Skip to main content

Configuring SSO with Google Workspace

Updated

Single Sign-On (SSO) with Google Workspace

Single Sign-On (SSO) is available as a paid add-on for TUNE accounts. To inquire about enabling this feature, please contact your Customer Success Manager, Sales Representative, or our support team at support@tune.com.

Follow this step-by-step guide to enable secure access to TUNE using Google Workspace credentials

Setup Overview

This configuration process has 7 main steps and takes approximately 15-20 minutes to complete.  Once completed, your users will log in through Google instead of maintaining a separate TUNE password.

You'll be working in two systems:

  • Google Workspace Admin Console (Steps 1-5)
  • TUNE Platform (Step 6)
  • Testing (Step 7)

What is Single Sign-On (SSO)?

Single Sign-On (SSO) lets your users access TUNE with their existing Google Workspace credentials.

Benefits

  • ✓ Log in to TUNE using Google Workspace credentials
  • ✓ No need to remember separate passwords
  • ✓ Automatically enforces your organization's security policies (like 2-step verification)
  • ✓ Centralized user management through Google Workspace

How it works

Google performs the authentication and confirms the user's identity. TUNE trusts this confirmation and grants access to your platform.

Before You Begin - Prerequisites

Required Before Starting:

Requirement Why It's Needed
Administrator access to Google Workspace You need permissions to create and configure SAML apps
Administrator access to TUNE You need permissions to configure SSO settings in TUNE
All users already exist in TUNE Users must have TUNE accounts before SSO can authenticate them
Matching email addresses Email addresses in Google Workspace must EXACTLY match email addresses in TUNE
Important: SAML authenticates users using email addresses. If the email addresses do not match exactly (including capitalization), the login will fail. Before starting, verify that all your TUNE users have matching email addresses in Google Workspace. This will prevent login issues after configuration.
 

Google Workspace Configuration (Steps 1-5)

Create a Custom SAML App in Google Workspace

What you'll do: Create a new SAML application in Google Workspace that represents TUNE.

Follow these steps:

  1. Sign in to the Google Admin Console at admin.google.com
  2. Navigate to: Apps → Web and mobile apps
  3. Click the Add App button
  4. Select Add custom SAML app from the dropdown menu

    image-20260216-165244.png

  5. Enter the following information:
Field What to Enter
App Name TUNE (or your preferred name)
Description Optional: e.g., "TUNE Affiliate Marketing Platform"
App Icon Optional: Upload a logo if desired
Click Continue to proceed.
image-20260216-165414.png
 
You should now see the "Google Identity Provider details" screen.
 

Copy Google's Identity Provider Details

Copy these three values:

Value to Copy What It Looks Like Where You'll Use It
SSO URL https://accounts.google.com/o/saml2/idp?idpid=... TUNE → SAML SSO Sign-in URL
Entity ID https://accounts.google.com/o/saml2?idpid=... TUNE → SAML IdP Entity ID
Certificate Starts with -----BEGIN CERTIFICATE----- TUNE → SAML IdP Certificate (PEM)
  1. Click DOWNLOAD CERTIFICATE to save the X.509 certificate file, OR copy the certificate text directly
  2. Copy the SSO URL and save it in a text document
  3. Copy the Entity ID and save it in the same text document. 
  4. Click Continue to proceed to the next screen
image-20260216-165605.png

Security Note: The X.509 certificate is a public certificate used to verify that login responses genuinely come from Google. It does NOT expose passwords or sensitive credentials.

Important: Keep these values handy! You'll paste them into TUNE in Step 6.

 

Configure Service Provider Details

Enter the following values:

Field Name Value to Enter
ACS URL https://YOUR-DOMAIN/saml/acs
Entity ID https://YOUR-DOMAIN
Name ID format Select EMAIL from dropdown
Name ID Select Basic Information > Primary Email
  1. Scroll down to Signed Response and check the box to enable it
  2. Check the box to enable Signed Assertion as well

How to Fill in the YOUR-DOMAIN Section

Replace YOUR-DOMAIN With your actual TUNE domain:

Scenario ACS URL Example Entity ID Example
Standard TUNE domain https://acme-network.hasoffers.com/saml/acs https://acme-network.hasoffers.com
Custom domain https://affiliate.acme.com/saml/acs https://affiliate.acme.com
Important: The URLs must begin with https:// (not http://). SAML requires secure, encrypted endpoints.
Click Continue
image-20260216-165756.png

Set Up Attribute Mapping

What you'll do: Configure which user information Google sends to TUNE during login.

Map the email attribute

  1. Under Google Directory attributes, select Primary Email from the first dropdown
  2. Under App attributes, type email in the text field
  3. Click Finish
Google Directory Field App Attribute
Primary Email email
image-20260216-165851.png
Why this matters: This mapping ensures that the user's email address is included in the login response, which TUNE uses to identify and authenticate the user.
 

Enable the SAML App for Users

Enable user access:

  1. Find your newly created TUNE app in the list and click on it
  2. Click on User access in the left sidebar
  3. Click Save

Choose one of these options:

  • Recommended for testing: Select specific organizational units or groups
  • For production: Select ON for everyone
image-20260216-165915.png
Best Practice: Start by enabling SSO for a small test group (like IT administrators) before rolling it out to your entire organization. This allows you to verify everything works correctly.
Google Workspace Configuration Complete! You've finished all the steps in Google. Now it's time to configure TUNE.
 

