## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech

## Session Summary

Short recall/reference session. Howard asked to pull up the ALIS online setup done for Cascades of Tucson and confirm the staff login model: whether usernames just need to match the email address, and whether an ALIS password needs to be set.

Invoked the `alis` skill for the staff-import/roster context, then read the authoritative record in `wiki/clients/cascades-tucson.md` ("ALIS SSO" section) plus the skill's `references/api-reference.md` and `import_builder.py` login/password logic. Confirmed the setup: ALIS at Cascades is wired for Entra OIDC SSO (tenant-wide admin consent granted 2026-06-03), the per-user join key is the ALIS staff Email field equalling the Entra UPN, and no local ALIS password is required because authentication is delegated to Microsoft/Entra.

Answered Howard directly: set Login Enabled = Yes with Email = the user's UPN (email), leave Password blank for SSO users. Flagged that the import builder auto-defaults Login Enabled to No when no password is present, so SSO rows must set Login Enabled = Yes explicitly. Also surfaced the still-pending related item from the 2026-06-05 notes: lowering the ALIS app session timeout 20->15 min (Howard, ALIS admin).

## Key Decisions

- Treated `wiki/clients/cascades-tucson.md` as the source of truth for the ALIS SSO join model rather than re-deriving from the API — the wiki explicitly records "Per-user join key = ALIS staff Email must equal the Entra UPN."
- No file changes or import build performed — this was a reference/confirmation session only.

## Problems Encountered

- None.

## Configuration Changes

- None (recall session). Session log created only.

## Credentials & Secrets

- None discovered or created. (ALIS API user login remains vaulted at `clients/cascades-tucson/alis-api-howard-user.sops.yaml`; not accessed this session.)

## Infrastructure & Servers

- ALIS tenant: Cascades of Tucson, communityId 622; tenant subdomain `cascadestucson`; API host `api.alisonline.com`.
- Identity: hybrid AD `cascades.local` -> Entra/M365 (Entra Connect, PHS + Seamless SSO), UPN suffix `cascadestucson.com`. Windows login = email = M365 = ALIS identity.
- ALIS SSO: Entra app registration -> OIDC into ALIS; tenant-wide admin consent granted 2026-06-03.

## Commands & Outputs

- `Skill alis` — loaded staff-import/roster reference.
- Read `wiki/clients/cascades-tucson.md` (ALIS SSO section, lines ~116-146).
- Grep `import_builder.py` — confirmed Login Enabled auto-defaults to No when Email+Password not both present (lines 214-226).

## Pending / Incomplete Tasks

- ALIS app session timeout 20->15 min (Howard as ALIS admin) — still pending per 2026-06-05 wiki notes. Not actioned this session.
- No import file was requested/built; offered to build one (Login Enabled=Yes, Email=UPN, no passwords) if needed.

## Reference Information

- Wiki: `wiki/clients/cascades-tucson.md` ("ALIS SSO" + "Entra Access Architecture" sections).
- Skill: `C:\Users\Howard\.claude\skills\alis\` — `references/api-reference.md`, `references/role-map.json`, `scripts/import_builder.py`.
- ALIS staff endpoints are READ-ONLY; staff/login writes happen via web UI Staff -> Import (.xls).
- Related prior log: `2026-06-29-howard-alis-caregiver-phoneonly-caretaker-crosscheck.md`.
