[{"data":1,"prerenderedAt":1081},["ShallowReactive",2],{"navigation_docs_en":3,"-en-interface-settings-single-sign-on":324,"-en-interface-settings-single-sign-on-surround":1076},[4,17,222,249,284],{"title":5,"path":6,"stem":7,"children":8,"icon":11},"Getting started","\u002Fen\u002Fgetting-started","en\u002F0.getting-started\u002F1.index",[9,12],{"title":10,"path":6,"stem":7,"icon":11},"Tour of the admin","sporty-toggle-large-on",{"title":13,"path":14,"stem":15,"icon":16},"First-week setup","\u002Fen\u002Fgetting-started\u002Ffirst-week-setup","en\u002F0.getting-started\u002F2.first-week-setup","sporty-calendar-check",{"title":18,"path":19,"stem":20,"children":21,"page":221},"Interface","\u002Fen\u002Finterface","en\u002F1.interface",[22,65,72,79,90,97,105,112,119,135,156,163,187,197,215],{"title":23,"path":24,"stem":25,"children":26,"icon":28},"Courts","\u002Fen\u002Finterface\u002Fcourts","en\u002F1.interface\u002F01.courts\u002F1.index",[27,29],{"title":23,"path":24,"stem":25,"icon":28},"sporty-court-sport",{"title":30,"path":31,"stem":32,"children":33,"icon":11},"Access control and lights","\u002Fen\u002Finterface\u002Fcourts\u002Fintegrations","en\u002F1.interface\u002F01.courts\u002F5.integrations\u002F1.index",[34,35,40,45],{"title":30,"path":31,"stem":32,"icon":11},{"title":36,"path":37,"stem":38,"icon":39},"Weblock","\u002Fen\u002Finterface\u002Fcourts\u002Fintegrations\u002Fweblock","en\u002F1.interface\u002F01.courts\u002F5.integrations\u002F2.weblock","sporty-door-open",{"title":41,"path":42,"stem":43,"icon":44},"Shelly","\u002Fen\u002Finterface\u002Fcourts\u002Fintegrations\u002Fshelly","en\u002F1.interface\u002F01.courts\u002F5.integrations\u002F3.shelly","sporty-bolt",{"title":46,"path":47,"stem":48,"children":49,"icon":39},"UniFi Access","\u002Fen\u002Finterface\u002Fcourts\u002Fintegrations\u002Funifi-access","en\u002F1.interface\u002F01.courts\u002F5.integrations\u002F4.unifi-access\u002F1.index",[50,52,56,61],{"title":51,"path":47,"stem":48,"icon":39},"Overview",{"title":53,"path":54,"stem":55,"icon":11},"Connect the VPN","\u002Fen\u002Finterface\u002Fcourts\u002Fintegrations\u002Funifi-access\u002Fvpn","en\u002F1.interface\u002F01.courts\u002F5.integrations\u002F4.unifi-access\u002F2.vpn",{"title":57,"path":58,"stem":59,"icon":60},"Create an API token","\u002Fen\u002Finterface\u002Fcourts\u002Fintegrations\u002Funifi-access\u002Fapi-token","en\u002F1.interface\u002F01.courts\u002F5.integrations\u002F4.unifi-access\u002F3.api-token","sporty-gear",{"title":62,"path":63,"stem":64,"icon":28},"Set it up in Club Admin","\u002Fen\u002Finterface\u002Fcourts\u002Fintegrations\u002Funifi-access\u002Fclub-admin","en\u002F1.interface\u002F01.courts\u002F5.integrations\u002F4.unifi-access\u002F4.club-admin",{"title":66,"path":67,"stem":68,"children":69,"icon":71},"Members","\u002Fen\u002Finterface\u002Fmembers","en\u002F1.interface\u002F02.members\u002F1.index",[70],{"title":66,"path":67,"stem":68,"icon":71},"sporty-user-group",{"title":73,"path":74,"stem":75,"children":76,"icon":78},"Memberships","\u002Fen\u002Finterface\u002Fmemberships","en\u002F1.interface\u002F03.memberships\u002F1.index",[77],{"title":73,"path":74,"stem":75,"icon":78},"sporty-id-card",{"title":80,"path":81,"stem":82,"children":83,"icon":85},"Leagues","\u002Fen\u002Finterface\u002Fleagues","en\u002F1.interface\u002F04.leagues\u002F1.index",[84,86],{"title":80,"path":81,"stem":82,"icon":85},"sporty-ranking-star",{"title":87,"path":88,"stem":89,"icon":16},"Planned