Vossberg: nobody can sign in through Okta at Bremen-Hemelingen, Hannover-Lahe and Kassel

Project: Support
Type: Incident
Status: Done Done
Priority: Highest
Organization: Vossberg Logistik
Reporter: Dennis Wolter <dennis.wolter@vossberg.example>
Assignee: Clara Rossi <clara.rossi@acme-hq.example>
Labels: vossberg-logistikoktasingle-sign-onincident
Components: identity-service
Created: 30 Jun 2026, 04:58 UTC
Updated: 30 Jun 2026, 12:30 UTC
Resolved: 30 Jun 2026, 12:30 UTC

Description

Since 06:40 nobody on the early shift at Bremen-Hemelingen can sign in. After the Okta page we get an error from ACME. Hannover-Lahe and Kassel say the same.

Dennis Wolter, shift lead, Bremen-Hemelingen

Linked issues

relates to SUP-990 Vossberg: 38 people at Billbrook can't sign in after the switch Done

Comments (8)

Ines Costa · 30 Jun 2026, 05:02 UTC

Hi Dennis, looking now.

Oskar Lund · 30 Jun 2026, 05:10 UTCInternal note

'SAML response signature invalid' on every Okta sign-in at Bremen-Hemelingen, Hannover-Lahe and Kassel since 06:40. The other depots are fine. Certificate changed on their side? Billbrook is on passwords since yesterday (SUP-990), so it doesn't see this.

Clara Rossi · 30 Jun 2026, 05:35 UTCInternal note

Rang Matthias at 07:30: Vossberg's IT changed the signing certificates on those three depots' Okta apps yesterday at 18:30, the first batch of their quarterly routine. New metadata on its way.

Matthias Krüger · 30 Jun 2026, 05:55 UTC

New metadata for the three depots attached. Sorry, nobody told us to send it first.

Elif Yildiz · 30 Jun 2026, 06:05 UTCInternal note

Loaded by hand for the three depots. Sign-ins pass.

Clara Rossi · 30 Jun 2026, 06:20 UTC

Hi Dennis, Matthias: sign-in works again at all three depots since 08:05. Cause: new signing certificates in Okta that we didn't have yet. Next time, please send us the new metadata before you change a certificate; we'll load it beside the old one so nothing breaks.

Matthias Krüger · 30 Jun 2026, 08:40 UTC

Agreed. From now on we announce certificate changes two working days ahead, with the metadata.

Oskar Lund · 30 Jun 2026, 12:30 UTCInternal note

381 failed sign-ins from 226 people on the early shift, 06:40 to 08:05. Review in Emargen (SEV2). The alert on signature failures per depot is live since 14:00. Kept in SUP as the cause was at Vossberg.