With single sign-on, visitors of a sales channel first sign in with your own organization’s account, for example through Microsoft Entra ID, Okta or Google Workspace. Only then do they see the ticket store. That way only your staff or members can order, for a staff party for example.
Their name and e-mail come from your organization: they are filled in at checkout and can’t be changed. How you and your colleagues sign in to EventSquare doesn’t change.
What do you need?
You’re an Owner or Manager of the EventSquare account.
Your IT department, who manage your organization’s identity provider. Any identity provider that supports SAML 2.0 works.
1. Add an identity provider
First ask your IT department to create a SAML application for EventSquare and send you its metadata URL.
Go to Settings › Single sign-on and click New identity provider.
Fill in a Name, for example your organization’s name. Only you see this name.
Under Metadata, paste the Metadata URL. Got a file instead? Choose Paste XML and paste its contents.
Click Add identity provider.
2. Send the details to your IT department
On the identity provider’s page, the EventSquare card shows three values: the Identifier (Entity ID), the Reply URL (ACS) and Our metadata. Your IT department enters them in the application.
Click Send to your IT administrator: you get an e-mail with all the values, ready to send. It also says what the identity provider has to send along: the e-mail address, first name and last name, as separate fields. Your IT department also decides which users or groups get access.
3. Test the sign-in
Click Test sign-in. A new tab opens.
Sign in the way a visitor would, with an account that has access to the application.
Go back to EventSquare. You see what the identity provider sends: name, e-mail and id.
If it works, the identity provider is marked Verified. If data is missing, buyers fill it in themselves at checkout: ask your IT department to send it along. If it fails, you see why, for example an Entity ID or reply URL that doesn’t match. Pass that message on to your IT department.
4. Turn on single sign-on for a sales channel
In your edition, go to Sales channels and open the sales channel.
In Settings, under Access, choose Single sign-on.
Pick the Identity provider and save the sales channel.
In the list of sales channels, the Access column shows which channels use single sign-on. You can use one identity provider for several sales channels. Read more in Create a sales channel.
What do your visitors see?
When they open the sales channel’s link, they first see your organization’s sign-in screen. After signing in, they go back to the ticket store and order as usual. If they’re in a queue, they keep their place.
The certificate and metadata
The identity provider’s page shows when its certificate expires. When your IT department puts in a new certificate, click Load metadata again and test the sign-in again.
You can only delete an identity provider once no sales channel uses it.