Runbook: a depot can't sign in with single sign-on

Use this when people at one depot (or one client) can't sign in through Entra ID or Okta. If every client in a region fails, it is not this: page the on-call engineer and treat it as SEV1.

1. Find out who and where

• Which client, which depot, how many people, since when.
• Is the depot's switch on? Portal › Single sign-on › the depot. If it was switched on today, the switch-back runbook may be the faster fix while you look.
• Get one person's email and the time of a failed attempt. The sign-in log in the portal shows the failure and its reason.

2. Read the error

What people see or the log says	Usually	Fix
Entra ID page: AADSTS50105, "not assigned to the application"	the person isn't in the depot's group in Entra ID	the customer's IT adds them to the group (for Kelderby: KEL-<Depot>-Users)
Entra ID page: AADSTS700016, application not found	the depot's app in Entra ID uses the wrong identifier	compare the entity ID with the depot's settings in the portal
Our page: "The response was signed with an unknown certificate"	the IdP certificate changed or expired	the customer uploads new metadata (portal, since 18 August); see SAML certificates
Our page: "This sign-in arrived too late"	clock skew over 3 minutes, or someone pressed Back	try again; if it repeats for everyone, check our hosts' time sync
Our page: "We couldn't tell which depot you work at"	Okta: the depot attribute is missing or has a code we don't know	the customer fixes the attribute in Okta; codes must match Depots in the portal
Our page: "No account for this sign-in"	nobody in the client has that email: the imported email differs from the person's Entra ID or Okta username	correct the person's email in the portal. Don't make a second account: that is how duplicates start (SUP-1264)
Signs in, but with the wrong role	the person's groups don't map to a role, or map to two	check GroupRoleMap for the client; roles are re-applied at every sign-in

Each depot has its own certificate and sign-in address (src/Saml/DepotSamlConfig.php), so one Entra ID app per depot. A fix to one depot's app doesn't fix the next.

3. Reproduce without the customer

Run the local SAML test IdP from tools/ against staging with the customer's claims copied in (no real names). Local development has the steps.

4. Tell people

• Update the SUP ticket with what you found and what the customer's IT must do. Support writes to the customer; you don't need to.
• More than one depot, or a switch weekend: tell the bridge (Clara or Ana).

Known cases

When	Client	What happened
March 2026	Brakeline	Hull's rehearsal failed: Grimsby's certificate had been loaded for it; the two files had the same name (SUP-388)
16 Jun	Vossberg	Okta test sign-in failed: depot attribute missing (SUP-958)
21 Aug	Kelderby	Rotterdam's test login failed after metadata upload: the file came from Kelderby's test tenant (SUP-1116)
Sat 24 Oct	Kelderby	19 Ghent drivers refused with AADSTS50105 on the switch morning: only in the old KEL-Ghent-Users, not in KEL-Gent-Users; Henrik added them at 07:40, all in by 08:10 (SUP-1261)

Change history

Version	Date	Who	What
7	24 Jun 2026	Marek	Okta attribute errors
8	19 Aug 2026	Marek	Metadata upload
9	15 Oct 2026	Marek	One app per depot; known cases table
10	26 Oct 2026	Oskar	Ghent on the first Kelderby weekend