Currently SSO configuration uses elytron, it is a change with prior configuration.
SSO support should detect if security subsystem is present and use it if SSO_FORCE_LEGACY_SECURITY=true. Elytron being used only if legacy security subsystem is not there or if SSO_FORCE_LEGACY_SECURITY=false (default value).

EAP CD18 will set SSO_FORCE_LEGACY_SECURITY=true