Index
Changing the login screen does not modernize all authentication. Sessions, access recovery, integrations, and linking to permissions need to remain consistent throughout the transition.
How to evaluate this decision
Inventory entry forms and consumers that depend on current identity. Separate authentication from authorization: recognizing the user does not define what he can do. Plan account linking, handling old sessions, and recovery. Avoid migrations that create parallel accounts without preserving the correct relationship with data and organizations.
Criteria for comparing proposals
- Identity: Match old and new accounts with verifiable criteria.
- Sessions: control expiration, revocation and temporary coexistence when necessary.
- Recovery: Test reset and safely return to flow without extending permissions.
A scenario to discuss with the supplier
Hypothetical example: the new provider authenticates a person, but the system does not find their link with the company. Creating an empty organization automatically can hide the error and separate the user from their data.
What to validate upon delivery
Test active, blocked, and multi-linked users, as well as expired sessions. Check authorization on the server and redirect destinations.
Prepare the conversation about the project
Bring access flows, providers and link rules to Quantum9. The scope must include transition and recovery while preserving existing security boundaries.
Software architecture · Map the company's priority