Single sign-on (SSO) for your club

With single sign-on, people whose email address is on your organisation's domain sign in to SportyPlus with the account they already use at work or school. They don't need a separate SportyPlus password. Your identity provider can also decide who gets the Administrator, Cashier or Employee role at your club.

SportyPlus works with any identity provider that supports OpenID Connect, including Microsoft Entra ID (formerly Azure AD), Google Workspace, Okta, Keycloak and Authentik.

Setting it up takes three steps:

1. Register SportyPlus in your identity provider.
2. Add the identity provider in SportyPlus.
3. Verify your email domain, then switch the connection on.

You need to be a club administrator, and someone who can change your identity provider and your domain's DNS. In a larger organisation those are often different people. Send them this page.

Register SportyPlus in your identity provider

Open Club Admin → Settings → Single sign-on. The top of the page shows the redirect URI. It is the same for every club:

https://api.sporty.plus/oauth/sso/callback

In your identity provider, create a web application (sometimes called a confidential client) that uses this redirect URI. Note down three things:

• the issuer URL,
• the client ID,
• a client secret.

The steps for common providers are below.

Microsoft Entra ID

1. In the Microsoft Entra admin center, open Applications → App registrations → New registration.
2. Give it a name, for example SportyPlus. Under Supported account types choose Accounts in this organizational directory only.
3. Under Redirect URI choose Web and paste the redirect URI. Choose Register.
4. On the overview page, copy the Application (client) ID and the Directory (tenant) ID.
5. Open Certificates & secrets → New client secret, then copy the secret's Value. It is shown only once.
6. Under Token configuration → Add optional claim → ID, add email.

The issuer URL is https://login.microsoftonline.com/<tenant-id>/v2.0, with your Directory (tenant) ID in the middle.

To give roles from groups, also choose Token configuration → Add groups claim and select Security groups. Entra sends group object IDs, not names, so map the IDs in SportyPlus.

Google Workspace

1. In the Google Cloud console, choose or create a project for your organisation.
2. Open Google Auth Platform → Audience (OAuth consent screen) and set the user type to Internal, so only your Workspace accounts can sign in.
3. Open Clients → Create client, choose Web application, add the redirect URI under Authorised redirect URIs, and choose Create.
4. Copy the Client ID and Client secret.

The issuer URL is https://accounts.google.com.

Google doesn't send group memberships when someone signs in, so roles from groups are not available with Google Workspace. Give roles by hand instead.

Okta

1. In the Okta admin console, open Applications → Create App Integration, choose OIDC – OpenID Connect and Web Application.
2. Add the redirect URI under Sign-in redirect URIs, and assign the people or groups who may sign in.
3. Copy the Client ID and Client secret.

The issuer URL is your Okta domain, for example https://yourclub.okta.com. If you use a custom authorization server, it is that server's issuer, for example https://yourclub.okta.com/oauth2/default.

To give roles from groups, open the application's Sign On tab, edit OpenID Connect ID Token, and set the Groups claim to groups with a filter that matches the groups you want to send.

Keycloak

1. In your realm, open Clients → Create client and choose OpenID Connect.
2. Switch on Client authentication and keep Standard flow on.
3. Add the redirect URI under Valid redirect URIs.
4. Copy the client secret from the Credentials tab.

The issuer URL is https://<your-keycloak>/realms/<realm>.

To give roles from groups, open the client's dedicated scope under Client scopes, add a Group Membership mapper, set the token claim name to groups, and switch off Full group path if you want plain group names.

Add the identity provider in SportyPlus

On Club Admin → Settings → Single sign-on, choose Add identity provider and fill in:

Choose Save. SportyPlus checks straight away that it can read the issuer's configuration, and tells you if it can't. The usual cause is a typo in the issuer URL.

Roles from groups

Under Roles from groups, choose Add group for each group that should give a role at your club, and pick Administrator, Cashier or Employee. Use the group name, or for Entra ID the group's object ID.

At every sign-in, SportyPlus compares the person's groups with this list. It gives the roles they should have, and takes away roles it gave them earlier for a group they are no longer in.

• A role you gave someone by hand, under Administrators and roles, is never taken away by single sign-on.
• The club owner always stays an administrator.
• Changes apply the next time the person signs in. Someone you remove from a group in your identity provider keeps their role until then. To take access away at once, also remove it in SportyPlus.

Multi-factor sign-in

Trust the identity provider's multi-factor sign-in is on by default. Members who turned on two-factor authentication in SportyPlus are then not asked for their SportyPlus code when your identity provider reports that it already did multi-factor authentication. If the provider doesn't report it, or you switch this off, they are asked as usual.

Verify your email domain

Single sign-on only works for email addresses on domains you have proved belong to your organisation. That is what stops anyone from using a connection to sign in as somebody else.

1. Under Email domains, type your domain, for example yourclub.com, and choose Add domain.
2. SportyPlus shows a TXT record with a Name and a Value. Add exactly that record where your domain's DNS is managed: your registrar, your hosting provider or Cloudflare.
3. Choose Check now. DNS changes can take from a few minutes to 48 hours to appear. SportyPlus also checks again every hour on its own.

When the domain shows Verified, switch the connection On. Its badge changes to Active, and the button appears on your club's login page.

Add every domain your people use, for example both yourclub.com and students.yourclub.com. Each one needs its own record.

How people sign in

On your club's login page, people choose Sign in with … and the label you gave the connection. Anyone can also choose Use single sign-on, type their work email and choose Continue. SportyPlus finds the identity provider that has verified that email's domain.

The first time someone signs in this way:

• If they already have a SportyPlus account with that email address, they are signed in to it. Their bookings, memberships and history are all there.
• If they don't, an account is created for them. They are then asked to complete their profile with their date of birth and the other details SportyPlus needs.

After that, they can still sign in with their password, Google or Apple if they had set those up. Single sign-on is one more way in, not the only one.

When something goes wrong

Last used on the connection shows when anyone last signed in through it. That is a quick way to confirm it works after you change something.