competitions","\u002Fen\u002Finterface\u002Fleagues\u002Fplanned-competitions","en\u002F1.interface\u002F04.leagues\u002F2.planned-competitions",{"title":91,"path":92,"stem":93,"children":94,"icon":96},"Tournaments","\u002Fen\u002Finterface\u002Ftournaments","en\u002F1.interface\u002F05.tournaments\u002F1.index",[95],{"title":91,"path":92,"stem":93,"icon":96},"sporty-trophy",{"title":98,"path":99,"stem":100,"children":101,"icon":104},"Payments and subscriptions","\u002Fen\u002Finterface\u002Fpayments","en\u002F1.interface\u002F06.payments\u002F1.index",[102],{"title":103,"path":99,"stem":100,"icon":104},"Payments","sporty-credit-card",{"title":106,"path":107,"stem":108,"children":109,"icon":111},"Shop","\u002Fen\u002Finterface\u002Fshop","en\u002F1.interface\u002F07.shop\u002F1.index",[110],{"title":106,"path":107,"stem":108,"icon":111},"sporty-bag-shopping",{"title":113,"path":114,"stem":115,"children":116,"icon":118},"Schools and coaches","\u002Fen\u002Finterface\u002Fschools","en\u002F1.interface\u002F08.schools\u002F1.index",[117],{"title":113,"path":114,"stem":115,"icon":118},"sporty-graduation-cap",{"title":120,"path":121,"stem":122,"children":123,"icon":125},"Emails","\u002Fen\u002Finterface\u002Femails","en\u002F1.interface\u002F09.emails\u002F1.index",[124,126,131],{"title":120,"path":121,"stem":122,"icon":125},"sporty-envelope",{"title":127,"path":128,"stem":129,"icon":130},"Newsletters and campaigns","\u002Fen\u002Finterface\u002Femails\u002Fnewsletters","en\u002F1.interface\u002F09.emails\u002F2.newsletters","sporty-newspaper",{"title":132,"path":133,"stem":134,"icon":71},"Mailing lists","\u002Fen\u002Finterface\u002Femails\u002Fmailing-lists","en\u002F1.interface\u002F09.emails\u002F3.mailing-lists",{"title":136,"path":137,"stem":138,"children":139,"icon":141},"Video and cameras","\u002Fen\u002Finterface\u002Fvideo","en\u002F1.interface\u002F10.video\u002F1.index",[140,142,146,151],{"title":136,"path":137,"stem":138,"icon":141},"sporty-camera-cctv",{"title":143,"path":144,"stem":145,"icon":141},"Dahua cameras","\u002Fen\u002Finterface\u002Fvideo\u002Fdahua","en\u002F1.interface\u002F10.video\u002F2.dahua",{"title":147,"path":148,"stem":149,"icon":150},"Other RTMP cameras","\u002Fen\u002Finterface\u002Fvideo\u002Frtmp","en\u002F1.interface\u002F10.video\u002F3.rtmp","sporty-video",{"title":152,"path":153,"stem":154,"icon":155},"Match analytics","\u002Fen\u002Finterface\u002Fvideo\u002Fanalytics","en\u002F1.interface\u002F10.video\u002F4.analytics","sporty-chart-simple",{"title":157,"path":158,"stem":159,"children":160,"icon":162},"Reports","\u002Fen\u002Finterface\u002Freports","en\u002F1.interface\u002F11.reports\u002F1.index",[161],{"title":157,"path":158,"stem":159,"icon":162},"sporty-chart-mixed",{"title":164,"path":165,"stem":166,"children":167,"icon":60},"Settings","\u002Fen\u002Finterface\u002Fsettings","en\u002F1.interface\u002F12.settings\u002F1.index",[168,170,174,178,183],{"title":169,"path":165,"stem":166,"icon":60},"Club settings",{"title":171,"path":172,"stem":173,"icon":16},"Booking rules and price list","\u002Fen\u002Finterface\u002Fsettings\u002Fbooking-rules","en\u002F1.interface\u002F12.settings\u002F2.booking-rules",{"title":175,"path":176,"stem":177,"icon":78},"Sign-up and legal pages","\u002Fen\u002Finterface\u002Fsettings\u002Fsignup-and-legal","en\u002F1.interface\u002F12.settings\u002F3.signup-and-legal",{"title":179,"path":180,"stem":181,"icon":182},"Administrators and roles","\u002Fen\u002Finterface\u002Fsettings\u002Fadministrators-and-roles","en\u002F1.interface\u002F12.settings\u002F4.administrators-and-roles","sporty-user",{"title":184,"path":185,"stem":186},"Single sign-on (SSO) for your