Engineering / ENG-1288
Brakeline: depot SAML configs for 9 depots, a rehearsal sign-in from each
Description
Brakeline move from passwords to Entra ID over two weekends (SUP-388, plan in Confluence CS › Brakeline single sign-on rollout). There is no metadata upload in the portal, so engineering loads each depot.
| Weekend | Depots |
|---|---|
| Sat 7 Mar | Leeds, Wakefield, Bradford, York |
| Sat 14 Mar | Doncaster, Sheffield, Hull, Grimsby, Immingham |
Per depot:
- Priya Nair's team creates the depot's enterprise app and sends its metadata on the ticket.
- We load it into the depot's SAML config (
identity-service:src/Saml/DepotSamlConfig.php). - Rehearsal on the Thursday before: a test account signs in through Entra ID.
- Saturday before the early shift, the depot's switch goes on.
Linked issues
- relates to SUP-388 Brakeline rollout of single sign-on Done
- relates to ENG-1348 Depot SAML config shows the certificate's subject and fingerprint, and warns on a reused one Done
Comments (4)
Marek Nowak · 7 Mar 2026, 08:30 UTC
First four switched. Nobody was signed out. 14 Leeds new starters had no Brakeline account yet; Priya's team made them by 09:00.
Marek Nowak · 12 Mar 2026, 14:10 UTC
Hull's rehearsal failed this morning: the certificate I'd loaded was Grimsby's, the two files had the same name (SUP-671). Loaded again, passed at 14:50. ENG-1348 so it can't happen quietly again.
Marek Nowak · 23 Mar 2026, 09:05 UTC
Second five switched on Saturday. No depot went back. Closing; SUP-388 can close too.
Rehearsals for Leeds, Wakefield, Bradford and York passed (York after ENG-1337, SUP-583).