LG-14455: Improved messaging for PIV/CAC mismatch

[aduth]

🎫 Ticket

LG-14455

🛠 Summary of changes

Implements a new workflow to help guide a user to adding a replacement PIV/CAC if they attempt to authenticate with a PIV which isn't the one associated with their account, such as if a user receives a new PIV/CAC card.

📜 Testing Plan

This is easiest to test using the simulated PIV/CAC service in local development, where you can create custom subject names for PIV/CAC to force a mismatch:

# config/application.yml
identity_pki_disabled: true

Verify that the PIV/CAC mismatch replacement workflow is shown under expected circumstances:

1. Have sample application running in a separate process
2. Go to http://localhost:3000
3. Create an account with PIV/CAC as an authenticator. Optionally add another MFA, as this will affect the experience that follows
4. From account dashboard, click "Forget all browsers" and confirm the prompt
5. Sign out
6. Go to http://localhost:9292 . Optionally change "Authentication Assurance Level (AAL)" to "HSPD12 required", as this will affect the experience that follows
7. Click "Sign in"
8. Submit email and password for the account you just created
9. When prompted to authenticate with PIV/CAC, submit with a subject different from what you set up with
10. Observe that you see a screen "This government employee ID is not connected to your account".
    1. If you did not add any other MFAs to your account, observe that this only gives you the option to delete your account
    2. Observe that you see an option to skip adding PIV/CAC, unless you chose "HSPD12" required in sample application
11. Click primary action button
12. If you chose to "Authenticate and add PIV/CAC", observe that you're brought to the MFA options page with all options listed, PIV/CAC disabled, and an alert banner indicating you'll add PIV after authenticating
13. Authenticate with another MFA method
14. Observe that you're brought to the PIV/CAC setup screen. You're given another option to skip adding PIV/CAC, unless you chose "HSPD12" required in sample application
15. Setup new PIV/CAC
16. Observe that you're sent along to confirm consent to share information with partner application

👀 Screenshots

Language	Mismatch Prompt	Mismatch Prompt (HSPD12)	Mismatch Prompt (No other options)	MFA Options	PIV/CAC Setup	PIV/CAC Setup (HSPD12)
English
Spanish
French
Chinese

[jmdembe]

👍🏾

[kevinsmaster5]

Looks good and behaves as expected in local test.