club","\u002Fen\u002Finterface\u002Fsettings\u002Fsingle-sign-on","en\u002F1.interface\u002F12.settings\u002F5.single-sign-on",{"title":188,"path":189,"stem":190,"children":191,"icon":130},"Social publishing","\u002Fen\u002Finterface\u002Fsocial","en\u002F1.interface\u002F13.social\u002F1.index",[192,193],{"title":188,"path":189,"stem":190,"icon":130},{"title":194,"path":195,"stem":196,"icon":11},"Connecting channels","\u002Fen\u002Finterface\u002Fsocial\u002Fchannels","en\u002F1.interface\u002F13.social\u002F2.channels",{"title":198,"path":199,"stem":200,"children":201,"icon":28},"Seated events","\u002Fen\u002Finterface\u002Fseated-events","en\u002F1.interface\u002F14.seated-events\u002F1.index",[202,203,207,211],{"title":198,"path":199,"stem":200,"icon":28},{"title":204,"path":205,"stem":206,"icon":28},"Seating plans","\u002Fen\u002Finterface\u002Fseated-events\u002Fseating-plans","en\u002F1.interface\u002F14.seated-events\u002F2.seating-plans",{"title":208,"path":209,"stem":210,"icon":16},"Selling seats","\u002Fen\u002Finterface\u002Fseated-events\u002Fselling-seats","en\u002F1.interface\u002F14.seated-events\u002F3.selling-seats",{"title":212,"path":213,"stem":214,"icon":39},"On sale and at the door","\u002Fen\u002Finterface\u002Fseated-events\u002Fon-sale","en\u002F1.interface\u002F14.seated-events\u002F4.on-sale",{"title":216,"path":217,"stem":218,"children":219,"icon":16},"Season tickets","\u002Fen\u002Finterface\u002Fseason-tickets","en\u002F1.interface\u002F15.season-tickets\u002F1.index",[220],{"title":216,"path":217,"stem":218,"icon":16},false,{"title":223,"path":224,"stem":225,"children":226,"icon":229},"Website","\u002Fen\u002Fwebsite","en\u002F2.website\u002F1.index",[227,230,235,239,244],{"title":228,"path":224,"stem":225,"icon":229},"Website builder","sporty-browser",{"title":231,"path":232,"stem":233,"icon":234},"Pages, hero and footer","\u002Fen\u002Fwebsite\u002Fpages","en\u002F2.website\u002F2.pages","sporty-file-lines",{"title":236,"path":237,"stem":238,"icon":130},"News and events","\u002Fen\u002Fwebsite\u002Fnews-and-events","en\u002F2.website\u002F3.news-and-events",{"title":240,"path":241,"stem":242,"icon":243},"Coaches and gallery","\u002Fen\u002Fwebsite\u002Fcoaches-and-gallery","en\u002F2.website\u002F4.coaches-and-gallery","sporty-images",{"title":245,"path":246,"stem":247,"icon":248},"FAQ and sponsors","\u002Fen\u002Fwebsite\u002Ffaq-and-sponsors","en\u002F2.website\u002F5.faq-and-sponsors","sporty-circle-question",{"title":250,"path":251,"stem":252,"children":253,"icon":182},"For members","\u002Fen\u002Fmembers","en\u002F3.members\u002F1.index",[254,256,260,264,268,272,276,280],{"title":255,"path":251,"stem":252,"icon":182},"Using the member app",{"title":257,"path":258,"stem":259,"icon":16},"Booking a court","\u002Fen\u002Fmembers\u002Fbooking","en\u002F3.members\u002F2.booking",{"title":261,"path":262,"stem":263,"icon":104},"Memberships and payments","\u002Fen\u002Fmembers\u002Fpayments","en\u002F3.members\u002F3.payments",{"title":265,"path":266,"stem":267,"icon":85},"How competitions work","\u002Fen\u002Fmembers\u002Fhow-competitions-work","en\u002F3.members\u002F4.how-competitions-work",{"title":269,"path":270,"stem":271,"icon":96},"Leagues, tournaments and results","\u002Fen\u002Fmembers\u002Fcompetitions","en\u002F3.members\u002F5.competitions",{"title":273,"path":274,"stem":275,"icon":71},"Family and children","\u002Fen\u002Fmembers\u002Ffamily","en\u002F3.members\u002F6.family",{"title":277,"path":278,"stem":279,"icon":78},"Your account","\u002Fen\u002Fmembers\u002Faccount","en\u002F3.members\u002F7.account",{"title":281,"path":282,"stem":283,"icon":248},"Getting