Vossberg: Okta sign-in rollout
By Clara Rossi · created 1 Jun 2026, 11:30 UTC · last updated 26 Jun 2026, 15:10 UTC · version 7
vossbergoktarolloutsingle-sign-on
Vossberg's 60 depots move from passwords to Okta. Okta sign-in ships on 22 June (ENG-1436); this page is the rollout.
Vossberg: Matthias Krüger · ACME: Clara Rossi, Lena Fischer (product), Marek Nowak
Plan
| Evening | Depots | People |
|---|---|---|
| Mon 22 Jun | 12 depots around Hanover (pilot) | 1,250 |
| Tue 23 Jun | 12 | 1,300 |
| Wed 24 Jun | 12 | 1,350 |
| Thu 25 Jun | 12 | 1,300 |
| Fri 26 Jun | 12 | 1,300 |
Switches at 20:00, between Vossberg's day and night shifts. Each evening's depots rehearse with a test account the day before.
The depot attribute
Okta sends each person's depot code in the attribute vossbergDepot. identity-service reads it at sign-in to check the person belongs to the depot they sign in at.
On 16 June the first test sign-in failed (SUP-958): the test account had no vossbergDepot. Matthias found 340 people without the attribute. Bettina filled it from HR by 19 June.
How it went
- Pilot, 22 June: 1,190 of 1,250 signed in through Okta the same evening and night. No depot went back.
- 23 June to 26 June: all on schedule. Celle went back to passwords for 20 minutes on the third evening: its Okta app had the wrong sign-in address. Matthias fixed it and Celle switched again at 20:40.
- Codes that didn't match: 19 of Vossberg's depots existed in Okta but not in ACME, and some codes differed. People at those depots were homed at the nearest depot for now. We will fix it properly later (it became the depot import).
Afterwards
- Okta works like Entra ID for roles: groups give roles at every sign-in.
- A person whose Okta email differs from the one we hold can't sign in. If someone makes them a new account, we get duplicates. Watch for them.