Skip to content
Fairway

Single sign-on

Running the courseChampionship tier, owner only7 minute readIn the app: /app/developers

Letting staff sign in with your organisation's existing account — Entra, Google Workspace or Okta.

Common for municipal courses inside a city, and for management companies. Staff sign in with the account they already have, and you keep control of access in one place.

What you'll need from your IT people

  • The issuer URL for your identity provider.
  • A client ID and client secret for a new application they create for Fairway.
  • Permission to whitelist our sign-in return address, which is shown on the setup screen.

Setting it up

  1. 1Have IT create an OpenID Connect application for Fairway and give you the three values above.
  2. 2Open API & feeds and fill in the single sign-on section.
  3. 3Restrict it to your email domain, so only addresses at your organisation can get in.
  4. 4Choose the role somebody gets on their first sign-in. Crew is the safe default — you can promote people afterwards.
  5. 5Decide whether a new person is created automatically on first sign-in, or must have been invited first.
  6. 6Save, then test it in a private browser window before you tell anybody about it.

How people sign in

They go to your course's sign-in address — shown on the setup screen once it's configured — and they're bounced to your provider and back. Nothing is decided until we've verified what came back.

We never see a password

The sign-in happens entirely at your provider. We check that the token they hand back is genuinely signed by your provider, is for us, hasn't expired and matches the request we started. A token that isn't properly signed is refused, always.

Turning it off

Remove the connection and passwords keep working. Nobody is locked out by switching it off — that's deliberate.

Questions

Can I require SSO and disable passwords?

Not currently. Passwords remain as a way in, which is what stops a provider outage locking your course out of its own job board.

Does it work for members?

No, it's for staff. Members use their own portal login.

The sign-in address says the provider isn't configured.

Either the connection is switched off, or your plan doesn't include single sign-on. Both say so rather than failing vaguely.

Didn't answer it?

Tell us what's missing and we'll write it. Help that doesn't cover the thing you came for isn't help.

Talk to a humanAll help articles