Proves the inbound OIDC flow end-to-end: the IdP asserts an email + entitlements, the SP verifies the token against the JWKS, and the resolver maps it onto a real DealerZone identity using the entitlement as the disambiguator. All reads are against live VADZ.
| Provider |
Toro Stage PingFed
https://stage-identity.toro.com
|
| Client ID | VisionAmp |
| Scope | openid email |
| Entitlement claim | ttcEntitlementJSON |
Start the flow — you'll be redirected to Toro's Stage login.
Sign in with Toro PingFed →
Resolution matches the asserted email against users / salesman /
distributor_users. A Stage account with an unknown email resolves to
not_found — correct behavior, but it proves nothing. Use the emails in the
matrix below, or add matching VADZ rows for Toro's test accounts first.
| Scenario | Pick | Expected resolution |
|---|---|---|
| Master dealer | testgilesuser@gmail.com | match users.email → level 2 (id 10102) |
| Dealer | christie.moore@toro.com | match users.email → level 4 (id 9640) |
| Inactive dealer | beltzservicedept@gmail.com | match users.email → level 6 (id 10231, restricted) |
| Salesperson | jimmy.warejr@spartanmowers.com | match salesman.email → salesman.id 89, user_type 2 |
| Distributor (ALL) | megan.belanger@intimidatorutv.com | users.email → distributor_users → ADMIN, types [99] |
| Distributor (scoped) | dgoodwin@lepco.com | users.email → distributor_users → LEPCO, types [3] |
| Admin | strategicamericaadmin@gmail.com | identity-mapped overlay (replaces id 10135) |
| ★ Dual-role collision | mladouce@powereqp.com as Distributor + SalesRep |
ONE email → TWO identities: distributor users.id 9563 (PED) and rep users.id 9692 (username mark.ladouce). Disambiguated by entitlement. |
| SP initiate | /user/auth/sso/initiate/ |
| SP callback | https://vadz.visionamp.com/user/auth/sso/callback/ |
| IdP authorize | https://stage-identity.toro.com/as/authorization.oauth2 |
| IdP token | https://stage-identity.toro.com/as/token.oauth2 |
| IdP JWKS | https://stage-identity.toro.com/pf/JWKS |