Start FileCloud FREE Trial
Log in

SAML Single Sign-On Support

Updates to SAML SSO

As of  FIleCloud Version 19.1, the ability to limit users to SSO by group is available.

As of FIleCloud Version 19.2, FileCloud can detect an SSO email and automatically redirect the user to the corresponding IDP provider with prefilled login information for the user.

You can use SAML SSO to control the authorization and authentication of hosted user accounts that can access FileCloud Web based interface.

  • SAML is an XML based open standard data format for exchanging authentication and authorization data between parties.
  • FileCloud supports SAML (Security Assertion Markup Language) based web browser Single Sign On (SSO) service
  • FileCloud acts as a Service Provider (SP) while the Customer or Partner acts as the identity provider (IdP).  FileCloud SAML SSO service is based on SAML v2.0 specifications.

SSO Login Diagram

The following process explains how the user logs into a hosted FileCloud application through customer-operated SAML based SSO service.

  1. The user attempts to reach the hosted FileCloud application through the URL.
  2. FileCloud generates a SAML authentication request. The SAML request is embedded into the URL for the customer’s SSO Service.
  3. FileCloud sends a redirect to the user’s browser. The redirect URL includes the SAML authentication request and is submitted to customer’s SSO Service.
  4. The Customer’s SSO Service authenticates the user based on valid login credentials.
  5. The customer generates a valid SAML response and returns the information to the user’s browser.
  6. The customer SAML response is redirected to FileCloud.
  7. The FileCloud authentication module verifies the SAML response.
  8. If the user is successfully authenticated, the user will be successfully logged into FileCloud.

When the IdP successfully authenticates the user account, FileCloud (SP) authentication module verifies that the user account exists in FileCloud.

  • If the user account does not exist in FileCloud, then a new user account is created and the user is logged into FileCloud.

SSO Configuration Steps

In order to successfully configure SAML SSO, the following steps must be followed.

To configure Apache Webserver for SAML SSO, please Contact FileCloud Support.

To ensure the correct FileCloud URL is set, and that it uses HTTPS:

  1. In the admin portal, go to Settings > Server.
  2. In the Server URL field, confirm that your URL begins with HTTPS.
  3. Click Check URL to make sure your URL is valid.


To set the SSO type in FileCloud:

  1. Log into the FileCloud admin portal.

  2. In the left navigation panel, click Settings.

  3. Select the SSO tab.

  4. In Default SSO Type, select SAML.

Active Directory Federation Services (ADFS) Support

When SAML SSO Type is selected and ADFS is enabled in FileCloud:

  • FileCloud will act as a Service Provider (SP)
  • FileCloud also acts as a claims aware application.

As a claims-aware application, FileCloud:

  • Accepts claims in the form of ADFS security tokens from Federation Service
  • Can use ADFS claims to support Single Sign On (SSO) into FileCloud

To specify the identity claims that are sent to the FileCloud refer to the IdP Configuration section below.

(lightbulb) When ADFS is used, the IdP (Identity Provider) in these instructions refers to Active Directory Federation Server.

To configure IdP settings in FileCloud:

  1. Log into the FileCloud admin portal.

  2. In the left navigation panel, click Settings.

  3. Select the SSO tab.

  4. In Default SSO Type, verify it is set to SAML.

  5. Set other parameters according to your IdP settings.



Use the following tables to understand the IdP settings.

FileCloud ParametersIdP Settings

ADFS as IdP

Data can be obtained from Federation Metadata

IdP End Point URLIdentity Provider URL

Identity Provider URL (Entity ID)

e.g. http://yourADFSdomainName/adfs/services/trust

Idp Username Parameter

Identifies the Username (must be unique for each user)

  • Usually uid or agencyUID
  • Default value: uid

NOTE: The username must be unique. If username sent by Idp is in email format, the email prefix will be used for username. The email prefix in this case must be
unique.

Identifies the Username (must be unique for each user)
Usually SAMAccountName or User Principal Name defined in claim rules.

NOTE: The username must be unique. If username sent by Idp is in email format,
the email prefix will be used for username. The email prefix in this case must be
unique. 

value: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn or upn


IdP Email Parameter

Identifies the email of the user (must be unique)

Default value: mail

Identifies the email of the user (must be unique)

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress or emailaddress


IdP Given Name Parameter

Identifies the given name of the user

Default value: givenName

Identifies the given name of the user.

