SSO Cutover Planning and Execution

Prerequisites

• The Digital Privacy Addendum (DPA) is completed. For more information, contact your Client Success or Sales representative.
• FRS Ticket requesting SSO on a Fluent Account is created
• Client or Partner has Administrator access to the PingOne Environment for this Fluent Account
• All in-scope SSO user groups and authentication flows have been defined and shared with Fluent Commerce, for example:
  • User groups: customer service users, store users, head/office/business admin users, developers, etc.
  • Authentication flows: any variances in authentication systems being used on client side for different user groups.
• Client or Partner has successfully signed of testing of SSO in Sandbox Environment, including all in-scope SSO user groups and authentication flows
• Completed the configuration with the External Identity Provider (IDP), if applicable
• Have logins for one, preferably two, Fluent Super Admin API users for testing

SSO Cutover Planning

Cutover Plan

Develop an SSO cutover plan that outlines the activities, user migration, SSO cutover, testing scenarios, and timing for each activity. The cutover plan requires a clear start and end date and time for each activity, starting with user migration through cutover and testing.

• Selecting a User Migration and Cutover Time and Date: 
  • Choose a date and time for the user migration. Once the migration starts, cease all user changes or additions until the cutover is completed.
    If possible, please select a user migration date before the cutover date. For example, if the cutover date is Monday, user migration can occur at the end of the day on the preceding Friday. This means no new users can be added after user migration until the cutover is complete.
  • Choose a date and time for the cutover that is at least two weeks from the ticket date. During the cutover, all transactions to Fluent must be halted.  
  • If stopping all orders and events is not possible, please discuss alternatives with ES team.
    
• User Cleanup & Validation:
  • Partner and client perform user cleanup, which includes verifying email addresses, ensuring the appropriate user types for API activities, and providing a count of active users earmarked for migration to Fluent.
  • Stop any further user additions or changes until after SSO cutover.
  • Check if the current user count matches the previously provided number; if not, check for new users.

• Plan for Testing: The final cutover step is testing SSO for API and front-end users. Ensure sufficient test coverage to validate your IDP's various users and groups.
• Schedule the cutover via FRS:  Update the FRS ticket with your requested cutover Plan, providing at least one week's notice. **Support will respond in the ticket when the cutover time is scheduled.
  Include the following information: 
  • User Migration Date and Time: Include when user changes will stop so that migration may begin. 
  • Cutover Date and Time: When will the cutover begin? During the cutover, all transactions to Fluent will be stopped until testing. 

Cutover

User Migration

• The partner and client stop any further user additions or changes.
• Update the FRS ticket to inform support that user changes have been halted and that user migration may begin.
• User Migration will begin with the SRE team.
• Fluent confirms the completion of the migration process.

SSO Activation and Testing

• Stop all user activities on the front-end applications.
• Disable all events and order processing by the integration API users. 

Cutover (approximately 1 hour):

• Have logins for one, preferably two Super Admin API users ready.
• Prevent all transactions, orders, and events from hitting Fluent. If you are unable to disable it at the source system or middleware, please contact support or your ES consultant.
• Instruct all users to refrain from OMS front-end activities until the cutover is completed. It should take less than 30 minutes.
• Client or partner notifies Fluent upon cessation of new orders.
• The client or partner clears the integration token cache. Since all previously used tokens are invalid, clearing them from the middleware cache is best.
• Request Fluent to activate SSO.
• Fluent's team initiates SSO activation, typically taking around 15 minutes.
• Fluent confirms that SSO is active. 
• Test OMS login.
• Test API login via Postman using other Super Admin API users.
• Client/Partner conducts comprehensive testing with all user types.
• A limited number of orders is allowed to flow into Fluent from middleware
• Validate that middleware is correctly making requests to Fluent.
• Partner validates the selected orders flowing within Fluent
• Partner validates integrations between Fluent and downstream systems.
•  In the ticket, confirm completion and sign off of SSO activation to Fluent
• The ticket is closed by Fluent.