Vossberg: what must our Okta app send?
Description
For the Okta test in June: what exactly should our SAML app send? I'd like to prepare it now.
Linked issues
- relates to SUP-817 Vossberg: sign-in with Okta instead of passwords Done
- relates to SUP-914 Vossberg: Okta test in staging fails with 'Audience mismatch' Done
- relates to SUP-958 Vossberg: Okta test sign-in fails, depot attribute missing Done
Comments (5)
NameID = email (must match the portal account). vossbergDepot = the person's depot code; identity-service checks the person belongs to the depot they sign in at. groups = for roles, as for Entra customers. Each depot still switches on its own. Spec on PROD (Okta sign-in).
Hi Matthias, here's what the Okta app should send:
| What | Value |
|---|---|
| NameID | the person's email, the same as on their ACME account |
| vossbergDepot | the person's depot code |
| groups | the Okta groups that mean administrator, depot manager and staff |
We check vossbergDepot at sign-in against the depot the person signs in at. Each depot is still switched on its own, after a test sign-in from it.
We'll send you our SAML details for a test in our staging environment at the start of June.
Clear. Groups will be VB-ACME-Admins, VB-ACME-DepotManagers, VB-ACME-Staff.
Noted. Closing this one.
Lena, what's the attribute list for Okta?