Brakeline rollout of single sign-on
Description
Hi,
our move to Entra ID is done. We'd like all nine depots signing in to ACME with Entra ID by the end of March.
Depots: Leeds, Wakefield, Bradford, York, Doncaster, Sheffield, Hull, Grimsby, Immingham (about 1,100 people).
Drivers start at 05:00 so we can't have depots without sign-in on a weekday morning. Can you send what you need and a plan?
Priya
Linked issues
- relates to SUP-671 Brakeline: Hull rehearsal fails, 'signature is invalid' Done
- relates to SUP-636 Brakeline: 14 new starters at Leeds can't sign in after the switch Done
- relates to SUP-583 Brakeline: York test sign-in refused, response 'not yet valid' Done
- relates to ENG-1288 Brakeline: depot SAML configs for 9 depots, a rehearsal sign-in from each Done
- relates to ENG-1337 SAML response refused: NotBefore 40 s in the future (Brakeline York) Done
- relates to ENG-1348 Depot SAML config shows the certificate's subject and fingerprint, and warns on a reused one Done
- relates to ENG-1401 Send people of a depot on single sign-on to their identity provider when they try a password Done
- relates to SUP-1102 Kelderby: single sign-on with Entra ID before go-live Done
Comments (17)
Groups: BRK-Admins, BRK-Depot-Managers, BRK-Drivers. They're named by job, not by depot. Could we do all nine in one weekend instead?
We'd rather not. If something goes wrong at one depot we want to be fixing one depot, not nine. Four then five keeps each Saturday small. Job-named groups are fine: the depot manager group gives the depot manager role; only administrators approve anyway.
OK, two weekends.
Plan and steps written up on the Brakeline single sign-on rollout page in CS, so we can reuse it for the next customer.
Nine DepotSamlConfig entries for client 1003, certs generated. SP metadata per depot sent to Priya.
Federation metadata for all nine apps attached.
IdP metadata loaded for all nine depots. Switches still off.
York's early test was refused on a clock check on our side, see SUP-583; fixed.
Rehearsal for the first four: all four test accounts signed in. On for Saturday.
Leeds, Wakefield, Bradford and York switched between 07:05 and 07:50 (06:05–06:50 your time). First sign-ins at each depot went through. 14 new starters at Leeds had no account yet, see SUP-636.
Monday morning fine at all four.
Rehearsal for the second five: Hull failed this morning because we had loaded Grimsby's certificate for it, see SUP-671. Fixed; all five passed by this afternoon.
Worth adding to the checklist: one test account per depot, not one per customer. Hull would have gone live with Grimsby's certificate otherwise.
Doncaster, Sheffield, Hull, Grimsby and Immingham switched between 07:00 and 08:05. First sign-ins fine.
All good this end. No calls from depots this morning, which is a first.
Wrapping up:
- Nine depots on Entra ID over two weekends, 7 March and 14 March. No downtime at any depot, and no depot went back to passwords.
- Two problems, both fixed before a shift needed them: Hull's rehearsal ran against Grimsby's certificate (SUP-671), and 14 new starters at Leeds had no account on the Saturday (SUP-636).
The Single sign-on checklist now asks for one test account per depot by the Tuesday before the switch, and new starters' accounts before the weekend. The whole rollout is on the Brakeline single sign-on rollout page. Closing; thanks Priya.
Hi Priya,
Here's how we'd do it.
Set-up, per depot
The switch
Proposed weekends