Articles in this section

Integration Instructions: Google Apps

  • Updated

Supported Features

Tubular currently supports the following features:

  • Service Provider (SP) Initiated flow

Tubular does not support the following features:

  • Identity Provider (IDP) Initiated Flow
  • SAML JIT (Just In Time) Provisioning

 

Step 1: Set up Google as SAML identity provider (IDP)

  1. Log in to your Google Admin console.
  2. From the Admin console Home page, go to Apps > SAML apps.
  3. Click Add (➕ ) button at the bottom right to add a new SAML app.
  4. Select Setup my own custom app at the bottom of the list and click Next.
  5. Select Option 1 for set up. Copy the SSO URL and put it in a safe place so you can access it later. Download the Certificate. Select Next.
  6. Set “Tubular Labs” as the Application Name.
  7. In Step 4, enter the following values into the appropriate fields:
    1. ACS URL: https://tubularlabs.com/auth/oauth/login?connection=CONNECTION_NAME
    2. Entity ID: urn:auth0:tubularlabs:CONNECTION_NAME
    3. Name ID: Basic Information, Primary Email
    4. Name ID Format: Email
  8. Under Attribute Mapping, add a mapping for Primary Email and set the App attribute to email
  9. (Optional) Add name attributes. Google can use name attributes to pass information to Tubular during user authentication.
    1. For the first name, set the category to Basic Information and the user field to First Name
    2. For the last name, set the category to Basic Information and the user field to Last Name
  10. Click Finish

The CONNECTION_NAME is a unique identifier for your connection. It should only contain alphanumeric characters and hyphens and must be less than 128 characters in length.

We recommend that you include your company name as a part of the connection name to ensure that the name is unique. For example, Acme Corp may name their connection Acme-Login.

If you plan on setting up a TEST or STAGING connection first, give it the same connection name in Tubular as you plan to use for your live connection.

 

Step 2: Enable Tubular SAML App

  1. Log in to your Google Admin console.
  2. From the Admin console Home page, go to Apps > SAML apps.
  3. Select Tubular
  4. At the top of the gray box, click Edit Service
  5. To turn Tubular SSO on or off for everyone in your organization, click On for everyone or Off for everyone, and then click Save.

 

Step 3: Set up Tubular as a SAML 2.0 service provider (SP)

Once you’ve finished configuring Google as your IDP, you can send over your connection details to your Customer Success Manager or our Support team to finalize integration of your Google instance with Tubular. Send us over the following pieces of information that you should have saved from your steps above:

  1. The Connection Name you configured in step 1.
  2. The Identity Provider Single Sign-On URL you copied at the end of step 1.
  3. The X.509 Certificate, the entire contents of the file you downloaded in step 1. This is an X.509 Certificate that’s required for SSO setup.

Our team will then input these fields to make the connection to your Google instance.

After your credentials are authenticated, you and all of your seat holders should now be redirected to sign in using your IDP when signing into Tubular Labs. 

Once SSO is set up for your organization, it will be the only method your users can use to log into the platform. We don’t currently have the option for some users to still use password for logging in after SSO is linked. User passwords will no longer be managed through Tubular. If a user attempts to reset their Tubular password it will have no effect. Please refer your users to your internal help desk for assistance recovering their Google account.

Related articles