Depot SAML config accepts two signing certificates during a rollover

Project: Engineering
Type: Story
Status: Done Done
Priority: High
Organization: Almwerk Foods
Reporter: Marek Nowak <marek.nowak@acme-hq.example>
Assignee: Piet de Vries <piet.devries@acme-hq.example>
Labels: almwerksingle-sign-on
Components: identity-service
Fix versions: identity-service 2026.03.06
Sprint: Sprint 37
Story points: 5
Created: 23 Feb 2026, 09:40 UTC
Updated: 6 Mar 2026, 15:00 UTC
Resolved: 6 Mar 2026, 15:00 UTC

Description

On Saturday two of Almwerk Foods' sites couldn't sign in for 75 minutes: their Entra ID apps rolled to a new signing certificate and our depot configs only knew the old one (OPS-27). An IdP rolling its certificate shouldn't break sign-in.

Acceptance criteria

A depot's SAML config holds up to two IdP signing certificates; a response signed by either is accepted.
The ops console shows each certificate's expiry date.
An expired one is ignored and logged once a day.

Linked issues

relates to OPS-27 Almwerk Foods: single sign-on failing at two sites after an Entra ID certificate rollover Done
relates to SUP-852 Parcelwise: a new Entra ID signing certificate on Wednesday Done
relates to SUP-897 Parcelwise: new SAML certificate for the Eindhoven hub Done
relates to ENG-1625 Metadata with two signing certificates: only the first is kept Done

Comments (0)

No comments.