Product Documentation
ShareFile
View PDF

Single sign on (SAML)

September 5, 2025
Contributed by: 
P

Single sign-on (SSO) can be configured using various IdPs and certain SAML 2.0 or 3.0-based federation tools using basic, integrated, or forms authentication. This feature is available for:

  • Standard
  • Advanced
  • Premium
  • Industry Advantage
  • Virtual Data Room

Notes:

  • This setting requires all Employee ShareFile users to use their Active Directory (AD) credentials to login to ShareFile.

  • This setting cannot relate to Client users of the account.

  • Admin employee users with “Configure single sign-on settings” permission can still login using their ShareFile credentials. This is for redundancy purposes in case there are any configuration issues with the identity provider.

Enforce single sign on

To enforce single sign on (SAML):

  1. From the ShareFile dashboard, navigate to Settings > Admin Settings > Security > Sign In Policy > Single sign on (SAML).

  2. Click Edit:

    SSO

    The Single sign on (SAML) drawer opens.

  3. From the Single sign on (SAML) drawer, select Enable:

    Enable SSO

    The single sign on configuration displays.

  4. Specify the following information:

    1. ShareFile issuer/Entity ID - Enter the Issuer or Entity ID that represent the ShareFile service. This usually is in the form of a URL or a colon-delimited string.
    2. Your IDP issuer/Entity ID - Select the Issuer or Entity ID that represents your Identity Provider (IDP). Typically this can be left at the default setting.
    3. X.509 certificate - Enter the public portion of your X.509 certificate, including the—BEGIN CERTIFICATE— and —END CERTIFICATE— lines.
    4. Sign in URL - Enter the URL of your IdP’s assertion consumer service.
    5. Require SSO sign in - Require non-administrative Employees to log in using your identity provider.
    6. SP - initiated SSO certificate - Sign SP-Initiated SAML Requests to your identity provider. Select “View” to retrieve the public certificate and add it to your IDP configuration. Choose from:
      1. HTTP Redirect with no signature
      2. HTTP Redirect (1024 bit certificate)
      3. HTTP Post (2048 bit certificate)
    7. Force SP-initiated SSO certificate to regenerate - Check this box to force ShareFile to regenerate the SP-Initiated certificate. Note that you will need to reconfigure your SSO service with the new certificate after saving.
    8. Enable web authentication - Select this check box if your account is using ShareFile Sync for Windows, ShareFile Sync for Mac, or the ShareFile Outlook Plugin and your SAML IDP is configured for web-based (Forms) authentication.
    9. SP-initiated authentication context - Defines the method and comparison level for the authentication context. IDPs have to match the selected authentication method, when using the “Exact” comparison; or a higher relative strengh method when using the “Minimum” comparison setting. Select one of the folliwing options:
      1. Unspecified
      2. User name and password
      3. Password protected transport
      4. Transport layer security (TLS) client
      5. X.509 certificate
      6. Integrated Windows authentication
      7. Kerberos
    10. Active profile cookies - This is an advanced setting used by ShareFile Active clients - - i.e., Mobile clients, Sync engine, Outlook plug-in, etc. This parameter may be needed to automate selections in certain IDP configurations, such as Home Realm selection in Microsoft ADFS.
  5. Click Save.

Supported configurations

The following configurations have been tested and are supported for most environments.

More configurations

These configurations have been successfully configured and tested by our engineering teams. The following configuration documentation is subject to change due to continued product enhancements and improvements. The following configuration guides are presented as is:

Note:

ShareFile no longer supports custom logout URLs for the SAML configuration. All users will be directed to the ShareFile authentication service’s logout page when they sign out. Some of the above configuration guides may still provide a logout URL, but are no longer necessary.

Single sign on (SAML)
September 5, 2025
Contributed by: 
P
September 5, 2025
Contributed by: 
P

In this article

Site feedback | Privacy and legal terms | Cookie preferences
©Progress Software all rights reserved