Single Sign-On (SSO) lets users sign in to Pandora CloudCover using their organization's existing corporate credentials instead of maintaining a separate CloudCover username and password.

SSO can help organizations centralize user access, enforce their existing authentication policies, and provide users with one set of credentials across multiple applications.

Pandora CloudCover supports:

The instructions below cover SAML 2.0 setup. If you would like to use OIDC, contact Pandora CloudCover Support for assistance.

CloudCover can work with most SAML-compatible identity providers, including:

SSO can be configured by the Account Owner or a User Administrator.

Sign in to Pandora CloudCover and go to:

Account > Single Sign-On (SSO)

If you do not see this option, SSO may not yet be enabled for your account, or your user may not have permission to manage SSO. Contact Pandora CloudCover Support if you need assistance.

Set Status to Enabled.

Next, enter a Company Code. This is the identifier users can enter when signing in through the CloudCover SSO page.

Your Company Code must be unique to your organization.

The SSO settings page displays the information your identity provider needs to connect to Pandora CloudCover:

Create or configure a SAML application for Pandora CloudCover in your identity provider and enter these values. The field names vary depending on your identity provider:

The ACS URL tells your identity provider where to send the SAML response after a user authenticates.

The Entity ID identifies Pandora CloudCover as the SAML service provider.

If you're unsure where to enter these values, refer to your identity provider's documentation for setting up a custom SAML application.

Once Pandora CloudCover has been configured in your identity provider, export or download its SAML metadata XML file.

The metadata file contains the information CloudCover needs to communicate with your identity provider, including its SAML endpoints and signing information.

Return to: Account > Single Sign-On (SSO)

Upload the SAML metadata XML file you exported from your identity provider.

Map the following CloudCover user fields to the corresponding attributes or claims supplied by your identity provider:

These values are used to create and update the user's CloudCover profile when they sign in through SSO.

Click Save Changes.

Your SAML configuration is now ready to test.

We recommend testing SSO with a user before rolling it out more broadly.

Users can sign in by going to: https://tune.cloudcovermusic.com/#/login/sso

Select Log in with SSO, then enter the Company Code configured for your account.

The user will be redirected to your organization's identity provider to authenticate. After successful authentication, they will be returned to Pandora CloudCover.

After you enter a Company Code, CloudCover also provides a Sign-On URL for your organization. This link includes your Company Code automatically, so users do not need to enter it manually each time they sign in.

For example, if your Company Code is: mycompany.com

You can:

Users who follow this link will be taken directly into your organization's SSO flow.

Pandora CloudCover supports just-in-time (JIT) provisioning.

If a user does not already have a CloudCover profile, one can be created automatically the first time they successfully sign in through SSO.

Information such as the user's email address, first name, and last name is populated using the attribute mappings configured in your SSO settings.

Newly created users are not automatically assigned access to locations or zones.

After a user's first SSO login, an Account Owner or User Administrator can go to:

Account > Users

Select the user and assign:

Users will only be able to view and manage the locations and zones assigned to them.

You can also create a user before their first SSO login.

For SAML 2.0, the SSO External User ID is typically the value supplied in the NameID claim by your identity provider.

You do not need to manually enter the user's first name, last name, or email address when those fields are being provided through your SSO attribute mappings.

SSO requirements can be managed on a per-user basis.

Enable Require SSO for users who should authenticate through your organization's identity provider.

Leave Require SSO disabled for users who should continue signing in with a CloudCover username and password.

This can be useful when some users, devices, contractors, or other accounts should continue using standard CloudCover credentials.

To sign in using your organization's credentials:

If your organization has provided a custom CloudCover SSO link, you can use that link instead and skip entering the Company Code.

If you don't know your Company Code or sign-in URL, contact your organization's CloudCover administrator.

Your CloudCover administrator determines which locations and zones you can access.

Once signed in, you can:

If you need access to an additional location or zone, contact your organization's CloudCover administrator.

Some organizations historically created a separate CloudCover username and password for each physical location and shared those credentials among multiple employees.

With SSO, each person can instead sign in using their own corporate identity and access all of the locations assigned to them from a single CloudCover account.

This allows organizations to manage access at the individual user level while users can move between their assigned locations without signing in and out of separate location accounts.

If you have questions about configuring SSO, attribute mappings, user provisioning, or switching identity providers, contact Pandora CloudCover Support. We’re happy to help.