Single sign on (SAML)

Single sign on (SSO) can be configured using various IdPs and certain SAML 2.0 or 3.0-based federation tools using basic, integrated, or forms authentication. This feature is available for the following ShareFile plans:

• Standard
• Advanced
• Premium
• Enterprise
• Industry Advantage
• Virtual Data Room

Note:

• This setting requires all Employee ShareFile users to use their Active Directory (AD) credentials to login to ShareFile.
• This setting cannot relate to Client users of the account.
• IdP-initiated SSO is not supported. When an IdP initiates SSO, the system automatically retriggers an SP-initiated authentication flow.

IP address restrictions

IP address restrictions apply to users who sign in through SSO. SSO configuration and IP address restrictions are managed separately. To allow or restrict access by IP address or IP range, contact ShareFile Support through the support chat. Provide the IP addresses or ranges, whether to allow or restrict them, and whether the restriction applies to employees, clients, or both.

Enable single sign on

To enable single sign on (SAML):

1. From the ShareFile dashboard, navigate to Account settings.
2. Select Security.
3. Under Sign in policy, select Single sign on (SAML).
4. Click Edit. The Single sign on (SAML) drawer opens.
5. From the Single sign on (SAML) drawer, select Enable. The single sign on configuration displays.
6. Specify the following information:
   1. ShareFile issuer/Entity ID - Enter the Issuer or Entity ID that represent the ShareFile service. This usually is in the form of a URL or a colon-delimited string.
   2. Your IDP issuer/Entity ID - Select the Issuer or Entity ID that represents your Identity Provider (IDP). Typically this can be left at the default setting.
   3. X.509 certificate - Enter the public portion of your X.509 certificate, including the---BEGIN CERTIFICATE--- and ---END CERTIFICATE--- lines.
   4. Sign in URL - Enter the URL of your IdP's assertion consumer service.
   5. Require SSO sign in - Require non-administrative employees to sign in using your identity provider. See Require SSO sign on for details and steps.
   6. SP - initiated SSO certificate - Sign SP-Initiated SAML Requests to your identity provider. Select "View" to retrieve the public certificate and add it to your IDP configuration. Choose from:
      1. HTTP Redirect with no signature
      2. HTTP Redirect (1024 bit certificate)
      3. HTTP Post (2048 bit certificate)
   7. Force SP-initiated SSO certificate to regenerate - Check this box to force ShareFile to regenerate the SP-Initiated certificate. Note that you will need to reconfigure your SSO service with the new certificate after saving.
   8. Enable web authentication - Select this check box if your account is using ShareFile Sync for Windows, ShareFile Sync for Mac, or the ShareFile Outlook Plugin and your SAML IDP is configured for web-based (Forms) authentication.
   9. SP-initiated authentication context - Defines the method and comparison level for the authentication context. IDPs have to match the selected authentication method, when using the "Exact" comparison; or a higher relative strengh method when using the "Minimum" comparison setting. Select one of the folliwing options:
      1. Unspecified
      2. User name and password
      3. Password protected transport
      4. Transport layer security (TLS) client
      5. X.509 certificate
      6. Integrated Windows authentication
      7. Kerberos
   10. Active profile cookies - This is an advanced setting used by ShareFile Active clients - - i.e., Mobile clients, Sync engine, Outlook plug-in, etc. This parameter may be needed to automate selections in certain IDP configurations, such as Home Realm selection in Microsoft ADFS.
7. Select Save to apply the changes.

Require SSO sign on

Enabling SSO configures your identity provider for ShareFile. To require non-administrative employees to use that identity provider when signing in, enable Require SSO sign in. This requirement does not apply to client users.

Before requiring SSO, enable and configure single sign on.

1. From the ShareFile dashboard, navigate to Account settings > Security.
2. Under Sign in policy, select Single sign on (SAML).
3. Select Edit.
4. In the Single sign on (SAML) drawer, enable Require SSO sign in.
5. Select Save to apply the changes.

Note:

Employee users with the Admin role can still sign in using their ShareFile credentials if there are configuration issues with your identity provider.

Supported configurations

The following configurations have been tested and are supported for most environments.

• ADFS 4.0 (Windows Server 2016)

• Microsoft Entra ID (Azure AD)

More configurations

These configurations have been successfully configured and tested by our engineering teams. The following configuration documentation is subject to change due to continued product enhancements and improvements. The following configuration guides are presented as is:

• Centrify/Idaptive (CyberArk documentation)

• ShareFile cloud application - Google Workspace Admin Help

• Okta

• Ping-Federate

• PingOne / PingID

• OneLogin or download the OneLogin PDF guide

• G Suite

NOTE:

ShareFile no longer supports custom logout URLs for the SAML configuration. All users will be directed to the ShareFile authentication service's logout page when they sign out. Some of the above configuration guides may still provide a logout URL, but are no longer necessary.