Runbook: switch a depot back to passwords

Written for Kelderby's switch weekends (Sat 24 Oct and Sat 31 Oct), and for any depot whose single sign-on fails after its switch. It answers the two questions ACM-319 left open on 11 October: how long switching a depot back takes, and who may do it at the weekend.

When to switch back

Switch a depot back if its people can't sign in with single sign-on and the cause won't be fixed within about 30 minutes. Most first-morning failures are people missing from the depot's group in Entra ID; that is a fix in Kelderby's Entra ID, not a reason to switch back. Read the SAML runbook first if you have five minutes.

What switching back does

• The depot's switch goes off (EnableDepotSaml). Its people sign in with their passwords again from their next sign-in. Their passwords were kept when the depot switched.
• Nobody is signed out. Sessions last eight hours and run on.
• Nothing else changes: roles, approver assignments and waiting requests stay as they are. Other depots stay on single sign-on.
• People with no password (added after the switch) get a set-password email, so check the count before you switch.
• Agency drivers on phone codes are not touched either way.

How long it takes

The switch itself takes effect within a minute (the depot's settings are cached for 60 seconds). With the confirmation and a test sign-in, we rehearsed it on Thu 22 Oct on Kelderby's test depot: 4 minutes from decision to a working password sign-in.

Who may do it

Who	How	When
The customer's administrator (for Kelderby: Henrik Lund)	Portal › Single sign-on › the depot › Switch back to passwords	any time
ACME's on-call engineer	php artisan saml:depot-off {client} {depot} --reason="…" in the client's region	only when the customer's administrator asks, on the bridge or in the SUP ticket, with Clara or Ana on the bridge

At the weekend the on-call engineer is reached through the paging rota; the bridge runs Saturday 05:00–09:00 on the switch weekends (Clara, Oskar, Tom). Every switch back gets a line in the weekend's OPS ticket (OPS-51, OPS-52).

Steps (ACME on-call)

1. Confirm the depot and get the administrator's request in writing.
2. Count people without a password: php artisan saml:depot-off {client} {depot} --dry-run.
3. Run it without --dry-run, with the reason.
4. Ask someone at the depot to sign in with a password. Clara confirms on the bridge.
5. Note it in the OPS ticket and the SUP ticket. The depot switches on again once its test sign-in passes.

Change history

Version	Date	Who	What
1	16 Oct 2026	Oskar	First version, for Kelderby's weekends
2	22 Oct 2026	Oskar	Rehearsed on Kelderby's test depot: 4 minutes
3	23 Oct 2026	Oskar	Bridge times; who to call
4	26 Oct 2026	Oskar	First weekend: Rotterdam, Antwerp and Ghent switched; no depot needed switching back