Single Sign-On for Organizations

An organization can sign its people in to FitnessSyncer through its own identity provider, such as Microsoft Entra ID, Okta or Google Workspace. Anyone with an e-mail address on the organization’s domains then signs in with their work account on FitnessSyncer.com, in our apps and in the FitnessSyncer Uploader, without a FitnessSyncer password.

• Where you set it up
• Setting it up
  • Which identity providers work?
  • What happens when I change my provider’s settings?
• Your domains
  • Can two organizations use the same domain?
• Who must use company sign-in
  • What about a FitnessSyncer account someone made with a work address?
  • Can an owner still sign in if our provider stops working?
  • What happens when our SAML certificate expires?
• Signing out
• What your people see
  • Can we link to our own sign-in page?
• Signing in shares nothing
• Removing someone
  • Does removing someone from our directory remove them from FitnessSyncer?
• Turning it off

Where you set it up

Single sign-on is set up on the Organization sign-on tab of your organization’s settings, on FitnessSyncer.com only, and only an owner sees that tab. Our apps have no settings for it, and nothing needs to be set up in them: people sign in through your company in our apps as soon as it is on. Read Running Your Organization on FitnessSyncer to open your settings.

Setting it up

Until company sign-in is on, the Organization sign-on tab takes you through four steps in order, and says which are done. Each step can be opened and saved again at any time.

1. Your domains: add each of your domains and verify it, as described below.
2. Your identity provider: choose OpenID Connect or SAML 2.0 first. The step then lists what to register at your identity provider for that protocol: the redirect URI for OpenID Connect, or the entity ID and the assertion consumer service URL for SAML 2.0. With OpenID Connect, allow the openid, email and profile scopes, and make sure the ID token carries the person’s e-mail address. Enter your provider: for OpenID Connect, the issuer URL and the client ID and client secret your provider gave you; for SAML 2.0, your provider’s metadata document or its address. Then select Save the provider. Once your provider is saved, the step also lists the address of FitnessSyncer’s SAML metadata, which your provider can read to register us and which carries the certificate our SAML requests are signed with.
3. Test sign-in: select Run a test sign-in and sign in at your provider yourself. You come back to the tab with the claims your provider sent, such as your name and your e-mail address. A test links nothing to your account.
4. Turn company sign-in on: choose who must use company sign-in, then select Turn company sign-in on.

Once company sign-in is on, the tab shows its provider, its domains and any certificate warning at the top, and its settings below: who must use company sign-in, signing out, your domains, your provider, the test sign-in and turning it off.

Your domains

Company sign-in applies only to e-mail addresses on the domains you verify. Add a domain under Your domains and the tab shows a TXT record for it. Add that record to the domain at your DNS provider, then verify the domain on the tab. A change to DNS can take a while to appear, so if the record is not found at first, try again later.

Keep the record in place for as long as you use single sign-on. If it is removed, addresses on that domain stop going to your provider.

Removing a domain on the tab stops sending the people whose addresses are on it to your provider. Anyone who has only ever signed in through your company then needs the reset password page to sign in. If you add the domain again, it gets a new TXT record to add and verify. The tab says this before you remove a domain, and you can undo the removal right after you select it.

Who must use company sign-in

• Company sign-in only, the default: people with an address on your domains sign in only through your provider. They can no longer sign in to FitnessSyncer with a password, a passkey, Google or Apple, and signing up with Google or Apple using such an address creates no account. Each of them is told to sign in through your company instead.
• Company sign-in or their own: people with an address on your domains go to your provider when they type their address, and may still sign in with a password, a passkey, or Google or Apple.

Signing out

Signing out of FitnessSyncer does not sign anyone out of your identity provider, and signing out of your provider does not sign anyone out of FitnessSyncer, unless you link the two. This is off until you turn it on, which you can do once company sign-in is on. To turn it on, select Sign people out of your provider and FitnessSyncer together under Signing out, then select Save the sign-out setting. From then on:

• Signing out of FitnessSyncer.com also signs the person out of your provider.
• When your provider signs someone out, FitnessSyncer signs them out everywhere, on the web and in our apps.

This works when your provider supports single logout. Once your provider is saved, the Organization sign-on tab lists what to register for it: the single logout service URL for SAML 2.0, or the post-logout redirect URI and the back-channel logout URI for OpenID Connect.

What your people see

Nothing changes for anyone whose address is not on your domains. Someone whose address is on them types it on the sign-in page, on FitnessSyncer.com or in our apps, and goes to your company’s sign-in. On the sign-in page of FitnessSyncer.com, they select Continue with company sign-in first. Once they sign in there, they come back to FitnessSyncer signed in. The FitnessSyncer Uploader signs in through FitnessSyncer.com, so it works the same way.

On FitnessSyncer.com, the sign-in and sign-up pages show your organization’s name as they send someone to your company’s sign-in, with your logo when you have added one on the Organization profile tab.

Signing in shares nothing

Signing in through your company gives your organization nothing of a person’s data. Joining a Leaderboard or a coaching program, connecting devices and choosing what to share stay each person’s own steps, each with its own permission.

Signing in through your company sets nothing up in anyone’s account either. When your organization offers connections, a new account made through your company’s sign-in is only offered them, and the person chooses whether to set up each one. Someone who signs in to an account they already have is not offered them, and nothing in their account changes. Your people can read what their company can see.

Removing someone

Removing someone’s access on People in your organization, or removing them on Members and roles, signs them out everywhere, on the web and in our apps, takes them off your organization’s Leaderboards and programs, and stops them signing in through your company. Their FitnessSyncer account and their data stay theirs: they can set a password on the reset password page and keep using their account. FitnessSyncer never tells them that you removed them. Their work address still goes to your company’s sign-in, as everyone else’s does. When they sign in there, FitnessSyncer does not let them in. It asks them to contact their organization administrator, and offers them their own password or a password reset instead.

To let someone sign in through your company again, filter the Status in the organization column of People in your organization to Access removed, where an owner or an administrator lets each of them back in from their row. Inviting them to your organization again lets them back in as well.

Turning it off

Turn company sign-in off stops sending anyone to your provider. The tab says this before you turn it off, and you can undo it right after you select it. Everyone who signed in through your company keeps their account, and can set a password on the reset password page to keep signing in.