One login for everything

With SSO, your staff use the same credentials they already have for your organization (Google, Microsoft, Okta, etc.) to access MyDojang. There is no separate password to remember or reset.

Supported protocols

MyDojang supports two industry-standard protocols: OpenID Connect (OIDC) — used by Google Workspace, Azure AD, Okta, and most modern identity providers — and SAML 2.0 — used by many enterprise and education identity providers.

Just-in-Time (JIT) provisioning

When a user logs in via SSO for the first time, MyDojang automatically creates their account from the identity provider's profile data. No manual invitation is required for SSO-provisioned users.

SCIM automatic provisioning

For larger organizations, SCIM (System for Cross-domain Identity Management) allows your identity provider to automatically create, update, and deactivate user accounts in MyDojang whenever changes happen in your directory — without any manual steps.

Go to Settings > Single Sign-On

From the dashboard, click Settings in the left sidebar, then select the Single Sign-On tab. This tab is visible to studio owners only.

Choose your provider type

Select OIDC (OpenID Connect) if your identity provider supports it — this is the recommended option for Google Workspace, Azure AD, Okta, Auth0, and similar providers. Select SAML 2.0 for enterprise or education identity providers that use SAML.

Enter your provider credentials (OIDC)

For OIDC, you need: the Issuer URL (also called the Discovery URL or Authority), the Client ID, and the Client Secret from your identity provider application. These are found in your IdP's application settings after you create an OAuth/OIDC app pointing to the MyDojang callback URL.

Enter your provider credentials (SAML)

For SAML 2.0, you need: the IdP SSO URL (the login endpoint your IdP provides), and the IdP Certificate (the X.509 public certificate used to sign SAML assertions). Your IdP will also need the MyDojang SP metadata — click 'Download SP Metadata' to get the XML file to upload to your IdP.

Set enforcement mode

Choose Soft enforcement (users can sign in with SSO or with their existing password) or Hard enforcement (SSO is required for all logins — password login is disabled for SSO-domain users). See the Enforcement Modes section below for details.

Add email domains

Enter the email domains that should trigger SSO (e.g., yourstudio.com). When a user types an email matching one of these domains on the login page, MyDojang will detect the SSO configuration and show the SSO login option or redirect them automatically.

Save and test

Click Save Configuration. Then click Test SSO to open a new browser tab and walk through the SSO login flow. Confirm that login succeeds before enabling Hard enforcement.

Open App Registrations

Sign in to portal.azure.com. Navigate to Microsoft Entra ID → App registrations → New registration.

Name and scope the app

Give the app a name such as "MyDojang SSO". Under Supported account types, choose "Accounts in this organizational directory only (Single tenant)" unless multi-tenant access is required. Leave Redirect URI blank for now and click Register.

Add the redirect URIs

Go to Authentication → Add a platform → Web. Add both redirect URIs — replace {your-slug} with your studio code: https://{your-slug}.mydojang.net/api/auth/sso/{your-slug}/callback/oidc https://mydojang.net/api/auth/sso/{your-slug}/callback/oidc Both are needed because users may sign in from your studio subdomain or the main mydojang.net domain. Click Configure, then Save.

Copy the Application (client) ID

On the app Overview page, copy the Application (client) ID. This is your Client ID — paste it into the MyDojang SSO wizard.

Create a client secret

Go to Certificates & secrets → Client secrets → New client secret. Choose an expiry and click Add. Copy the Value immediately — it is only shown once. This is your Client Secret.

Required API permissions

Go to API permissions. The default Microsoft Graph permissions (openid, profile, email, User.Read) are sufficient for SSO login. No additional permissions or admin consent are needed for basic SSO. If you plan to use SCIM, see the SCIM section below for extra permissions.

Add group claims (optional — required for group role mappings)

If you want MyDojang to automatically assign roles (Instructor, Manager, etc.) based on Entra group membership, you must add a groups claim to the ID token. Go to Token configuration → Add groups claim. Select Security groups (or whichever group type your users belong to). Under the ID token column, choose Group ID. Save. Without this step, the groups claim will be empty and group role mappings in MyDojang will have no effect. Users will keep their existing role or be created as Member.

Enter credentials in MyDojang

In MyDojang, go to Settings → Single Sign-On. Select "Microsoft / Entra ID", then enter your Client ID and Client Secret. Complete the wizard for enforcement mode and email domains.

Open the Google Cloud Console

Go to console.cloud.google.com. Select or create a project associated with your Google Workspace organization.

Configure the OAuth consent screen

Navigate to APIs & Services → OAuth consent screen. Choose Internal to restrict login to your Workspace domain only (recommended). Fill in the app name and support email, then click Save and Continue.

Create OAuth 2.0 credentials

Go to APIs & Services → Credentials → Create Credentials → OAuth client ID. Set Application type to "Web application". Add both authorized redirect URIs — replace {your-slug} with your studio code: https://{your-slug}.mydojang.net/api/auth/sso/{your-slug}/callback/oidc https://mydojang.net/api/auth/sso/{your-slug}/callback/oidc Both are needed so SSO works whether users sign in from the subdomain or the main mydojang.net domain. Click Create.