help","\u002Fen\u002Fmembers\u002Fhelp","en\u002F3.members\u002F8.help",{"title":285,"path":286,"stem":287,"children":288,"icon":290},"OAuth & Sign in with Sporty","\u002Fen\u002Foauth","en\u002F4.oauth\u002F1.index",[289,291,295,299,303,307,311,315,319],{"title":285,"path":286,"stem":287,"icon":290},"sporty-brackets-curly",{"title":292,"path":293,"stem":294,"icon":290},"Registering an application","\u002Fen\u002Foauth\u002Fclients","en\u002F4.oauth\u002F2.clients",{"title":296,"path":297,"stem":298,"icon":290},"The authorization code flow","\u002Fen\u002Foauth\u002Fauthorization-code","en\u002F4.oauth\u002F3.authorization-code",{"title":300,"path":301,"stem":302,"icon":290},"Scopes","\u002Fen\u002Foauth\u002Fscopes","en\u002F4.oauth\u002F4.scopes",{"title":304,"path":305,"stem":306,"icon":290},"Sign in with Sporty","\u002Fen\u002Foauth\u002Fsign-in-with-sporty","en\u002F4.oauth\u002F5.sign-in-with-sporty",{"title":308,"path":309,"stem":310,"icon":290},"The partner API","\u002Fen\u002Foauth\u002Fpartner-api","en\u002F4.oauth\u002F6.partner-api",{"title":312,"path":313,"stem":314,"icon":290},"Syncing bookings","\u002Fen\u002Foauth\u002Fbooking-sync","en\u002F4.oauth\u002F7.booking-sync",{"title":316,"path":317,"stem":318,"icon":290},"MCP and AI clients","\u002Fen\u002Foauth\u002Fmcp-and-ai-clients","en\u002F4.oauth\u002F8.mcp-and-ai-clients",{"title":320,"path":321,"stem":322,"icon":323},"Agent checkout","\u002Fen\u002Foauth\u002Fagent-checkout","en\u002F4.oauth\u002F9.agent-checkout","sporty-cart-shopping",{"id":325,"title":184,"body":326,"description":1069,"extension":1070,"links":1071,"meta":1072,"navigation":1073,"path":185,"seo":1074,"stem":186,"__hash__":1075},"docs_en\u002Fen\u002F1.interface\u002F12.settings\u002F5.single-sign-on.md",{"type":327,"value":328,"toc":1052},"minimark",[329,333,341,344,369,376,380,391,402,409,430,433,438,510,517,532,536,583,588,591,595,622,632,651,655,688,693,711,714,723,810,817,821,841,844,858,862,873,876,879,913,928,937,941,945,949,963,966,980,983,987,1046],[330,331,332],"p",{},"With single sign-on, people whose email address is on your organisation's domain sign in to SportyPlus with the account they already use at work or school. They don't need a separate SportyPlus password. Your identity provider can also decide who gets the Administrator, Cashier or Employee role at your club.",[330,334,335,336,340],{},"SportyPlus works with any identity provider that supports ",[337,338,339],"strong",{},"OpenID Connect",", including Microsoft Entra ID (formerly Azure AD), Google Workspace, Okta, Keycloak and Authentik.",[330,342,343],{},"Setting it up takes three steps:",[345,346,347,356,362],"ol",{},[348,349,350,355],"li",{},[351,352,354],"a",{"href":353},"#register-sportyplus-in-your-identity-provider","Register SportyPlus in your identity provider",".",[348,357,358,355],{},[351,359,361],{"href":360},"#add-the-identity-provider-in-sportyplus","Add the identity provider in SportyPlus",[348,363,364,368],{},[351,365,367],{"href":366},"#verify-your-email-domain","Verify your email domain",", then switch the connection on.",[330,370,371,372,375],{},"You need to be a club ",[351,373,374],{"href":180},"administrator",", and someone who can change your identity provider and your domain's DNS. In a larger organisation those are often different people. Send them this page.",[377,378,354],"h2",{"id":379},"register-sportyplus-in-your-identity-provider",[330,381,382,383,386,387,390],{},"Open ",[337,384,385],{},"Club Admin → Settings → Single sign-on",". The