Sign-in providers
Which sign-in methods exist and how admin access works.
Auto Tournament can show a sign-in button for each of these providers:
| Provider | Protocol | Guide |
|---|---|---|
| Steam | OpenID | Steam |
| Discord | OAuth2 | Discord |
| GitHub | OAuth2 | GitHub |
| OAuth2 with OpenID Connect scopes | ||
| Twitch | OAuth2 | Twitch |
| Epic Games | OpenID Connect | Epic Games |
| Your own (Keycloak, Authentik, Entra ID, ...) | OpenID Connect | OpenID Connect |
Turn them on in Settings → Sign-in: paste the client ID and secret, and copy the callback URL shown there into the provider's console. The login page shows one button per provider that is turned on and fully set up. You can turn on more than one.
Steam is optional
Any sign-in method can be someone's account. The first time someone signs in with Discord, Google, GitHub, Twitch, Epic Games or OpenID Connect, they get an account of their own when registration is open (Settings → Players & Access). With registration closed, they are asked to sign in with Steam to finish.
People can link more sign-in methods, Steam included, on /me/connections. Games that need Steam, such as CS2, only put players with a linked Steam account on their servers.
Admin sign-in
Local admin accounts (username and password) do not have a button on the login page. Admins sign in at:
https://tournament.example.com/login/adminEnter the username, the password and, when two-factor sign-in is on, the code from your authenticator app. Bookmark the page.
The first local admin is created on a new install: the container log prints a one-time setup code, and you enter it at /setup. See First login.
Locked out? Run this on the host. It prints a new one-time code for /setup:
docker exec auto-tournament reset-adminAdmin access
You get admin rights in one of these ways:
- You are a local admin (see above).
- An existing admin edits your player on the Players page and turns on Is admin.
- Your email address is in Admin emails (Settings → Sign-in → Admin access), and you sign in with a provider that has verified it, such as Google.
- Your Steam64 ID is in Admin Steam IDs in the same place, or your player has Admin on in Players.
Admin rights belong to the account, whatever button you used to sign in. Someone who only uses Google, for example for a chess tournament, can be an admin without ever touching Steam.
Games that need an account
A game can need a certain account, because that is how its matches know who is who. The game's module or game pack says which one:
| Game | Account | Why |
|---|---|---|
| Counter-Strike 2, Dota 2, Deadlock, Team Fortress 2 | Steam | CS2 servers let players in by Steam ID. |
| Rocket League, Fortnite | Epic Games | The in-game account people know each other by. |
| Most others (chess, fighting games, …) | None | Any sign-in method works. |
Turn on the sign-in method your games need in Settings → Sign-in. Players see the games under Game accounts on their connections page, with a Connect button for an account they have not linked yet. When that sign-in method is not turned on, the page tells them to ask an admin.
Callback address
Each provider sends you back to Auto Tournament after sign-in. The address is FRONTEND_BASE_URL followed by the provider's callback path, for example:
https://tournament.example.com/api/auth/github/callbackIf the API has another public address than the web app, set BACKEND_BASE_URL. The callback then uses that address instead of FRONTEND_BASE_URL.
The address you register at the provider must match exactly: same scheme (http or https), same host, same port, no slash at the end.
Check which providers are on
This shows the providers the login page will show:
curl -fsS http://localhost:3069/api/auth/providersA provider with "enabled": true has a button. A provider that is missing is not turned on, or is missing its client ID or secret.
All sign-in variables are listed in Configuration.