SAML (Any Provider)
Files.com supports SSO (Single Sign-On) with both SP-initiated and IdP-initiated logins, and integrates with the most popular SSO providers. If your identity provider is not listed by name in our list of supported SSO providers, you can use our generic SAML Service Provider application to connect your IdP with Files.com.
Identity providers that work with our SAML application include Ping Identity, Cloudflare SSO, Cisco Duo Security SSO, Google Workspace SSO, IBM Security Verify, and Rippling SSO. We work with any SSO provider that is SAML 2.0 compliant.
SAML Overview
Security Assertion Markup Language (SAML) is an XML-based, open-standard data format for exchanging authentication and authorization data between parties (for example, between an identity provider and a service provider).
The SAML specification defines three roles. The Principal is typically a user, though it can also be a system or application. The Identity Provider (IdP) manages and authenticates user identities; Ping Identity and Cloudflare SSO are common examples. The Service Provider (SP) is the application the user is signing in to, which in this case is Files.com. These roles define how users, identity providers, and service providers interact and what each is responsible for.
Configure SAML Application
To connect the Files.com SAML application to your identity provider, you need the information below. Users need a corresponding Files.com account, created in advance or through configured automatic provisioning. Configure your identity provider first, then configure the Files.com application.
Configure Your Identity Provider
Set up a connection for Files.com SSO with your IdP using the values below.
| Field | Value |
|---|---|
| Single Sign On URL Assertion Consumer Service URL ACS URL Service Provider SSO URL SP SSO URL | https://app.files.com/saml/consume |
| Audience URI SP Entity ID SP URL Provider ID Metadata URL | https://app.files.com/saml/metadata, or https://app.files.com/saml/metadata/<Unique Identifier> when the Files.com provider has a Unique Identifier. See One Identity Provider for Multiple Sites. |
| Default RelayState (optional) | [SUBDOMAIN].files.com (Replace [SUBDOMAIN] with your Files.com subdomain). Required for IdP-initiated login. |
| Name ID format | EmailAddress |
| Application username |
After you configure the SAML application in your IdP, your IdP will give you access to a Metadata file or a Metadata URL, which you will need for the next step. SAML metadata is an XML document containing the information needed to interact with SAML-enabled identity or service providers, including endpoint URLs, supported bindings, identifiers, and public keys.
Configure Files.com SAML Application
Select SAML (Other Provider) from the SSO providers list. If you have a Metadata URL or an XML file from your IdP, enter it into the form and click Save.
To connect using a Certificate Fingerprint instead, get the Issuer URL, SLO endpoint, and SSO endpoint from your IdP, and download the certificate from your IdP. After the certificate is on your local machine, run the following command in a terminal to obtain its fingerprint.
openssl x509 -in [your_cert_file] -noout -sha256 -fingerprint
In Files.com, select the Certificate Fingerprint option and paste the fingerprint from the command above. Paste the Issuer URL you copied from your IdP. Use the SSO and SLO endpoint values published in your provider's metadata; do not substitute the issuer URL for either endpoint. Click Save to save your configuration.
The generic SAML authentication method is now available when assigning an authentication method for a user in Files.com, and the Sign in with SAML (Other Provider) button appears on your site's login page. Single sign-on authentication works with browser-based sessions, the Desktop App, and the Mobile App.
We strongly recommend keeping at least one site administrator on password authentication rather than assigning every administrator to SSO. This prevents lockout from Files.com during an IdP or SSO outage.
One Identity Provider for Multiple Sites
Your organization can use one SAML identity provider for several Files.com sites, such as separate production and test sites. Configure a separate application in the IdP for each site so you can assign users and set sign-in requirements independently.
Give each application a distinct Entity ID and configure its assertions to name only that Entity ID as their audience. The audience identifies the application for which the IdP authenticated the user. In Files.com, the provider's Unique Identifier is the suffix appended to https://app.files.com/saml/metadata/. For example, a Unique Identifier of company-test corresponds to the full Entity ID https://app.files.com/saml/metadata/company-test in the IdP. Enter the suffix in Files.com, not the full URL. The SSO provider API exposes this setting as provider_identifier.
Keep the Assertion Consumer Service URL as https://app.files.com/saml/consume. Set each application's Relay State to its site's hostname for IdP-initiated login. The Entity ID and Relay State serve different purposes: the audience states which application may accept the assertion, while Relay State selects the Files.com site that processes it. A different Relay State alone does not separate two applications with identical SAML trust settings.
Files.com does not reject SAML settings merely because another site uses them. If two sites trust the same issuer and signing certificate and use the same Entity ID, an assertion can pass either provider's SAML checks. Distinct Entity IDs reject an assertion addressed only to the other application. They do not substitute for configuring the IdP to send an audience: Files.com also accepts assertions without an audience restriction, and accepts a list of audiences when one matches. SAML in Security Reference explains these checks and the account requirements that still apply.
SCIM Provisioning
Files.com supports SCIM provisioning with popular identity providers that have SAML-based integrations, and with the generic SAML integration when your IdP supports SCIM. See the SCIM Provisioning page for details.