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname or givenname

IdP Surname Parameter

Identifies the surname of the user

Default value: sn

Identifies the sur name of the user

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname or surname

IdP Log Out URL (Optional)URL for logging out of IdP

URL for logging out of IdP

Note: For this setting to be effective, request that FileCloud Support add the corresponding setting to your FileCloud configuration.

Limit Logon to IdP Group

(available in FileCloud Version 19.1 and higher)

IdP Group Name

  • Specifying a group name means that a user can login through SAML SSO only when the Identity Provider indicates that the user belongs to the specified IdP group
  • The IdP must send this group name through the memberof parameter
  • The memberof parameter can include a comma separated value of all groups to which the user belongs

IdP Group Name

  • Specifying a group name means that a user can login through SAML SSO only when the Identity Provider indicates that the user belongs to the specified IdP group
  • The IdP must send this group name through the memberof parameter
  • The memberof parameter can include a comma separated value of all groups to which the user belongs
Show the IdP Logon Screen

Identifies which Logon screen the user will see:

  • FileCloud screen = not selected
  • IdP screen = selected

Identifies which Logon screen the user will see:

  • FileCloud screen = not selected
  • IdP screen = selected
IdP Meta DataIdentity Provider Metadata in XML FormatFederation Metadata in xml format
SSO Error Message (Optional)

Added in FileCloud 20.1

Custom error message that appears when a signin is invalid. Enter in HTML format.

Custom error message that appears when a signin is invalid. Enter in HTML format.

Allow Account Signups

Added in FileCloud 20.1

When TRUE, during the login process, if the user account does not exists, a new FileCloud user account is created automatically.When TRUE, during the login process, if the user account does not exists, a new FileCloud user account is created automatically.

Automatic Account Approval

Added in FileCloud 20.1

This setting works with the Allow Account Signups setting to determine:

  • If the account created by the user is disabled until the Administrator approves it
  • If the account is approved with a specific level of access automatically without intervention from the Administrator.
  • Possible values are:
    0 - No Automatic approval, Admin has to approve account
    1 - Automatically approve new accounts to Full User
    2 - Automatically approve new accounts to Guest User
    3 - Automatically approve new accounts to External User



This setting works with the Allow Account Signups setting to determine:

  • If the account created by the user is disabled until the Administrator approves it
  • If the account is approved with a specific level of access automatically without intervention from the Administrator.
  • Possible values are:
    0 - No Automatic approval, Admin has to approve account
    1 - Automatically approve new accounts to Full User
    2 - Automatically approve new accounts to Guest User
    3 - Automatically approve new accounts to External User


Enable ADFSNoYes
User login token expiration match Idp expiration

If enabled the user token expiration will be set based on Idp expiration settings

If not enabled user token expiration will be set based on FileCloud Session Timeout
(FileCloud admin UI - Settings - Server - Session Timeout in Days)

Default: No (Not enabled) 

If enabled the user token expiration will be set based on ADFS expiration settings

If not enabled user token expiration will be set based on FileCloud Session Timeout
(FileCloud admin UI - Settings - Server - Session Timeout in Days)

Default: No (Not enabled) 

Show the Idp Login ScreenIf enabled, automatically redirect user to Idp log-in screen.

If enabled, automatically redirect user to Idp log-in screen.

Log Level

Set the Log mode for the SAML Calls.

Default Value: prod (Do not use DEV for production systems)

Set the Log mode for the SAML Calls.

Default Value: prod (Do not use DEV for production systems)


Use the following URL (Entity ID) to register FileCloud as an SP with IdP or ADFS.  The URL below also provides the metadata of the FileCloud SP.

http://<Your Domain>/simplesaml/module.php/saml/sp/metadata.php/default-sp

You can customize the user log-in screen to display the SSO log-in option along with the direct log-in option or to only display the SSO log-in.

To display the SSO log-in option along with the direct log-in option:

  1. From the left navigation pane, click Customization. 

  2. Select the General  tab, and then the Login sub-tab.

  3. Check Show SSO Link and Show Login Options.
  4. Save your changes.
    Now, when users access the user portal log-in page, they will see:


    On clicking the Single Sign-On link on the login page, the user is redirected to the SAML SSO Service web page. 


To only display the SSO log-in the user portal or the admin portal, please Contact FileCloud Support.



Integrating with other applications