top of the page shows the ",[337,388,389],{},"redirect URI",". It is the same for every club:",[392,393,399],"pre",{"className":394,"code":396,"language":397,"meta":398},[395],"language-text","https:\u002F\u002Fapi.sporty.plus\u002Foauth\u002Fsso\u002Fcallback\n","text","",[400,401,396],"code",{"__ignoreMap":398},[330,403,404,405,408],{},"In your identity provider, create a ",[337,406,407],{},"web application"," (sometimes called a confidential client) that uses this redirect URI. Note down three things:",[410,411,412,419,424],"ul",{},[348,413,414,415,418],{},"the ",[337,416,417],{},"issuer URL",",",[348,420,414,421,418],{},[337,422,423],{},"client ID",[348,425,426,427,355],{},"a ",[337,428,429],{},"client secret",[330,431,432],{},"The steps for common providers are below.",[434,435,437],"h3",{"id":436},"microsoft-entra-id","Microsoft Entra ID",[345,439,440,453,468,481,491,501],{},[348,441,442,443,449,450,355],{},"In the ",[351,444,448],{"href":445,"rel":446},"https:\u002F\u002Fentra.microsoft.com",[447],"nofollow","Microsoft Entra admin center",", open ",[337,451,452],{},"Applications → App registrations → New registration",[348,454,455,456,460,461,464,465,355],{},"Give it a name, for example ",[457,458,459],"em",{},"SportyPlus",". Under ",[337,462,463],{},"Supported account types"," choose ",[337,466,467],{},"Accounts in this organizational directory only",[348,469,470,471,464,474,477,478,355],{},"Under ",[337,472,473],{},"Redirect URI",[337,475,476],{},"Web"," and paste the redirect URI. Choose ",[337,479,480],{},"Register",[348,482,483,484,487,488,355],{},"On the overview page, copy the ",[337,485,486],{},"Application (client) ID"," and the ",[337,489,490],{},"Directory (tenant) ID",[348,492,382,493,496,497,500],{},[337,494,495],{},"Certificates & secrets → New client secret",", then copy the secret's ",[337,498,499],{},"Value",". It is shown only once.",[348,502,470,503,506,507,355],{},[337,504,505],{},"Token configuration → Add optional claim → ID",", add ",[337,508,509],{},"email",[330,511,512,513,516],{},"The issuer URL is ",[400,514,515],{},"https:\u002F\u002Flogin.microsoftonline.com\u002F\u003Ctenant-id>\u002Fv2.0",", with your Directory (tenant) ID in the middle.",[330,518,519,520,523,524,527,528,531],{},"To give roles from groups, also choose ",[337,521,522],{},"Token configuration → Add groups claim"," and select ",[337,525,526],{},"Security groups",". Entra sends group ",[337,529,530],{},"object IDs",", not names, so map the IDs in SportyPlus.",[434,533,535],{"id":534},"google-workspace","Google Workspace",[345,537,538,546,556,573],{},[348,539,442,540,545],{},[351,541,544],{"href":542,"rel":543},"https:\u002F\u002Fconsole.cloud.google.com",[447],"Google Cloud console",", choose or create a project for your organisation.",[348,547,382,548,551,552,555],{},[337,549,550],{},"Google Auth Platform → Audience"," (OAuth consent screen) and set the user type to ",[337,553,554],{},"Internal",", so only your Workspace accounts can sign in.",[348,557,382,558,561,562,565,566,569,570,355],{},[337,559,560],{},"Clients → Create client",", choose ",[337,563,564],{},"Web application",", add the redirect URI under ",[337,567,568],{},"Authorised redirect URIs",", and choose ",[337,571,572],{},"Create",[348,574,575,576,579,580,355],{},"Copy the ",[337,577,578],{},"Client ID"," and ",[337,581,582],{},"Client secret",[330,584,512,585,355],{},[400,586,587],{},"https:\u002F\u002Faccounts.google.com",[330,589,590],{},"Google doesn't send group memberships when someone signs in, so roles from groups are not available with Google Workspace. Give