SSO

Single sign-on (SSO) lets people in your organization sign in to Venue.sh with your existing identity provider instead of a separate Venue.sh password. Admins configure SSO from Settings, without needing the Venue.sh team to set it up for them.

Venue.sh supports SAML identity providers such as Okta and Keycloak. Each organization can have one SSO provider, mapped to a single email domain.

note

SSO configuration is rolled out per organization. If the SSO page does not appear in Settings, the feature is not yet enabled for your organization, or your role does not include organization update permission. Contact the Venue.sh team to have it enabled.

How Sign-In Works with SSO

When SSO is configured, Venue.sh routes users to your identity provider based on their email domain. Someone signing in with an address on your configured domain is sent to your identity provider to authenticate, then returned to Venue.sh.

Because accounts come from your identity provider, the Invited Users tab and the Invite user action are hidden for organizations with an SSO domain. Provision and deprovision people in your identity provider instead.

Adding a SAML Provider

Prerequisites

• Admin access to your Venue.sh organization (Admin role)
• Admin access to your SAML identity provider
• The email domain your organization uses to sign in

1. Open Settings from the cog in the upper-right corner, then click SSO.

2. Click Add SAML Provider.

3. Complete the form:

   Field	What to enter
   Provider ID	A unique identifier used in the ACS and metadata URLs, for example venue-saml. This cannot be changed later.
   Email Domain	The email domain that routes users to SSO at sign-in, for example yourcompany.com.
   Issuer / IdP Entity ID	The IdP entity ID from your SAML metadata. Okta and Keycloak often label this Issuer.
   SAML Entry Point	The SAML SSO URL from your IdP metadata.
   IdP Certificate	The certificate body from your IdP metadata. Paste only the token; Venue.sh adds the BEGIN and END lines for you.

4. Click Create Provider.

Configuring Your Identity Provider

After creating the provider, Venue.sh generates the values your identity provider needs.

1. On the SSO page, open the actions for your provider and select View Setup Values.

2. Copy the values into your identity provider:

   • ACS URL / Sign-on URL - Where your identity provider sends the SAML response.
   • SP Entity ID / SP Metadata URL - Identifies Venue.sh as the service provider.
   • Metadata XML - Copy the XML, or download it as a file, if your identity provider prefers a metadata upload.

3. Save the configuration in your identity provider, then test signing in with an account on the configured domain.

Managing a Provider

From the SSO page you can:

• View Setup Values - Reopen the ACS URL, SP metadata URL, and metadata XML at any time.
• Edit Configuration - Update the domain, issuer, entry point, or certificate. The Provider ID cannot be changed.
• Delete Provider - Remove the SSO configuration. Users then sign in with their Venue.sh credentials again.

note

Providers that use OIDC can be viewed but not edited through this form. Contact the Venue.sh team if you need to change an OIDC provider.

Troubleshooting

Situation	What to do
The SSO page is missing from Settings	The feature may not be enabled for your organization, or your role may not include organization update permission. Contact your Venue administrator.
Add SAML Provider is unavailable	Each organization can have only one SSO provider. Edit or delete the existing provider first.
Users are not routed to the identity provider	Confirm the Email Domain matches the domain on their email addresses.
Sign-in fails at the identity provider	Re-check the ACS URL and SP Entity ID in your identity provider against View Setup Values.
The certificate is rejected	Paste only the certificate body, without the BEGIN and END CERTIFICATE lines.
You cannot invite new users	Invitations are disabled for organizations with an SSO domain. Provision users in your identity provider instead.

See Also

• Settings - Account and organization configuration.
• Users and Teams - Manage who can access your organization.
• RBAC - Roles and permissions across Venue.sh.