Accounts, SSO and MFA
Every till login, scanner sign-in and admin password at Mangrove Market is a door into the business. This lesson shows how TechOps gives each person the right doors on their first day, changes them when they move, closes all of them on their last day, and makes stolen passwords far less useful.
By the end you can
- Explain how an identity provider, a directory, groups and roles fit together
- Run the joiner, mover and leaver process from HR records, including day-one offboarding
- Describe single sign-on with SAML or OpenID Connect: who vouches, who trusts, and what the app checks
- Rank MFA methods by strength and say which ones stop phishing
- Find leavers and movers with stale access in an access review query, and handle shared logins, service accounts and break-glass accounts
The everyday picture
Picture the head office building. On your first day you go to the front desk, show your ID and get a staff badge. You do not show your passport at every door after that. Each door has a reader that trusts the badge, because it trusts the front desk that printed it.
The badge does not open every door. Its colour says which group you are in: blue opens the office floors, orange also opens the server room. When you move from the stores team to the warehouse team, the desk changes your colour. When you leave, the desk switches the badge off, and every door stops opening for it at the same moment.
Now imagine a side door with an old key lock that the desk does not control. People who left the company still have that key. Most access problems in IT look like this: the badge system works, and the trouble is the doors that are not connected to it.
One identity, many apps: the directory and the identity provider
Mangrove's roughly 1,920 store staff, plus warehouse, head office and engineering staff, use the Back office, the Store app, email, the tills, GitHub and the store boxes. If every app kept its own user list, a leaver would have to be removed in ten places, and somebody would forget one.
So the company keeps one identity per person in two connected parts. The directory stores who exists: a username, an employee number, a job title, a store and a manager. The identity provider (IdP) does the login: it checks your password and your second factor, then tells the apps who you are. In many companies one product does both jobs; Microsoft Entra ID, Okta, Google Workspace and Keycloak are common examples.
Three words get mixed up all the time, so keep them apart:
- An account is one login for one person (or one machine) in one system. A cashier may have a directory account and a till account.
- A group is a named set of accounts, such as
store-managersortechops-admins. Groups usually live in the directory. - A role is a set of permissions inside an app, such as "Back office: approve stock transfers". In RBAC you give permissions to roles, map roles to groups, and put people in groups.
This chain makes access manageable. When a person changes job, you change their groups, and every app that reads those groups follows. Apps learn about groups at login, when the IdP sends them along with the identity. Many apps also accept SCIM, a standard API the IdP uses to create, update and disable accounts ahead of login. SCIM matters for leavers: it switches off the app account before the person ever tries to log in again.