The Adaptavist Group LogoDocumentation

SSO

Single sign-on (SSO) lets people in your organization sign in to Venue.sh with your existing identity provider instead of a separate Venue.sh password. Admins configure SSO from settings, without needing the Venue.sh team to set it up for them.

Venue.sh supports SAML identity providers such as Okta and Keycloak. Each organization can have one SSO provider, mapped to a single email domain.

Note: SSO configuration is rolled out per organization. If the SSO page does not appear in Settings, the feature is not yet enabled for your organization, or your role does not include organization update permission. Contact the Venue.sh team to have it enabled.

How Sign-In Works with SSO

When SSO is configured, Venue.sh routes users to your identity provider based on their email domain. Someone signing in with an address on your configured domain is sent to your identity provider to authenticate, then returned to Venue.sh.

Because accounts come from your identity provider, the Invited Users tab and the Invite user action are hidden for organizations with an SSO domain. Provision and deprovision people in your identity provider instead.

Adding a SAML Provider

Note: Prerequisites
  • Admin access to your Venue.sh organization (Admin role)
  • Admin access to your SAML identity provider
  • The email domain your organization uses to sign in
  1. Open Settings from the cog in the upper-right corner, then click SSO.
  2. Click Add SAML Provider.
  3. Complete the form:
    FieldWhat to enter
    Provider IDA unique identifier used in the ACS and metadata URLs, for example venue-saml. This cannot be changed later.
    Email DomainThe email domain that routes users to SSO at sign-in, for example yourcompany.com.
    Issuer / IdP Entity IDThe IdP entity ID from your SAML metadata. Okta and Keycloak often label this Issuer.
    SAML Entry PointThe SAML SSO URL from your IdP metadata.
    IdP CertificateThe certificate body from your IdP metadata. Paste only the token; Venue.sh adds the BEGIN and END lines for you.

Configuring Your Identity Provider

After creating the provider, Venue.sh generates the values your identity provider needs.

  1. On the SSO page, open the actions for your provider and select View Setup Values.
  2. Copy the values into your identity provider:
    • ACS URL / Sign-on URL - Where your identity provider sends the SAML response.
    • SP Entity ID / SP Metadata URL - Identifies Venue.sh as the service provider.
    • Metadata XML - Copy the XML, or download it as a file, if your identity provider prefers a metadata upload.
  3. Save the configuration in your identity provider, then test signing in with an account on the configured domain.

Managing a Provider

From the SSO page, you can do the following:

  • View Setup Values - Reopen the ACS URL, SP metadata URL, and metadata XML at any time.
  • Edit Configuration - Update the domain, issuer, entry point, or certificate. The Provider ID cannot be changed.
  • Delete Provider - Remove the SSO configuration. Users then sign in with their Venue.sh credentials again.
Note: Providers that use OIDC can be viewed but not edited through this form. Contact the Venue.sh team if you need to change an OIDC provider.

Troubleshooting

SituationWhat to do
The SSO page is missing from SettingsThe feature may not be enabled for your organization, or your role may not include organization update permission. Contact your Venue administrator.
Add SAML Provider is unavailableEach organization can have only one SSO provider. Edit or delete the existing provider first.
Users are not routed to the identity providerConfirm the Email Domain matches the domain on their email addresses.
Sign-in fails at the identity providerRe-check the ACS URL and SP Entity ID in your identity provider against View Setup Values.
The certificate is rejectedPaste only the certificate body, without the BEGIN and END CERTIFICATE lines.
You cannot invite new usersInvitations are disabled for organizations with an SSO domain. Provision users in your identity provider instead.

See Also

  • Settings - Account and organization configuration.
  • Users and Teams - Manage who can access your organization.
  • RBAC - Roles and permissions across Venue.sh.

Search documentation

Start typing to search the docs.