Citrix ShareFile SAML Single Sign-On (SSO)

Prepare ShareFile for single sign-on: Set up your user accounts in ShareFile.

Configure ShareFile for SSO with SAML. For details, see Configure ShareFile for SSO.

Configure the application settings in the Identity Administration portal: Configure the ShareFile web application in the Identity Administration portal. Here you specify some of the settings you specified in the web application directly. For details, see Configure ShareFile in the Identity Administration portal.

In your web browser, go to the administration login URL for ShareFile.

The URL has the following format: https://<customName>.ShareFile.com where customName is most likely your company name.and log in with your administrator user name and password.

Go to Settings > Admin Settings > Security > Login & Security Policy.

Use this page to configure the application for single sign-on from the user portal.

In the Basic Settings section, select Enable SAML.

Specify the following for the Basic Settings:

Specify the following for the Optional Settings:

Click Save.

Log out of your ShareFile account.

In the Identity Administration portal, click Apps, then click Add Web Apps.

The Add Web Apps screen appears.

On the Search tab, enter the partial or full application name in the Search field and click the search icon.

Next to the application, click Add.

In the Add Web App screen, click Yes to confirm.

Identity Administration portal adds the application.

Click Close to exit the Application Catalog.

The application that you just added opens to the Application Settings page.

Select the Citrix ShareFile SAML application and click Add App.

The application opens to the Application Settings screen.

Specify the following:

(Optional) On the Application Settings page, click Enable Derived Credentials for this app on enrolled devices (opens in built-in browser) to use derived credentials on enrolled mobile devices to authenticate with this application.

See CyberArk-issued derived credentials for more information.

On the Application Settings page, expand the Additional Options section and specify the following settings:

(Optional) On the Description page, you can change the name, description, and logo for the application. For some applications, the name cannot be modified.

The Category field specifies the default grouping for the application in the user portal. Users have the option to create a tag that overrides the default grouping in the user portal.

On the User Access page, select the role(s) that represent the users and groups that have access to the application.

When assigning an application to a role, select either Automatic Install or Optional Install:

• Select Automatic Install for applications that you want to appear automatically for users.

• If you select Optional Install, the application doesn’t automatically appear in the user portal and users have the option to add the application.

(Optional) On the Policy page, specify additional authentication controls for this application.

(Optional) In the Default Profile (used if no conditions matched) drop-down, you can select a default profile to be applied if a user does not match any of the configured conditions.

If you have no authentication rules configured and you select Not Allowed in the Default Profile dropdown, users will not be able to log in to the service.

Click Save. If you have more than one authentication rule, you can prioritize them on the Policy page. You can also include JavaScript code to identify specific circumstances when you want to block an application or you want to require additional authentication methods. For details, see Application access policies with JavaScript.

On the Account Mapping page, configure how the login information is mapped to the application’s user accounts.

The options are as follows:

• Use the following Directory Service field to supply the user name: Use this option if the user accounts are based on user attributes. For example, specify an Active Directory field such as mail or userPrincipalName or a similar field from the CyberArk Cloud Directory.

• Everybody shares a single user name: Use this option if you want to share access to an account but not share the user name and password. For example, some people share an application developer account.

• Use Account Mapping Script: You can customize the user account mapping here by supplying a custom JavaScript script. For example, you could use the following line as a script:

  LoginUser.Username = LoginUser.Get('mail')+'.ad';

  The above script instructs CyberArk Identity to set the login user name to the user’s mail attribute value in Active Directory and add ‘.ad’ to the end. So, if the user’s mail attribute value is Adele.Darwin@acme.com then CyberArk Identity uses Adele.Darwin@acme.com.ad. For more information about writing a script to map user accounts, see the SAML application scripting.

(Optional) On the Advanced page, you can edit the script that generates the SAML assertion, if needed. In most cases, you don’t need to edit this script. For more information, see the SAML application scripting.

(Optional) On the Changelog page, you can see recent changes that have been made to the application settings, by date, user, and the type of change that was made.

(Optional) Click Workflow to set up a request and approval work flow for this application.

See Manage application access requests for more information.

Click Save.

You prepare your Citrix ShareFile demo account for provisioning:

In the Identity Administration portal, you configure the Citrix ShareFile application for automatic user provisioning:

Click the Provisioning tab.

Select Enable provisioning for this application.

Select either Preview Mode or Live Mode.

• Preview Mode: Use Preview Mode when you’re initially testing the application provisioning or making configuration changes. The identity platform does a test run to show you what changes it would make but the changes aren’t saved.

• Live Mode: Use Live mode when you want to use application provisioning in your production system. The identity platform does the provisioning run and saves the changes to both the identity platform and the application’s account information.

Enter the following information for the main provisioning details:

Click Verify to have CyberArk Identity verify the connection and save the provisioning details.

First, make sure that you’ve entered and verified the provisioning credentials.

On the Provisioning page, scroll down to Sync Options. 

Specify how CyberArk Identity handles situations when it determines that the user already has an account in the target application.

• Sync (overwrite): Updates account information in the target application (this includes removing data if the target account has a value for a user attribute that is not available from CyberArk Identity).

• Do not sync (no overwrite): Keeps the target user account as it is; CyberArk Identity skips and does not update duplicate user accounts in the target application.

• Do not de-provision (deactivate or delete): The user's account in the target application is not de-provisioned when a role membership change that would trigger a de-provisioning event occurs.

• Select Deprovision users in this application when they are disabled in source directory to enable the feature.

  If checked, a user will be deprovisioned when they are marked as disabled in the source directory. Deprovisioning behavior and available deprovisioning options depend on what the target application supports.

Scroll to the Role Mappings section.

To add role mappings and specify which users get provisioned to this application, click Add.

The Role Mapping dialog box opens.

To map user accounts in the Identity Administration portal to Citrix ShareFile user accounts, select a Role (the ones in the Identity Administration portal) and a Destination group (the ones in Citrix ShareFile).

For Citrix ShareFile, the Destination group is a set of permissions that CyberArk Identity sets for the provisioned users. You can assign a role to any, all, or none of the destination groups.

Click Done to save the role mapping and return to the Provisioning page.

Continue adding role mappings, as desired.

• To change a mapping, select the role mapping and click Modify.

• To remove a mapping, select the role mapping and click Delete.

• To change the order of the role mappings, select the role mapping that you want to move higher in the list and click Move Up.

When you’re done, click Save to save the provisioning details.

Anytime that you make changes to the provisioning role mapping, CyberArk Identity runs a synchronization automatically. You can also run a preview synchronization or a real synchronization, if desired.