Copy Client ID and Client Secret

The dialog shows your Client ID and Client Secret. Copy both and paste them into the MyDojang SSO wizard under "Google Workspace".

Enable the People API

Go to APIs & Services → Library and enable the "Google People API". This lets MyDojang read the user's name and email at sign-in.

Create an OIDC application in your IdP

In your identity provider's admin console, create a new application. Choose OIDC or OAuth 2.0 as the protocol and Web Application as the type.

Add the redirect URI

Set both authorized redirect URIs (also called callback URLs or sign-in redirect URIs) — replace {your-slug} with your studio code: https://{your-slug}.mydojang.net/api/auth/sso/{your-slug}/callback/oidc https://mydojang.net/api/auth/sso/{your-slug}/callback/oidc Both are required so SSO works from either the studio subdomain or the main mydojang.net domain.

Copy credentials and issuer URL

Copy your application's Client ID, Client Secret, and Issuer URL. The issuer URL is also called the discovery URL or OIDC well-known base URL — for example: https://your-domain.okta.com or https://your-tenant.auth0.com/.

Enter credentials in MyDojang

In the SSO wizard, select "Custom OIDC". Enter the Client ID, Client Secret, and Issuer URL. MyDojang will automatically discover all endpoints via the OIDC discovery document at {issuerUrl}/.well-known/openid-configuration.

Required scopes

Ensure the application grants the openid, profile, and email scopes. These are standard and supported by all major OIDC providers.

Create a SAML application in your IdP

In your identity provider, create a new SAML application or integration. You will need to provide the SP (Service Provider) details from the MyDojang SSO wizard.

Get the SP details from MyDojang

In the SSO wizard (Settings → Single Sign-On → Custom SAML, step 2), the ACS URL and SP metadata URL are displayed. Add both ACS URLs in your IdP — replace {your-slug} with your studio code: ACS URL 1: https://{your-slug}.mydojang.net/api/auth/sso/{your-slug}/callback/saml ACS URL 2: https://mydojang.net/api/auth/sso/{your-slug}/callback/saml SP Metadata: https://{your-slug}.mydojang.net/api/auth/sso/{your-slug}/metadata Both ACS URLs are needed so SAML assertions are accepted regardless of which domain the user signs in from. You can also import the SP metadata XML directly if your IdP supports it.

Configure attribute mappings

In your IdP's SAML app, map user attributes to the following names: email (or use NameID format emailAddress) and name (or givenName + surname). MyDojang reads the NameID as the user subject and looks for email and name claims.

Download the IdP metadata XML

Export the IdP metadata XML from your identity provider. This is usually a "Download metadata" button in the SAML app settings. Copy the full XML content.

Paste metadata XML in MyDojang

In the SSO wizard step 2, paste the full IdP metadata XML into the IdP Metadata XML field. MyDojang extracts the SSO URL, entity ID, and signing certificate automatically.

What group role mappings do

Group role mappings let you automatically assign MyDojang roles (Instructor, Manager, Owner) to users based on their identity provider group membership. When a user logs in via SSO, MyDojang checks which groups they belong to and assigns the highest matching role. Users not in any mapped group keep their existing role.

Configure mappings in MyDojang

In Settings → Single Sign-On, go to the Group Role Mappings step of the wizard. Add one mapping per group: enter the group identifier (name or Object ID depending on your IdP) and select the MyDojang role it maps to. You can add as many mappings as needed.

Enable group claims in your IdP (required)

Your identity provider must be configured to include group membership in the SSO token, otherwise MyDojang has no group information to match against. See the provider-specific setup guide above for how to enable group claims — for Entra ID this is done under Token configuration → Add groups claim.

Finding your group identifier

The group identifier you enter in MyDojang must exactly match what your IdP sends in the token. Entra ID (Azure AD): By default, Entra sends the group Object ID (a GUID like abcd-1234-...). Find it in Entra ID → Groups → click the group → copy the Object ID. Google Workspace: Groups are sent by email address (e.g. [email protected]). Okta / Auth0: Groups are typically sent by name (e.g. Instructors). Check your IdP's OIDC claims to confirm the format.

How it works with SCIM

SCIM and group role mappings work together. SCIM creates the user account (always as Member). On first SSO login, group role mappings are applied and the user's role is updated. After that, the role is only changed if their group membership changes and they log in via SSO again.

Users not in a mapped group keep their role

If a user logs in via SSO and is not a member of any mapped group, their existing role is preserved. They will not be downgraded to Member. This means you can safely configure group mappings for some roles without affecting users who are managed manually.

Soft enforcement (default)

Users with a matching email domain will see a 'Sign in with SSO' button on the login page, but they can still log in with their MyDojang password if they prefer. This is a good starting point when first rolling out SSO.

