عرض عملي: SSO لموظفي المتاجر إلى النظام الإداري الجديد

خطوة بخطوة

1. Context: 120 stores, shift workers on shared tills, high turnover, some without corporate email.
2. Choose: back office as an OIDC client of the workforce IdP; role claims mapped from directory groups (store manager, cashier, head office).
3. Handle shared devices: short sessions, per-user login, MFA suited to store use (badge or app); no shared logins.
4. Planned mistake: one shared login per store "for speed". Fix: individual accounts, fast badge-based sign-in, and audit trail per person.
5. Automate joiner and leaver from the HR system.
6. Define break-glass for IdP outage: how a store keeps operating (links to ARC-019).