Operations / OPS-32
Administrators at single sign-on clients stuck at authenticator set-up
Description
Summary
From 09.00 every administrator who signs in with a password must use MFA (ENG-1431). Administrators who sign in through Entra ID are exempt, but the check looked at their account's old sign-in method, so they were asked to set up an authenticator, and the set-up asked for a password they don't have. They couldn't reach the portal until 10.31.
Impact
17 administrators at 9 clients on single sign-on (Brakeline, Parcelwise, Almwerk and others) couldn't open the portal for up to 1 h 29 min. Approvals at those clients waited. Nobody else affected.
Timeline (Thursday 11 June)
- 09.00 MFA required for every client.
- 09.02 First administrator at a single sign-on client sees "Enter your password to continue".
- 09.08 Priya Nair (Brakeline) emails support.
- 09.12 Ines opens this; Marek and Mira on it.
- 09.25 Cause found. Bug ENG-1491.
- 10.31 Hotfix out in all regions.
- 10.40 Brakeline's two IT admins in.
Why we missed it
Every test administrator on staging had a password. None signed in through SAML.
Follow-ups
- Staging has a single sign-on administrator in every test run (done with the fix).
Linked issues
- relates to ENG-1431 MFA for administrators Done
- relates to ENG-1491 Administrators at single sign-on depots asked to set up an authenticator Done
Comments (0)
No comments.