Okta Branding Proposal

[sean-usds]

Problem statement

New users should get a RS-branded email when an account has been created for them in Okta. Currently we're locked into using SR's branded templates that are set up in Okta.

See: https://app.zenhub.com/workspaces/experience-607d9d5e68b95200150fec37/issues/cdcgov/prime-reportstream/2815

Email:

"Activate your account" flow

Option 1: Cobranding

In the account creation email, we could include both SimpleReport and ReportStream branding, or just CDC/PRIME branding.

Effort

• Low (days)

Work Involved

• Edit the branding images in the account creation email template
• Replace "SimpleReport" in email subjects/bodies to a cobranded term

Pros:

• Easiest path forward
• No code changes required

Cons:

• Password setting for account creation would still happen on simplereport.com (Activate your account button goes to SR)
• Most SimpleReport users probably don't need to know what ReportStream is, and vice versa
• This same branding problem would still exist for other Okta emails, such as password reset
• We would need SimpleReport's buy-in

Option 2: Custom ReportStream onboarding email

Instead of sending all users the same onboarding email, we could instead trigger a different email template for ReportStream users that uses RS branding. If we go this route, we would probably want to also create our own version fo the activation flow on reportstream.cdc.gov that exists on simplereport.gov

Effort

• Medium to high (weeks)

Work involved

• Create new email template in Okta Admin
• Use Okta Workflows to determine which account creation email a user gets based on their Okta group (All RS users' groups begin with "DH")
• Make sure RS users aren't getting SR email
• Create web interface on ReportStream for password creation (same as the one on SR)

Pros:

• Most intuitive experience for the end user. RS users don't need to know what SR is, and vice versa.
• Once we have a base RS email template, it will be easier to split out other automated emails as well (such as password reset)
• No need to get SimpleReport's buy-in since nothing on their side would change

Cons:

• Requires 1-2 sprints of 1-2 engineering time and possibly 1-2 sprint of design time
• We would also want to set up RS templates for other Okta emails as well. It would be strange to use RS branding for account creation, and SR for password reset
• Onboarding steps and/or documentation may need to be updated

[sean-usds]

Going with: Option 2

Notes:

• SR has a test Okta account that we can use for testing
• Can route emails based on Okta Group (RS groups begin with "DH") but it would be worth investigating whether or not there is a better way
• What happens when someone who already has a SR account wants to be added to RS?
  • Should be able to just add them to a RS group
  • Password reset flows will need to work on both SR and RS

Related/followup issues:

• Help pages
• Password reset
• Email reset

Next Steps:

• Detail stories for:
  • Email template - Drew
  • Getting access to SR's test Okta - Tom
  • Investigating Workflow solution for email routing - Sean
  • Web UI/UX for password creation - Sean / eng team
• Sean & Tom will discuss approach with SR folks
• Sean will create/find appropriate Zenhub tickets (epic 3635 can be the starting point)

[sean-usds]

Relevant tasks:

• Email template: https://app.zenhub.com/workspaces/experience-607d9d5e68b95200150fec37/issues/cdcgov/prime-reportstream/3634
• Okta Workflow Spike: https://app.zenhub.com/workspaces/experience-607d9d5e68b95200150fec37/issues/cdcgov/prime-reportstream/3718
• We UI for activation: https://app.zenhub.com/workspaces/experience-607d9d5e68b95200150fec37/issues/cdcgov/prime-reportstream/3717