PART 2: TUNE Platform Configuration

Configuring SSO in TUNE

Access TUNE SSO Settings

  1. Log in to TUNE as an Administrator
  2. Navigate to Company → Customize Application → Single Sign-On

image-20260216-171136.png

Enter the Identity Provider Details

Paste the three values you copied from Google in Step 2:

TUNE Field Name Paste the Value From Google
SAML IdP Entity ID Paste the Entity ID from Step 2
SAML SSO Sign-in URL Paste the SSO URL from Step 2
SAML IdP Certificate (PEM) Paste the Certificate from Step 2
  1. Paste the Entity ID into the SAML IdP Entity ID field
  2. Paste the SSO URL into the SAML SSO Sign-in URL field
  3. Paste the Certificate into the SAML IdP Certificate (PEM) field
  4. Click Save to apply your SSO configuration

Certificate Format Requirements:

The certificate must include the BEGIN and END lines:

-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAXqZ... (certificate data)
-----END CERTIFICATE-----
 
image-20260216-170944.png

PART 3: Testing your Configuration

Perform a test login:

  1. Open a private/incognito browser window: For Chrome: Ctrl+Shift+N (Windows) or Cmd+Shift+N (Mac). For Firefox: Ctrl+Shift+P (Windows) or Cmd+Shift+P (Mac)
  2. Navigate to your TUNE login page (e.g., https://your-domain.hasoffers.com)
  3. Enter your email address in the login field
  4. Click the login button

Expected Behavior

  1. You should be redirected to Google for authentication
  2. You'll see the Google sign-in page
  3. After signing in with your Google credentials, you should be redirected back to TUNE
  4. You should be automatically logged into TUNE without entering a TUNE password

If the test login worked, congratulations! Your SSO configuration is complete. Users can now log in to TUNE using their Google Workspace credentials.

If the test didn't work, see the Troubleshooting section below for solutions to common issues.1
 

Managing SSO for Individual Users (Optional)

By default, once SSO is enabled, all employees will use Google Workspace to log in. However, you can disable SSO for specific users if needed.

When Would You Disable SSO for a User?

Common Use Cases:

  • Testing SSO configuration with specific accounts before organization-wide rollout
  • Providing access to contractors who don't have Google Workspace accounts
  • Troubleshooting login issues for individual users
  • Maintaining emergency administrator access during SSO provider outages

How to Disable SSO for a Specific Employee

  1. In TUNE, navigate to the Employee page
  2. Find and click on the employee you wish to update
  3. Click Edit under the Settings section
  4. Locate the Single Sign-On setting
  5. Change the setting to Disabled
  6. Click Save

What happens next:

  • The user will log in directly with their TUNE email and password
  • The SSO redirect will be skipped for that user only
  • Other users are not affected by this change
  • You can re-enable SSO at any time by changing the setting back to "Enabled"
Important: The user must have a valid TUNE password set if SSO is disabled. Otherwise, they won't be able to log in.
 

Troubleshooting Common Issues

Issue: Login Redirect Loop

Symptom: User keeps being redirected between Google and TUNE without successfully logging in.

Possible Solutions:

  1. Verify the ACS URL is correct and begins with https:// (not http://)
  2. Check that the Entity ID exactly matches your TUNE domain
  3. Ensure cookies are enabled in the browser
  4. Clear browser cache and cookies, then try again in a new incognito window
  5. Verify that "Signed Response" and "Signed Assertion" are both enabled in Google

 

Issue: "User Not Found" Error

Symptom: Error message stating the user doesn't exist in TUNE.

Possible Solutions:

  1. Verify the user account exists in TUNE
  2. Check that the email address in Google Workspace exactly matches the email in TUNE (including capitalization)
  3. Confirm the user account is active (not deleted or suspended) in TUNE
  4. Verify the attribute mapping in Google is set to "Primary Email" → "email"

 

Issue: "Invalid Signature" Error

Symptom: SAML response signature validation fails.

Possible Solutions:

  1. Verify the X.509 certificate was copied completely (including the BEGIN and END lines)
  2. Check for extra spaces or line breaks in the certificate
  3. Ensure the certificate hasn't expired (download a fresh certificate from Google)
  4. Confirm both "Signed Response" and "Signed Assertion" are enabled in Google Workspace
  5. Re-copy and re-paste the certificate to ensure no formatting issues

 

Issue: SSO Not Working for Some Users

Symptom: SSO works for some users but not others.

Possible Solutions:

  1. Check that the affected users are in the enabled organizational unit in Google Workspace
  2. Verify that affected users have the same email in both Google and TUNE
  3. Check if SSO is disabled for specific users in their TUNE employee settings
  4. Ensure affected users exist in TUNE and have active accounts
Still having issues? See the Need Help? section below to contact support with detailed information.
 

Security & Compliance Notes

Security Information

  • All SAML responses from Google are cryptographically signed and verified
  • TUNE never sees or stores your Google passwords
  • Certificates can be rotated at any time for enhanced security
  • SSO does not modify user roles or permissions inside TUNE
  • 2-step verification and other Google security policies are enforced automatically

Security Best Practices - Do Not:

  • Share SSO configuration details publicly or with unauthorized individuals
  • Send certificates over unsecured email
  • Upload screenshots showing real production URLs without masking sensitive data
  • Use the same SAML app for multiple environments (use separate apps for staging/production)

Need Help?

Contact Support

If you need assistance, please contact TUNE Support and provide:

  1. Screenshot of your Google SAML configuration (mask any sensitive URLs)
  2. Exact error message you're seeing (screenshot preferred)
  3. Test email address you used for testing
  4. Your TUNE domain (e.g., acme-network.hasoffers.com)
  5. Steps you've already tried from the troubleshooting section

 

Related articles