Identity provisioning and sign-in

Use OIDC for authentication and sign-in claims. Use SCIM for user lifecycle, teams, and team membership. Test each integration with a pilot assignment before broad rollout, keep provider identifiers stable, and document whether elevated roles come from OIDC claims or manual administration.

Start with authentication modes, then migrate the existing administrator without changing its User ID. Configure independent emergency access and test and enforce SSO after a staged login test. Use credential rotation for tested provider changes and lockout recovery during an IdP outage. Emergency recovery needs PostgreSQL and never silently enables password fallback.

For existing installations, follow Upgrade existing SSO for preserved login behavior, controlled cutover and migration acceptance checks.

Use Local certification and failure rehearsal to reproduce upgrade, concurrency, deployment-cutover and recovery checks.