Almwerk Foods: single sign-on failing at two sites after an Entra ID certificate rollover

Project: Operations
Type: Incident
Status: Done Done
Priority: Medium
Organization: Almwerk Foods
Reporter: Marek Nowak <marek.nowak@acme-hq.example>
Assignee: Marek Nowak <marek.nowak@acme-hq.example>
Labels: sev3almwerksingle-sign-on
Components: identity-service
Created: 21 Feb 2026, 06:40 UTC
Updated: 21 Feb 2026, 08:10 UTC
Resolved: 21 Feb 2026, 08:10 UTC

Description

Summary

Almwerk's Entra ID apps for Völkermarkt and Pöchlarn rolled to a new signing certificate early on Saturday. Our depot configs knew only the old one, so every sign-in through Entra ID at those two sites failed from 07.10 to 08.25.

Timeline (Saturday 21 February)

07.10 First failed SAML sign-in at Völkermarkt: "signature invalid".
07.31 Lisa Pichler emails support; Marek, on call, is called.
07.52 Marek sees the new certificate in Almwerk's published metadata.
08.20 New certificate added to both depot configs.
08.25 Sign-ins succeed.

Impact

About 90 people at two sites couldn't sign in for 75 minutes at the start of the Saturday shift.

Follow-ups

Depot configs accept two certificates during a rollover: ENG-1328.

Linked issues

relates to ENG-1328 Depot SAML config accepts two signing certificates during a rollover Done

Comments (0)

No comments.