Engineering / ENG-1440
Depot from an attribute: check people sign in at their own depot
Description
As Vossberg's IT, I send each person's depot code in an attribute, so ACME can tell when someone signs in at a depot that isn't theirs.
Acceptance criteria
- Client setting: the attribute's name (Vossberg's is
vossbergDepot). - At sign-in identity-service reads the code and checks the person belongs to the depot they sign in at.
- A missing attribute or a depot that doesn't match refuses the sign-in, with a message, and is logged.
- Clients without the setting are unaffected.
Linked issues
- relates to ENG-1503 Okta depot codes are matched case-sensitively Done
SUP-958: Vossberg's first test account had no attribute at all. The refusal now names the missing attribute; Matthias found 340 people without it.