To plug a security attack vector, for platforms that support it (Tomcat 8, Undertow/Wildfly, Jetty 9),
+                    the keycloak oidc and saml adapters will change the session id after login.  You can turn off this behavior
+                    check adapter config switches.
+                </para>
+            </simplesect>
         </section>
         <section>
             <title>Migrating to 1.8.0</title>

docbook/auth-server-docs/reference/en/en-US/modules/adapter-config.xml

@@ -379,6 +379,15 @@
                     </para>
                 </listitem>
             </varlistentry>
+            <varlistentry>
+                <term>turn-off-change-session-id-on-login</term>
+                <listitem>
+                    <para>
+                        The session id is changed by default on a successful login on some platforms to plug a security attack vector (Tomcat 8, Jetty9, Undertow/Wildfly).  Change this to true if you want to turn this off
+                        This is <emphasis>OPTIONAL</emphasis>. The default value is <emphasis>false</emphasis>.
+                    </para>
+                </listitem>
+            </varlistentry>
         </variablelist>
     </para>
 </section>