roles by hand instead.",[434,592,594],{"id":593},"okta","Okta",[345,596,597,609,616],{},[348,598,599,600,561,603,579,606,355],{},"In the Okta admin console, open ",[337,601,602],{},"Applications → Create App Integration",[337,604,605],{},"OIDC – OpenID Connect",[337,607,608],{},"Web Application",[348,610,611,612,615],{},"Add the redirect URI under ",[337,613,614],{},"Sign-in redirect URIs",", and assign the people or groups who may sign in.",[348,617,575,618,579,620,355],{},[337,619,578],{},[337,621,582],{},[330,623,624,625,628,629,355],{},"The issuer URL is your Okta domain, for example ",[400,626,627],{},"https:\u002F\u002Fyourclub.okta.com",". If you use a custom authorization server, it is that server's issuer, for example ",[400,630,631],{},"https:\u002F\u002Fyourclub.okta.com\u002Foauth2\u002Fdefault",[330,633,634,635,638,639,642,643,646,647,650],{},"To give roles from groups, open the application's ",[337,636,637],{},"Sign On"," tab, edit ",[337,640,641],{},"OpenID Connect ID Token",", and set the ",[337,644,645],{},"Groups claim"," to ",[400,648,649],{},"groups"," with a filter that matches the groups you want to send.",[434,652,654],{"id":653},"keycloak","Keycloak",[345,656,657,665,676,681],{},[348,658,659,660,662,663,355],{},"In your realm, open ",[337,661,560],{}," and choose ",[337,664,339],{},[348,666,667,668,671,672,675],{},"Switch on ",[337,669,670],{},"Client authentication"," and keep ",[337,673,674],{},"Standard flow"," on.",[348,677,611,678,355],{},[337,679,680],{},"Valid redirect URIs",[348,682,683,684,687],{},"Copy the client secret from the ",[337,685,686],{},"Credentials"," tab.",[330,689,512,690,355],{},[400,691,692],{},"https:\u002F\u002F\u003Cyour-keycloak>\u002Frealms\u002F\u003Crealm>",[330,694,695,696,699,700,703,704,706,707,710],{},"To give roles from groups, open the client's dedicated scope under ",[337,697,698],{},"Client scopes",", add a ",[337,701,702],{},"Group Membership"," mapper, set the token claim name to ",[400,705,649],{},", and switch off ",[337,708,709],{},"Full group path"," if you want plain group names.",[377,712,361],{"id":713},"add-the-identity-provider-in-sportyplus",[330,715,716,717,561,719,722],{},"On ",[337,718,385],{},[337,720,721],{},"Add identity provider"," and fill in:",[724,725,726,739],"table",{},[727,728,729],"thead",{},[730,731,732,736],"tr",{},[733,734,735],"th",{},"Field",[733,737,738],{},"What to enter",[740,741,742,761,774,785,798],"tbody",{},[730,743,744,750],{},[745,746,747],"td",{},[337,748,749],{},"Button label",[745,751,752,753,756,757,760],{},"The name on the login button, shown as ",[457,754,755],{},"Sign in with …",". Your organisation's name, or ",[457,758,759],{},"Microsoft",", works well.",[730,762,763,768],{},[745,764,765],{},[337,766,767],{},"Issuer URL",[745,769,770,771,355],{},"The issuer from your identity provider. Leave out ",[400,772,773],{},"\u002F.well-known\u002Fopenid-configuration",[730,775,776,782],{},[745,777,778,579,780],{},[337,779,578],{},[337,781,582],{},[745,783,784],{},"From your identity provider. The secret is stored encrypted and never shown again. When you edit the connection, leave it blank to keep the current one.",[730,786,787,791],{},[745,788,789],{},[337,790,300],{},[745,792,793,794,797],{},"Leave it as ",[400,795,796],{},"openid email profile"," unless your provider asks for more, for example a scope that adds groups.",[730,799,800,804],{},[745,801,802],{},[337,803,645],{},[745,805,806,807,809],{},"The claim that carries group memberships. ",[400,808,649],{}," for most providers.",[330,811,812,813,816],{},"Choose ",[337,814,815],{},"Save",". SportyPlus checks straight away that it can read the issuer's configuration, and tells you if it can't. The usual cause is a typo in the issuer URL.",[434,818,820],{"id":819},"roles-from-groups","Roles from groups",[330,822,470,823,561,825,828,829,832,833,836,837,840],{},[337,824,820],{},[337,826,827],{},"Add group"," for each group that should give a role at your club, and pick ",[337,830,831],{},"Administrator",", ",[337,834,835],{},"Cashier"," or ",[337,838,839],{},"Employee",". Use the group name, or for Entra ID the group's object ID.",[330,842,843],{},"At every sign-in, SportyPlus compares the person's groups with this list. It gives the roles they should have, and takes away roles it gave them earlier for a group they are no longer in.",[410,845,846,852,855],{},[348,847,848,849,851],{},"A role you gave someone by hand, under ",[351,850,179],{"href":180},", is never taken away by single sign-on.",[348,853,854],{},"The club owner always stays an administrator.",[348,856,857],{},"Changes apply the next time the person signs in. Someone you remove from a group in your identity provider keeps their role until then. To take access away at once, also remove it in SportyPlus.",[434,859,861],{"id":860},"multi-factor-sign-in","Multi-factor sign-in",[330,863,864,867,868,872],{},[337,865,866],{},"Trust the identity provider's multi-factor sign-in"," is on by default. Members who turned on ",[351,869,871],{"href":870},"\u002Fen\u002Fmembers\u002Faccount#two-factor-sign-in","two-factor authentication"," in SportyPlus are then not asked for their SportyPlus code when your identity provider reports that it already did multi-factor authentication. If the provider doesn't report it, or you switch this off, they are asked as usual.",[377,874,367],{"id":875},"verify-your-email-domain",[330,877,878],{},"Single sign-on only works for email addresses on domains you have proved belong to your organisation. That is what stops anyone from using a connection to sign in as somebody else.",[345,880,881,893,907],{},[348,882,470,883,886,887,569,890,355],{},[337,884,885],{},"Email domains",", type your domain, for example ",[400,888,889],{},"yourclub.com",[337,891,892],{},"Add domain",[348,894,895,896,899,900,903,904,906],{},"SportyPlus shows a ",[337,897,898],{},"TXT"," record with a ",[337,901,902],{},"Name"," and a ",[337,905,499],{},". Add exactly that record where your domain's DNS is managed: your registrar, your hosting provider or Cloudflare.",[348,908,812,909,912],{},[337,910,911],{},"Check now",". DNS changes can take from a few minutes to 48 hours to appear. SportyPlus also checks again every hour on its own.",[330,914,915,916,919,920,923,924,927],{},"When the domain shows ",[337,917,918],{},"Verified",", switch the connection ",[337,921,922],{},"On",". Its badge changes to ",[337,925,926],{},"Active",", and the button appears on your club's login page.",[330,929,930,931,579,933,936],{},"Add every domain your people use, for example both ",[400,932,889],{},[400,934,935],{},"students.yourclub.com",". Each one needs its own record.",[938,939,940],"warning",{},"Keep the TXT record in place. If it is removed, the domain stops being verified at the next hourly check, and people with addresses on it can no longer sign in through single sign-on.",[942,943,944],"note",{},"A domain can be used for single sign-on by one club at a time. If another club has already verified your domain, contact SportyPlus support.",[377,946,948],{"id":947},"how-people-sign-in","How people sign in",[330,950,951,952,954,955,958,959,962],{},"On your club's login page, people