Single sign-on

Owner: Lena Fischer · For what to tell customers, see Customer success's Single sign-on.

People sign in with their own company's account instead of an ACME password. It is switched on one depot at a time.

What we support

Identity provider	Since	Customers
Microsoft Entra ID, over SAML 2.0	2023	Brakeline, Kelderby, Parcelwise, Almwerk; Halden planned
Okta, over SAML 2.0	22 June 2026	Vossberg, Ridgeway
Anything else		Untested

How it works

• One connection per customer: the identity provider's details and metadata.
• Per depot: its own certificate and sign-in address on our side, and its own switch. In Entra ID or Okta that means one app per depot.
• The switch decides how the depot's people sign in from their next sign-in. It signs nobody out: a session runs until it ends (eight hours unless the client set another length, 1 to 12).
• Matching: a sign-in is matched to an existing person by email. No account is made at sign-in; a person we can't match is refused with "No account for this sign-in".
• Roles come from the customer's groups at every sign-in. Assignments made in the portal are left alone.
• Depot from an attribute (Okta): a customer can send each person's depot code, and we check the person belongs to the depot they sign in at. Vossberg does.
• Phone codes are untouched by the switch: people without a company account keep them.
• Switching back: an administrator turns a depot's switch off and its people sign in with passwords again.
• Metadata upload: a customer's IT uploads each depot's metadata in the portal since 18 August. Customers' administrators are warned 60 and 30 days before a certificate expires (SAML certificates: expiry checks).

What it doesn't do

• Make accounts from Entra ID or Okta (no SCIM). See Accounts from Entra ID (provisioning).
• Switch every depot at once. ACM-293 is in delivery since 20 October. Decided in its kickoff: a rehearsal list where each depot's test sign-in is run and kept; one switch for every depot whose test passed, naming the ones left out; one depot can go back alone; people keep their passwords for 14 days after their depot switches; each depot's manager gets an email the day before.

Change history

Version	Date	Who	What
1	23 Jan 2023	Rafael	Entra ID per depot (ADR-008)
6	5 Feb 2024	Marek	Per-depot certificates; the switch never signs anyone out
9	22 Jun 2026	Lena	Okta, depot attribute
11	18 Aug 2026	Lena	Metadata upload
12	1 Oct 2026	Lena	Depot approver assignments survive sign-in
14	20 Oct 2026	Lena	ACM-293 in delivery and what its kickoff decided