SC-02: SSO Migration
| Field | Value |
|---|---|
| Scenario ID | PER-005-SC-02 |
| Context / Trigger | The organization has been operating on ATOMx for two months using local accounts. David has validated the platform and is now ready to integrate corporate SSO (Azure AD via OIDC). He needs to transition 15 active users from local account authentication to federated SSO without interrupting operations. Three pilots currently have active flight authorizations scheduled for the next 48 hours. |
Narrative
David opens the organization’s identity integration settings [UERQ-SYS-1996]. He selects “Add Federated Identity Provider” and chooses OIDC. The system presents a guided configuration form: he enters the Azure AD tenant discovery URL, client ID, client secret, and configures claims mapping [UERQ-SYS-1954, UERQ-SYS-1956] — mapping Azure AD’s “preferred_username” to ATOMx identity, Azure AD groups to ATOMx roles, and the “department” claim to an organization attribute.
David enables JIT provisioning [UERQ-SYS-1957] so that users who authenticate through Azure AD for the first time are automatically provisioned with the organization’s default role (Pilot/Operator). He configures SCIM provisioning [UERQ-SYS-1982] for automated lifecycle sync: new Azure AD users in the “ATOMx Operators” group will be provisioned, and deleted or disabled users will be deactivated.
Before activating the federation, David reviews the transition plan displayed by the system: “15 users currently authenticated via local accounts. After federation activation: users will authenticate via Azure AD on next login. Existing active sessions will remain valid until their current session expires. No active flight authorizations will be interrupted.”
He confirms and activates the federation. He then claims the organization’s email domain [UERQ-SYS-1978] so that any future employee registrations with the corporate domain are automatically routed into his organization’s realm.
David sends an internal communication to all users: “Your next ATOMx login will use your corporate credentials. No action required.” He monitors the admin dashboard over the next 48 hours, watching as users’ authentication method transitions from “Local” to “Federated (Azure AD)” upon their next login.
The three pilots with active authorizations complete their flights without interruption — their existing sessions were preserved during the transition.
Traceability
| Linked End Goals | Transition from local accounts to federated SSO without interrupting active flight authorizations. |
| Linked Capabilities | OIDC Provider Support (UERQ-SYS-1954), Claims Mapping (UERQ-SYS-1956), JIT Provisioning (UERQ-SYS-1957), SCIM 2.0 Provisioning (UERQ-SYS-1982), Domain Claiming (UERQ-SYS-1978), Per-Organization Identity Integration (UERQ-SYS-1996), Session Management (UERQ-SYS-1933). |
| Safety Relevance | Critical: this is the highest-risk moment for the Organization Admin. An SSO misconfiguration during transition could lock out pilots who have active or scheduled flight authorizations. The system must preserve existing sessions during the transition and not force re-authentication on users with active flights. |