Proves the inbound OIDC flow end-to-end: the IdP asserts an email + entitlements, the SP verifies the token against the JWKS, and the resolver maps it onto a real DealerZone identity using the entitlement as the disambiguator. All reads are against live VADZ.
| Provider |
Toro Stage PingFed
https://stage-identity.toro.com
|
| Client ID | VisionAmp |
| Scope | openid email |
| Entitlement claim | ttcEntitlementJSON |
Start the flow — you'll be redirected to Toro's Stage login.
Sign in with Toro PingFed →
Resolution matches the asserted email against users / salesman /
distributor_users. A Stage account with an unknown email resolves to
not_found — correct behavior, but it proves nothing.
The dztest.* accounts below are synthetic logins wired to the SAME dealer
locations, distributors and rep hierarchies as the real accounts they mirror, so the
identity is fake but every association it resolves to is real. They are created by
_audit/stage-test-accounts.sql, which must be run against VADZ before
any of these will resolve.
| Scenario | Pick | Expected resolution |
|---|---|---|
| Master dealer | dztest.multi@mailinator.com | match users.email → level 2; Giles OPE, 2 locations, sold-to 442238 |
| Dealer | dztest.dealer@mailinator.com | match users.email → level 4; catch-all location 4607, no sold-to |
| Dealer (w/ sold-to) | dztest.dealer2@mailinator.com | match users.email → level 4; S & H Farm Supply, sold-to 430074 |
| Inactive dealer | dztest.inactive@mailinator.com | match users.email → level 6 (restricted); Beltz, sold-to 442184 |
| Salesperson | dztest.salesrep@mailinator.com | match salesman.email → user_type 2; backing users.email is the username dztest.salesrep |
| Distributor (ALL) | dztest.distall@mailinator.com | users.email → distributor_users → ADMIN, types [99] |
| Distributor (scoped) | dztest.distlepco@mailinator.com | users.email → distributor_users → LEPCO, types [3] |
| Admin | dztest.admin@mailinator.com | identity-mapped via config admin_emails — no VADZ row needed |
| ★ Dual-role collision | dztest.dual@mailinator.com as Distributor + SalesRep |
ONE email → TWO identities: distributor (PED, types [1]) and rep whose users.email is the username dztest.dual. Disambiguated by entitlement. |
| SP initiate | /user/auth/sso/initiate/ |
| SP callback | https://vadz.visionamp.com/user/auth/sso/callback/ |
| IdP authorize | https://stage-identity.toro.com/as/authorization.oauth2 |
| IdP token | https://stage-identity.toro.com/as/token.oauth2 |
| IdP JWKS | https://stage-identity.toro.com/pf/JWKS |