Engineering / ENG-1436
Okta sign-in for Vossberg
Description
Shaped in Emargen: Okta sign-in for Vossberg. The April spike is ENG-1386; product page Confluence PROD › Okta sign-in.
Why
Vossberg Logistik, our largest customer, uses Okta. Our single sign-on has only ever been tested with Entra ID.
What we build
- Single sign-on with Okta over SAML 2.0, depot by depot like Entra ID: one Okta app per depot, a switch per depot in the portal.
- Okta groups give roles at every sign-in, as Entra ID groups do.
- Depot from an attribute: a customer can send each person's depot code in a SAML attribute, named per customer. identity-service checks the person belongs to the depot they sign in at.
- An Okta profile in the local SAML test IdP.
Not in this epic
- Accounts made from Okta (SCIM). OpenID Connect. Okta's device checks.
Done when
Vossberg's pilot depots sign in through Okta. Target Monday 22 June; rollout plan in Confluence CS › Vossberg: Okta sign-in rollout.
Child issues
- ENG-1437 SAML: accept Okta as a depot's identity provider Done
- ENG-1439 Okta as a depot's identity provider Done
- ENG-1440 Depot from an attribute: check people sign in at their own depot Done
- ENG-1441 Local SAML test IdP gets an Okta profile Done
- ENG-1459 Load each Vossberg depot's Okta metadata Done
- ENG-1500 Pilot evening: switch 12 Vossberg depots around Hanover to Okta Done
Linked issues
- relates to SUP-817 Vossberg: sign-in with Okta instead of passwords Done
- relates to SUP-958 Vossberg: Okta test sign-in fails, depot attribute missing Done
Comments (2)
Marek Nowak · 26 Jun 2026, 19:30 UTC
All five evenings done. Celle went back to passwords for 20 minutes on Wednesday (wrong sign-in address in its Okta app), switched again at 20:40.
Pilot evening done: 12 depots around Hanover on Okta, no depot went back. Closing; the other four evenings run this week.