--- title: "Single Sign-On for Sports Clubs: Entra ID, Google Workspace, Okta and Keycloak | SportyPlus" description: "How single sign-on for sports clubs works, when it is worth it, and how to set it up so staff and members sign in with the accounts your organisation already runs, with club roles taken from their groups." lang: "es" canonical: "https://www.sporty.plus/es/blog/single-sign-on-for-sports-clubs" --- 1. [Inicio](https://www.sporty.plus/es) 3. [Blog](https://www.sporty.plus/es/blog) 5. Single Sign-On for Sports Clubs: Let Staff Sign In With Your Organisation's Accounts ![Single Sign-On for Sports Clubs: Let Staff Sign In With Your Organisation's Accounts](https://www.sporty.plus/_og/r/blog/single-sign-on-for-sports-clubs.png) # Single Sign-On for Sports Clubs: Let Staff Sign In With Your Organisation's Accounts How single sign-on for sports clubs works, when it is worth it, and how to set it up so staff and members sign in with the accounts your organisation already runs, with club roles taken from their groups. Single sign-on for sports clubs means your staff, and your members if you want, sign in to the club software with the account your organisation already gives them. That might be Microsoft 365, Google Workspace, Okta or Keycloak. There is no separate password to create, forget or share. When someone leaves and IT disables their work account, their access to the club system ends with it. It is not for every club. A volunteer-run tennis club with one admin and a shared Gmail address has nothing to connect. A university sports centre, a company sports club, a municipal facility or a multi-site operator usually does. These organisations already keep everyone in a directory, and keeping a second list of who can do what in the club system is the part that goes wrong. ## The problem: a second list of people nobody keeps up to date Every club system has its own idea of who works there. Someone is made an administrator when they start. Someone else gets till access for the summer camp. A coach is given rights to the schedule. Each of those is a separate account with a separate password, granted by whoever was around that day. The trouble comes later: - **People leave and keep their access.** The front-desk student who worked last season can still sign in to the admin, because removing them was never on anyone's checklist. - **Passwords get shared.** The reception PC is logged in as "info@club" and three people use it, so the audit trail says the same person did everything. - **Access doesn't match the job.** Someone moved from the till to coaching, and nobody took the cashier role away. - **The IT department can't see it.** If the club belongs to a university or a company, its security team has rules for where staff sign in: multi-factor authentication, password policy, sign-in alerts. The club software is the one system outside those rules. ## How clubs usually handle it Most clubs handle it by hand. The manager keeps a list of staff, and whoever processes leavers is supposed to remember the club software along with everything else. Some clubs set a calendar reminder to review admin accounts each season. Some just share one admin login and change the password when someone leaves, which works until the day nobody remembers to. None of this is negligence. The club system simply has no connection to the place where the organisation actually records who works there. ## The recommended approach: let your identity provider decide The fix is to stop keeping that second list. Your organisation already has an **identity provider**, the system behind your work email sign-in. Connect the club software to it, and three things change: 1. **Sign-in happens at your identity provider.** People choose _Sign in with Microsoft_ (or whatever you name it), sign in where they always do, and are sent back signed in. Your multi-factor rules, password policy and sign-in alerts apply. 2. **Leaving is handled once.** Disable the person's work account and they can no longer sign in to the club system either. 3. **Roles come from groups.** Put the front-desk staff in a _Front desk_ group and the managers in _Club admins_, and the club software gives them the matching role at each sign-in. Move someone between groups and their club role follows. The standard that makes this work across providers is **OpenID Connect** (OIDC). Microsoft Entra ID (formerly Azure AD), Google Workspace, Okta, Keycloak and Authentik all support it, so one setup covers almost every organisation. ### Why domain verification matters There is one rule you should insist on from any club software that offers single sign-on: it should only believe your identity provider about **email addresses on domains you have proved you own**. That matters more than it sounds. Your identity provider can claim that anyone is anyone. If the club software accepted any claim, whoever configured the connection could sign in as any account in the system, including people at other clubs. So before single sign-on goes live, the software should ask you to publish a DNS record on your domain. That proves you control `yourclub.com`, and only `@yourclub.com` addresses are then accepted through your connection. ## Example: a university sports centre _This is a hypothetical example._ A university sports centre has 8 courts, a gym and a front desk. It employs 4 permanent staff and about 15 student workers each semester, and everyone has a university Microsoft 365 account. Before single sign-on, each student worker got a club-software login at the start of the semester. In practice about a third of them were never removed, because the semester ended in a rush. By the second year the admin had 30 accounts and the manager could not say