Single sign-on

Sign in through your organisation's identity provider, how access is granted and revoked, and the sign-in fallback.

SCAD Maps can hand sign-in over to your organisation's identity provider. People use the account they already have, access is granted and withdrawn in one place, and nobody has to remember a separate password for the event. This is a per-instance option that your organiser switches on; if your instance does not use it, people sign in with the local username and password described in Quick start.

What people see#

On an instance with single sign-on there is still only one login form. Enter the username or email and password of your organisation account, exactly as you would elsewhere.

• Coming from the organiser's portal. If you open the event from a portal where you are already signed in, SCAD Maps signs you in silently. You land on the map without seeing a login form.
• Returning to the app. A device that has signed in through single sign-on once tries a silent sign-in the next time the app is opened while signed out, so a bookmark or the installed app icon takes you straight in. Signing out on purpose switches this off for the rest of that browser tab.
• Not signed in at the provider. You get the normal login form with a short hint to sign in with your organisation login. Enter your credentials there; you stay on the same page and never see the provider's own screen.
• Extra verification. If the provider asks for a second factor, SCAD Maps sends you to the provider's page to complete it and brings you back signed in.

How access is decided#

The identity provider proves who you are. It also tells SCAD Maps which groups you belong to, and the groups decide what you may do on this instance. The check runs at every sign-in.

If someone belongs to more than one group, the highest level wins. The levels are the ones described in Permissions. A person with no group for this event sees the message that their account does not have access and should ask an administrator. Nothing is created for them.

First sign-in and existing accounts#

The first time a person signs in through the provider, SCAD Maps creates their account automatically, with a username taken from the provider profile. There is no request or approval step, because being in the event group is the approval.

If an account with the same email address already exists, SCAD Maps links to it instead of creating a duplicate. The person keeps their notes, areas, tasks, chat history and settings, and their local password is removed so that the provider is the only way in. Linking only happens when the provider states that the email address is verified, and never to an account that is already linked to a different identity.

Sessions and withdrawing access#

• Shorter sessions. A signed-in session normally stays valid for seven days. For single sign-on accounts it is capped at 24 hours. The groups are only re-checked at sign-in, so the cap limits how long a person who has been removed can carry on.
• Immediate revocation. When the organiser's portal removes someone from the event group, it can tell the instance straight away. Their sessions are ended and any open connection is closed within seconds, instead of waiting for the 24 hours to run out. This needs a shared secret to be set up between the portal and the instance; without it the 24-hour cap is the fallback.
• Nothing else changes. After sign-in the person has an ordinary SCAD Maps session, the same as a password login. Custom roles, restrictions and guest links work as usual.

Single sign-on only#

An instance can be set to use the identity provider as its only front door. Visitors who are not signed in are sent straight to the provider, and the passwords of accounts that sign in this way are removed. One local administrator account is deliberately kept out of this, so that an outage at the provider cannot lock everybody out of the instance. Guest links and QR access keep their own flow, since they do not use accounts.

What the identity provider needs#

For operators. SCAD Maps talks to any provider that supports standard OpenID Connect with the authorisation-code flow and PKCE. It is registered as a public client, so no client secret is stored in the instance.

The requested scopes are openid, profile, email and groups. The email address and the group list are read from the provider's user-info endpoint when it is available, because some providers leave the groups out of the ID token. The full list of options is in Instance configuration.

If sign-in fails#

• "Your account does not have access to this event." The person is not in a group for this instance. Add them at the identity provider and ask them to try again.
• "Sign-in service unavailable." The instance cannot reach the provider. Other sign-in methods such as guest links keep working. See Troubleshooting.
• "Too many sign-in attempts." Attempts are limited per person and per network address before they are passed on to the provider. Wait a few minutes.