Single Sign-On Authentication
Single Sign-On (SSO) is an authentication mechanism that allows a user's identity to be managed by a single, trusted identity provider through which the user can access multiple service providers. SSO is rapidly gaining popularity both for security and compliance purposes, and to improve user experience in an increasingly complex applications and services environment.
When your users have multiple apps and services to navigate, SSO helps keep it safe and simple.
Files.com supports SP (Service Provider) initiated SSO flow securely and integrates with the most popular SSO providers. Always a leader in security and integration practices, we understand that our service must play well with others. Please contact us if you are looking for an IdP initiated SSO flow or looking for any other integration in this context. We are happy to help.
SSO integrations are available on Power and Premier plans. Each of our SSO-enabled plans carries different SSO capacities and options, so please review each plan to determine which best fits your needs.
Files.com integrates with the following SSO providers.
Several SSO integrations will also support user and group provisioning as configured by the SSO provider application.
|Provider||ProviderAuthentication and On-Demand Provisioning||SCIM Provisioning|
Microsoft Active Directory
SAML (any provider)
You can add as many providers as you wish.
To add a provider, log in as an administrator and navigate to Settings > Users > User Settings, click the SSO Providers setting, and then click the Add provider button.
A table of the various options will appear. Click on the logo of the provider desired and then click the Save button. The new provider will be added to the table of enabled providers. You can also disable any enabled SSO providers from this table.
Auth0, Microsoft Azure and Okta require additional configuration to complete the initial setup. Please reference the provider's support documentation to locate your Subdomain, Client ID and Client Secret.
Additionally, Auth0, Microsoft Azure and Okta support advanced provisioning options. Click on Advanced to expand the configuration settings and configure the provisioning settings.
Please note that you can not use the same SSO provider settings (ex: Application ID or Client ID, Tenant ID, Secret etc., from your SSO provider) in more than one Files.com site.
Files.com supports SCIM provisioning and it is designed to integrate seamlessly with popular identity providers such as Okta, Azure Active Directory, and OneLogin. You can even use SCIM provisioning with SAML (any provider) or Auth0. Organizations can configure SCIM provisioning by establishing a connection between their identity provider and Files.com. Once the integration is set up, user provisioning and management can be effectively streamlined. Visit the SCIM Provisioning page for more details.
After an SSO provider has been enabled for a site, site administrators grant SSO access on a per-user basis. Granting this access can be performed when creating a new user or by modifying an existing user's settings. Please note that each unique user can have only one SSO provider assigned.
To assign an SSO method for an existing user, navigate to Settings > Users and click the username of the user. Next, click Authentication Method and select the desired SSO provider from the dropdown list.
Finally, click Save to apply the setting.
Files.com also allows you to Bulk Import or Bulk Create users with any site-enabled SSO providers. To do this, use the authentication_method column with one of the site-enabled SSO provider name.
Files.com allows for you to have a mix of SSO-authenticated and Files.com password-authenticated users on your site.
For example, you could have your internal users authenticate via an SSO provider, and have your external vendors/partners authenticate with Files.com passwords.
To do this simply repeat the navigation steps mentioned prior for the user in question, and select your preferred Authentication Method for that user.
Site administrators can change or remove the user's ability to authenticate via SSO at any time by selecting Password from the dropdown list.
Note that, when selecting a new SSO provider for authentication, first ensure that the corresponding user's username is already created in the IdP to avoid any authentication issues. We strongly recommend to have at least one site administrator who is configured to have the password option as the authentication method instead of assigning all site administrators to use SSO as an authentication method. This password authentication site administrator account will help you to avoid getting your Files.com site locked out, particularly in cases when you have any issues with your IdP or SSO integration.
Once you have enabled an SSO provider, a Sign in with... button for that provider will appear on your site's login page. Users are able to click the appropriate service button to be authenticated via the external service and redirected to their Files.com account.
When logging into Files.com using the SSO provider for the first time, users will be prompted to authorize the connection of their provider account with Files.com.
If a user does not have a current session with the SSO provider, they will be prompted to log in to that provider's service before the Files.com authentication is verified.
Disabling an SSO provider will revoke access for the user accounts that are configured to authenticate using that SSO provider. The login page will also not show the login option for that provider.
To disable an SSO provider, navigate to Settings > Users > User Settings > SSO Providers, edit the SSO provider, and click the Enabled option to toggle the selection to its disabled state.
To re-enable a disabled SSO provider, edit the SSO provider, and click the Enabled option to toggle the selection back to its enabled state.
To remove an SSO provider entirely, site administrators must first modify all user accounts that are currently set to use that SSO provider, and configure them to use another authentication method or provider. You can quickly identify any users set to the provider by looking at the AUTHENTICATION METHOD column of the user list. Once there are no users configured to authenticate with the provider, you will be able to remove it.
Sometimes it might be required to switch the SSO provider because of various reasons your business may have.
To switch your current SSO provider for Files.com to new SSO provider, make sure that the new identity provider of your choice is supported before starting your migration. Files.com integrates with most popular SSO and you can check the supported providers list.
Once you pick the new identity provider, follow the corresponding Files.com SSO integration documentation and enable the new SSO provider.
In general, if you face any challenges in migrating the configuration or users from Files.com to new SSO provider, please refer to the provider's support documentation.
For a SAML-based IdP, work with the SSO IdP to check if the issuer + audience + username combination can be reused or not.
For SCIM, make sure the mappings and provisioning are configured properly with the new SSO provider to avoid any duplicate or disabled users in Files.com or in your user directory.
Once the new provider is setup and ready to use, go to Settings > Users > Manage Users > [UserName] > Authentication > Authentication method to edit and pick the new provider of your choice for that user.
Once all users are updated, you can disable the old SSO provider. With this, all users can now start using your new SSO provider to login to Files.com.
Single sign-on authentication can only be used with browser-based sessions, or with the Files.com Desktop App.
If the user requires access to FTP/SFTP/DAV connections, the authentication method must be set to Password or Active Directory/LDAP.
An alternative approach is for the user to use SSO and then additionally add an SFTP key or an API Key to their user account.
As an administrator, you can add an SFTP key for a user at Settings > Users > [username] > Authentication > SFTP keys. Or users can add their own keys in the web interface by going to My account in the top right menu.
This works! We have designed the Files.com app to allow connecting with SSO user accounts. Follow the instructions to connect your account, and on the login screen click the SSO provider button assigned for that user.
We currently do not support SSO login with our mobile application. If the user requires mobile application access, the authentication method must be set to Password or Active Directory/LDAP.
Note that users can always use any browser on the mobile device to access their Files.com site using SSO. To do that, simply open any browser application on your mobile device, go to your site's login page and select the SSO provider to login.
If you want to have the Files.com web application automatically send your users to a SSO Provider rather than displaying the login page, build a link on your external site that links to a URL on your files.com site with the URL parameter ?use_sso=1 appended.
For example, send someone a link to: https://mysite.files.com/files/MyFolder/?use_sso=1
This solution only works if you have exactly one SSO provider.
Get Instant Access to Files.com
The button below will take you to our Free Trial signup page. Click on the white "Start My Free Trial" button, then fill out the short form on the next page. Your account will be activated instantly. You can dive in and start yourself or let us help. The choice is yours.Start My Free Trial