Single sign-on¶

Single sign-on allows people log in to Klipspringer through the identity provider they already use. Klipspringer supports Security Assertion Markup Language (SAML) 2.0, Lightweight Directory Access Protocol (LDAP), and OpenID Connect.

You'll need the "Manage single sign-on and verified domains" permission.

Connecting a provider¶

1. Choose the provider type and enter a name. This is the name people will see on the login button
2. Copy the details Klipspringer shows into your identity provider's settings.
3. Test the connection. The test logs you in and shows the details your provider sends.

A provider can't be used until a test succeeds. If you change a connection setting, Klipspringer turns the provider off until you test it again.

You can connect unlimited providers.

Verified domains¶

Klipspringer allows you to let organizers sign in with their identity provider only when you have verified the domain of their email address. To verify a domain, add the TXT record that Klipspringer gives you in your domain's DNS settings. Please note that a domain can only belong to one organization at a time.

Attendees logins do not require domain verification.

Access rules¶

An access rule limits a product to people who match the rule. For example, a university can choose to sell student tickets only to people whose email address ends with "@university.edu".

Klipspringer checks the rule when an attendee adds the item to the cart and again at checkout.

Restrictions¶

Klipspringer doesn't let you disable or remove your last provider while single sign-on is required.