Hard enforcement

Users with a matching email domain are automatically redirected to your identity provider when they try to log in. Password-based login is disabled for these users. Use Hard enforcement when you want to ensure that all logins go through your IdP for centralized access control and audit logging.

Switching between modes

You can change the enforcement mode at any time from Settings > Single Sign-On. When switching to Hard enforcement, make sure your SSO configuration has been tested and is working correctly first.

Non-SSO users are not affected

Enforcement only applies to users whose email matches one of the configured SSO domains. Staff or members with emails on other domains continue to log in with their MyDojang password as usual.

How domain detection works

When a user starts typing their email on the MyDojang login page, the system automatically checks whether the email domain matches any SSO configuration. This check happens in the background with a short delay after the user stops typing.

Soft enforcement behavior

If the domain matches a Soft enforcement SSO config, a 'Sign in with SSO' button appears below the email field. The user can click it to start the SSO flow, or they can continue entering their password to log in normally.

Hard enforcement behavior

If the domain matches a Hard enforcement SSO config, the user is immediately redirected to the identity provider login page. No password field is shown.

No configuration needed by the user

Domain detection is fully automatic. Users do not need to know their studio's SSO URL or select anything manually — just typing their email is enough to trigger the correct login flow.

What SCIM does

SCIM (System for Cross-domain Identity Management) is an API standard that lets your identity provider push user changes to MyDojang automatically. When you add or remove someone in Okta, Azure AD, or another SCIM-enabled IdP, MyDojang is updated instantly — no manual intervention needed.

Enable SCIM

Go to Settings > Single Sign-On and enable the SCIM toggle. A SCIM Endpoint URL and a Bearer Token will be generated. You will need both of these to configure your identity provider.

Get your SCIM endpoint URL

The SCIM endpoint URL follows this format: https://yourstudio.mydojang.net/api/scim/v2/your-studio-slug. Copy this URL from the SSO settings page and paste it into the SCIM configuration section of your identity provider.

Generate a bearer token

Click 'Generate SCIM Token' to create a bearer token. Copy it immediately — it is shown only once. Paste it into the 'Bearer Token' or 'API Token' field in your identity provider's SCIM configuration. If you need to rotate the token, generate a new one; the old token stops working immediately.

Configure your identity provider

In your IdP (Okta, Azure AD, etc.), go to the application's Provisioning section. Set the SCIM connector base URL to the endpoint URL above, set the authentication type to Bearer Token, paste your token, and enable the desired provisioning features: Create Users, Update User Attributes, and Deactivate Users.

Test provisioning

Use your IdP's built-in SCIM test or 'Provision on demand' feature to test with a specific user. The user should appear in your MyDojang staff list within a few seconds. Removing the user from the IdP application will deactivate their MyDojang account.

SCIM users start as Member

All users created via SCIM are assigned the Member role by default. To assign a higher role (Instructor, Manager, etc.) you have two options: 1. Manually: Go to dashboard → Settings → Staff and change the user's role. 2. Automatically via group role mappings: If you have group role mappings configured and group claims enabled in your IdP, the user's role will be updated automatically the first time they log in via SSO. SCIM handles account creation; SSO handles role assignment.

Account deactivation

When SCIM deactivates a user (via DELETE or setting active=false), their MyDojang account is immediately blocked. The user cannot log in and is redirected to an error page on their next request. Their data is preserved — the account is blocked, not deleted.

SSO button does not appear

Make sure the email domain entered on the login page exactly matches one of the domains configured in Settings > Single Sign-On. Domains are case-insensitive but must be an exact match (e.g., 'acme.com' will not match 'mail.acme.com').

OIDC error: Invalid redirect_uri

Your identity provider application's allowed redirect URIs must include both MyDojang callback URLs: https://{your-slug}.mydojang.net/api/auth/sso/{your-slug}/callback/oidc https://mydojang.net/api/auth/sso/{your-slug}/callback/oidc Check your IdP's application settings and add whichever URL is missing.

SAML error: Invalid signature

The IdP certificate stored in MyDojang may not match the certificate your IdP is currently using to sign assertions. Download the current certificate from your IdP and update it in Settings > Single Sign-On.

SCIM users not appearing

Check that the bearer token in your IdP matches the one generated in MyDojang. Tokens are hashed after generation and cannot be retrieved — if lost, generate a new token and update your IdP configuration.

Group role mappings not applying

If users are not getting the expected role on SSO login, check two things: (1) Group claims must be enabled in your identity provider — without them, the groups field in the token is empty and no mapping can match. For Entra ID, this is under Token configuration → Add groups claim. (2) The group identifier in MyDojang must exactly match what the IdP sends — for Entra ID this is the group Object ID (GUID), not the group name.

Account deactivated error

If a user sees 'Account deactivated' after logging in, their account has been deactivated via SCIM or manually. A studio owner can reactivate the account from the staff management page.