choose ",[337,953,755],{}," and the label you gave the connection. Anyone can also choose ",[337,956,957],{},"Use single sign-on",", type their work email and choose ",[337,960,961],{},"Continue",". SportyPlus finds the identity provider that has verified that email's domain.",[330,964,965],{},"The first time someone signs in this way:",[410,967,968,974],{},[348,969,970,973],{},[337,971,972],{},"If they already have a SportyPlus account with that email address",", they are signed in to it. Their bookings, memberships and history are all there.",[348,975,976,979],{},[337,977,978],{},"If they don't",", an account is created for them. They are then asked to complete their profile with their date of birth and the other details SportyPlus needs.",[330,981,982],{},"After that, they can still sign in with their password, Google or Apple if they had set those up. Single sign-on is one more way in, not the only one.",[377,984,986],{"id":985},"when-something-goes-wrong","When something goes wrong",[724,988,989,999],{},[727,990,991],{},[730,992,993,996],{},[733,994,995],{},"What the person sees",[733,997,998],{},"What it means",[740,1000,1001,1016,1026,1036],{},[730,1002,1003,1008],{},[745,1004,1005],{},[457,1006,1007],{},"Single sign-on is not set up for that address.",[745,1009,1010,1011,1013,1014,355],{},"No active connection has verified that email's domain. Check the domain is ",[337,1012,918],{}," and the connection is ",[337,1015,922],{},[730,1017,1018,1023],{},[745,1019,1020],{},[457,1021,1022],{},"Your organisation's sign-in cannot be used for that email address.",[745,1024,1025],{},"The identity provider signed them in with an address on a domain that isn't verified on this connection. Add and verify that domain too.",[730,1027,1028,1033],{},[745,1029,1030],{},[457,1031,1032],{},"This account cannot sign in with single sign-on.",[745,1034,1035],{},"The account belongs to SportyPlus staff and can't sign in this way.",[730,1037,1038,1043],{},[745,1039,1040],{},[457,1041,1042],{},"There was an error. Please try again",[745,1044,1045],{},"Usually a wrong client secret, a redirect URI that doesn't exactly match, or a sign-in that took longer than 10 minutes. Check the settings from registering SportyPlus in your identity provider, then try again.",[330,1047,1048,1051],{},[337,1049,1050],{},"Last used"," on the connection shows when anyone last signed in through it. That is a quick way to confirm it works after you change something.",{"title":398,"searchDepth":1053,"depth":1053,"links":1054},2,[1055,1062,1066,1067,1068],{"id":379,"depth":1053,"text":354,"children":1056},[1057,1059,1060,1061],{"id":436,"depth":1058,"text":437},3,{"id":534,"depth":1058,"text":535},{"id":593,"depth":1058,"text":594},{"id":653,"depth":1058,"text":654},{"id":713,"depth":1053,"text":361,"children":1063},[1064,1065],{"id":819,"depth":1058,"text":820},{"id":860,"depth":1058,"text":861},{"id":875,"depth":1053,"text":367},{"id":947,"depth":1053,"text":948},{"id":985,"depth":1053,"text":986},"Connect an OpenID Connect identity provider to SportyPlus so people sign in with their work account, and give club roles from their groups.","md",null,{"icon":182},true,{"title":184,"description":1069},"wKg0MFE2kxHLywU7ZAen5074o8-WJqucwlBYaPvgkuQ",[1077,1079],{"title":179,"path":180,"stem":181,"description":1078,"icon":182,"children":-1},"Give your staff access to the admin, and decide what they can do.",{"title":188,"path":189,"stem":190,"description":1080,"icon":130,"children":-1},"Here we learn how to write one post and publish it to your club's social channels",1792768605095]