SSO Configuration
SAML 2.0 single sign-on for Okta, Azure AD, and Google Workspace.
🏢
Enterprise Feature
SSO is available on the Enterprise plan. Upgrade to connect your identity provider and enable SAML-based authentication for your team.
View Enterprise PlanService Provider Info (paste these into your IdP)
SP Entity ID / Audience URI
Identifies TuneVault to your identity provider.
—
ACS URL / Reply URL
Where the IdP sends the SAML response after authentication.
—
SP Metadata XML
Some IdPs accept metadata import. Download this for quick setup.
SSO Status
Not configured
Identity Provider Configuration
Okta
Azure AD / Entra ID
Google Workspace
Custom SAML 2.0
📋 Okta Setup Steps
- In Okta Admin Console → Applications → Create App Integration
- Choose SAML 2.0 as the sign-in method
- Set Single sign on URL to the ACS URL above
- Set Audience URI (SP Entity ID) to the Entity ID above
- Set Name ID format to
EmailAddress - Under Attribute Statements, add:
email → user.email,displayName → user.displayName - Finish setup, go to Sign On tab → copy the Identity Provider metadata URL or download the certificate
- Paste the SSO URL, IdP Entity ID, and X.509 Certificate below
📋 Azure AD / Entra ID Setup Steps
- Azure Portal → Microsoft Entra ID → Enterprise Applications → New application
- Choose Create your own application → name it "TuneVault" → Integrate any other application (Non-gallery)
- Go to Single sign-on → SAML
- In Basic SAML Configuration: set Identifier (Entity ID) and Reply URL (ACS URL) from above
- Under Attributes & Claims, ensure
user.mail→emailaddressis mapped - Download the Certificate (Base64) from SAML Signing Certificate section
- Copy the Login URL and Azure AD Identifier for the fields below
📋 Google Workspace Setup Steps
- Google Admin Console → Apps → Web and mobile apps → Add app → Add custom SAML app
- Name your app "TuneVault", click Continue
- Download the IdP metadata or copy the SSO URL, Entity ID, and Certificate
- On the next screen: ACS URL = ACS URL above, Entity ID = SP Entity ID above
- Set Name ID format to
EMAIL, Name ID =Basic Information > Primary email - Add attribute mappings:
Primary email → email,First name + Last name → displayName - Assign users/groups, then paste the values below
📋 Custom SAML 2.0 Setup
- In your IdP, create a new SAML 2.0 application/SP
- Set the ACS URL (also called Reply URL or Recipient URL) to the value above
- Set the SP Entity ID (also called Audience URI or Issuer) to the value above
- Configure the response to include the user's email address (in NameID or a custom attribute)
- Export the IdP's X.509 certificate, SSO endpoint URL, and Entity ID
- Paste those values into the form below
The URL where TuneVault redirects users to authenticate.
Identifies your IdP in the SAML exchange. Often a URL but not a redirect.
Paste the full PEM certificate including BEGIN/END headers. Used to verify assertion signatures.
Attribute Mapping
The SAML attribute name that contains the user's email. Use
nameID if email is in the NameID element.SAML attribute containing the user's full name (optional).
Attribute containing IdP group memberships, used for role mapping below (optional).
Group → Role Mapping (optional)
Map IdP group names to TuneVault roles. Enter one mapping per line as GroupName = role.
Valid roles: admin, senior_dba, junior_dba, viewer.
Access Policy
Require SSO for all users
Disables magic link and Google OAuth for team members. Admins always retain magic link access as a break-glass fallback.
User Provisioning
Just-in-time provisioning
First-time SSO login automatically creates a TuneVault account. No manual invite needed for SSO users.
✓ Active
Role assignment
Roles are assigned from IdP group mapping on every login. Overrides manual role assignments for SSO users.
Group-based