ADR-008: Single sign-on switched per depot

Status: accepted · Date: 16 January 2023 · Decided by: Marek Nowak, Rafael Duarte

Context

Clients want their people to sign in with their own company accounts (Entra ID first) over SAML. A client with many depots can't move everyone in one day: depot IT readiness differs, early shifts start before head office IT is awake, and a mistake locks out a whole depot.

Decision

• One SAML connection per client holds the identity provider's side: its entity ID and metadata.
• Each depot has its own service provider settings (DepotSamlConfig): its own certificate and sign-in address.
• Each depot has its own switch (EnableDepotSaml). A depot's people keep their passwords until its switch is on. Switching a depot only decides how the next sign-in happens; nobody is signed out.
• A depot can be switched back on its own.

Consequences

• A client can move depot by depot, rehearsing each one with a test account first. This is what customers like about it.
• In Entra ID, each depot is its own enterprise application with its own certificate. A client with 25 depots sets up 25 applications and watches 25 certificates.
• Switching many depots is many switches, flipped by hand in the portal. Each batch costs the client a weekend.

Updates

• 5 February 2024: the switch is recorded with who flipped it and when.