Registration & Sign-in

Two settings pages control the front door of a network: Registration decides who is allowed to become a forecaster, and Single sign-on configures the network's own SSO connection. The two interact: some registration models depend on whether SSO is configured.

Who Can Join

Under Settings → Registration, pick one of three access models:

  • Invite / allow-list only - the default. Only people you have invited or added to the allow list can join. Nobody else can register, whatever email address they have.
  • Restricted - people can join if you invited or allow-listed them, or their email matches one of your allowed domains, or (optionally) they can authenticate through your SSO provider.
  • Open - anyone who can sign in with an enabled method becomes a forecaster. With password sign-in enabled, that means anyone on the public internet can create an account on the network's domain; requiring single sign-on narrows it to people your identity provider will authenticate.

Allowed Email Domains

On a restricted network, list the domains whose members may register - one per line or comma-separated. Anyone with a verified email address at one of those domains can join without an individual invitation.

Sign-in Methods

The network's login screen offers whichever methods you enable. At least one must stay on.

  • Email & password - forecasters set a password, and their email is verified before access is granted.
  • Single sign-on (SAML / OIDC) - available once you have configured a connection. This is the network's own connection, entirely separate from the SSO on your analyst surface.

Turning on Require single sign-on makes SSO the only way in: the password method is switched off and the login screen offers nothing else.

Single Sign-on for a Network

A network can have its own SAML or OIDC connection, configured under Settings → Single sign-on. This is deliberately independent of the SAML SSO on your analyst account - the audiences are usually different organizations, so they need different identity providers.

Set up one connection of either type:

  • SAML - for identity providers like Okta, Entra ID, or ADFS.
  • OIDC - for OpenID Connect providers. The page shows the issuer and redirect URI you will need to register on the provider side.

SSO Email Domains

Listing domains here sends anyone whose email matches straight to single sign-on when they register or sign in, rather than showing them a password form. For example, entering example.com routes [email protected] through SSO. Leave it empty to route each person by the method saved against their account.

Allow Anyone Who Can Sign In With SSO

On a restricted network, this switch treats successful authentication with your identity provider as sufficient grounds to join - no invitation or matching domain required. Turn it off to hold even SSO users to the allow list and allowed domains.

Onboarding Practice Question

Also on the Registration page: new forecasters practise on a yes/no question during onboarding. Nothing they enter is recorded - it exists to give them the feel of putting a number on something. Set your own question here, or leave it blank to use the bundled default.

Example Configurations

Three ways these settings combine, and what each produces:

  • An internal network - restricted access, SSO required, "allow anyone who can sign in with SSO" on. Your identity provider is the gate; nobody manages a roster by hand.
  • A curated external panel - invite-only with email and password. You control exactly who is in, and each person is invited individually.
  • A partner network - restricted access with your partners' domains on the allowed list, plus invitations for the handful of people who fall outside them.