which were still in use. With single sign-on: - IT creates two Entra ID groups, _Sports Centre – Front desk_ and _Sports Centre – Managers_. - The club software maps _Front desk_ to the Cashier role and _Managers_ to Administrator. - A new student worker is added to the front-desk group by HR's usual onboarding. On their first shift they choose _Sign in with University account_ and are at the till, with no account to create. - When the semester ends and their contract stops, their university account is disabled and their access goes with it. If they stay at the university but leave the job, removing them from the group takes the Cashier role away at their next sign-in. - Members who are students or staff sign in the same way and book courts with the account they already use for everything else. ## How SportyPlus can help SportyPlus supports single sign-on with any OpenID Connect identity provider, set up by the club itself under **Settings → Single sign-on**. You enter the identity provider's details and verify your email domain with a TXT record. A **Sign in with …** button then appears on your club's login page. Anyone can also type their work email under **Use single sign-on**, and SportyPlus finds the right provider. Group memberships can give the Administrator, Cashier or Employee role at your club. SportyPlus only ever takes away roles it gave through single sign-on: a role you granted by hand is left alone, and the club owner always stays an administrator. Members who turned on two-factor sign-in in SportyPlus aren't asked for it again when your identity provider reports that it already did multi-factor authentication. Someone who already had a SportyPlus account with their work email keeps it, with their bookings and history, and a new account is created only for people who had none. The full setup, with steps for Entra ID, Google Workspace, Okta and Keycloak, is in the [single sign-on setup guide](https://docs.sporty.plus/en/interface/settings/single-sign-on). ## Practical recommendations - **Start with staff.** Connect the identity provider and map the admin and front-desk groups first. Members can use the same button whenever they like, but staff access is where the risk is. - **Create groups for club roles, not for people.** _Club admins_ and _Front desk_ will still make sense in three years; a group named after this season's manager won't. - **Verify every domain your people use.** If students are on `students.yourclub.edu` and staff on `yourclub.edu`, add both. - **Keep the DNS record in place.** It is your standing proof of the domain. If someone tidies up DNS and deletes it, single sign-on stops for that domain. - **Turn on multi-factor authentication at the identity provider,** not separately in each system. Then one strong sign-in covers everything. - **Know what single sign-on doesn't do yet.** Roles update when people sign in. Someone removed from a group keeps their club role until their next sign-in, so for an urgent removal also take the role away in the club software. ## Related questions ### Do members have to use single sign-on? No. Single sign-on is an extra way in. Members and staff who already sign in with a password, Google or Apple can keep doing so. ### What if someone already has an account with their work email? They are signed in to that account. Their bookings, memberships and history stay where they are. A new account is created only for people who had none. ### Does Google Workspace support roles from groups? Not through sign-in. Google doesn't include group memberships when someone signs in, so with Google Workspace you give club roles by hand. Entra ID, Okta and Keycloak can all send groups. ### Can two clubs use the same email domain? Not for single sign-on. A domain can be verified by one club at a time, which is part of what stops one club's identity provider from signing in another club's people. ### Is this the same as Sign in with Google? No. _Sign in with Google_ lets anyone with any Google account sign in. Single sign-on connects your organisation's own directory. Only your people can use it, you control who they are, and their roles at the club follow your groups. ## Related SportyPlus guides - [How to manage junior members and their parents](https://www.sporty.plus/blog/manage-junior-members-and-parents): accounts, consent and family payers. - [AI assistant for sports clubs](https://www.sporty.plus/blog/ai-assistant-for-sports-clubs): what an assistant in your club software should and shouldn't be trusted with. - [How to run a sports club email newsletter](https://www.sporty.plus/blog/sports-club-email-newsletter): consent and opt-ins for club news. Keep your club's access in one place. [Manage staff, roles and members with SportyPlus](https://www.sporty.plus/modules/user). ## Guías de SportyPlus relacionadas - [How to Manage Junior Members and Their Parents at a Sports Club](https://www.sporty.plus/es/blog/manage-junior-members-and-parents) Most clubs have juniors on the books under a parent's email, a shared login, or no account at all. Here is a structure that works for the parent, the child and the club's records. - [AI Assistant for Sports Clubs: What It Should Do, and What It Must Never Do](https://www.sporty.plus/es/blog/ai-assistant-for-sports-clubs) A chatbot that guesses is worse than none. Here is what to expect from an AI assistant in your club software, and five questions that show whether you can trust it. - [How to Run a Sports Club Email Newsletter: Club News, Offers and Opt-Ins](https://www.sporty.plus/es/blog/sports-club-email-newsletter) Most clubs send one undifferentiated "club email". That is why members unsubscribe from everything after one sale. Split news from promotions and both get read.