SAML for single sign-on with Citrix Files 编辑

Important:

This article applies only to Endpoint Management environments that aren’t Workspace-enabled. In a Workspace-enabled environment, Content Collaboration is integrated directly with Citrix Workspace.

You can configure Endpoint Management and Content Collaboration to use the Security Assertion Markup Language (SAML) to provide single sign-on (SSO) access to Citrix Files mobile apps. This functionality includes:

• Citrix Files apps that are MAM SDK enabled or wrapped by using the MDX Toolkit

• Non-wrapped Citrix Files clients, such as the website, Outlook plug-in, or sync clients

• For wrapped Citrix Files apps: Users who log on to Citrix Files get redirected to Secure Hub for user authentication and to acquire a SAML token. After successful authentication, the Citrix Files mobile app sends the SAML token to Content Collaboration. After the initial logon, users can access the Citrix Files mobile app through SSO. They can also attach documents from Content Collaboration to Secure Mail mails without logging on each time.
• For non-wrapped Citrix Files clients: Users who log on to Citrix Files using a web browser or other Citrix Files client are redirected to Endpoint Management. Endpoint Management authenticates the users, who then acquire a SAML token which is sent to Content Collaboration. After the initial logon, users can access Citrix Files clients through SSO without logging on each time.

To use Endpoint Management as a SAML identity provider (IdP) to Content Collaboration, you must configure Endpoint Management for use with Enterprise accounts, as described in this article. Alternatively, you can configure Endpoint Management to work only with storage zone connectors. For more information, see Content Collaboration use with Endpoint Management.

For a detailed reference architecture diagram, see Architecture.

Prerequisites

Complete the following prerequisites before you can configure SSO with Endpoint Management and Citrix Files apps:

• The MAM SDK or a compatible version of the MDX Toolkit (for Citrix Files mobile apps).

  For more information, see Endpoint Management compatibility.

• A compatible version of Citrix Files mobile apps and Secure Hub.
• Content Collaboration administrator account.
• Connectivity verified between Endpoint Management and Content Collaboration.

Configure Content Collaboration access

Before setting up SAML for Content Collaboration, provide Content Collaboration access information as follows:

1. In the Endpoint Management web console, click Configure > Content Collaboration. The Content Collaboration configuration page appears.

   

2. Configure these settings:

   • Domain: Type your Content Collaboration subdomain name. For example: example.sharefile.com.
   • Assign to delivery groups: Select or search for the delivery groups that you want to be able to use SSO with ShareFile.
   • Content Collaboration Administrator Account Logon
   • User name: Type the Content Collaboration administrator user name. This user must have administrator privileges.
   • Password: Type the Content Collaboration administrator password.
   • User account provisioning: Leave this setting disabled. Use the Content Collaboration User Management Tool for user provisioning. See Provision user accounts and distribution groups.

3. Click Test Connection to verify that the user name and password for the Content Collaboration administrator account authenticate to the specified Content Collaboration account.

4. Click Save.

   • Endpoint Management syncs with Content Collaboration and updates the Content Collaboration settings ShareFile Issuer/Entity ID and Login URL.

   • The Configure > Content Collaboration page shows the App internal name. You need that name to complete the steps described later in Modify the Citrix Files.com SSO settings.

Set up SAML for Wrapped Citrix Files MDX Apps

You don’t need to use Citrix Gateway for single sign-on configuration with Citrix Files apps prepared with the MAM SDK. To configure access for non-wrapped Citrix Files clients, such as the website, Outlook plug-in, or the sync clients, see Configure the Citrix Gateway for Other Citrix Files Clients.

To configure SAML for wrapped Citrix Files MDX apps:

1. Download the Citrix Content Collaboration for Endpoint Management clients. See Citrix.com downloads.

2. Prepare the Citrix Files mobile app with the MAM SDK. For details, see MAM SDK overview.

3. In the Endpoint Management console, upload the prepared Citrix Files mobile app. For information about uploading MDX apps, see To add an MDX app to Endpoint Management.

4. Verify the SAML settings: Log on to Content Collaboration with the administrator user name and password you configured earlier.

5. Verify that Content Collaboration and Endpoint Management are configured for the same time zone. Ensure that Endpoint Management shows the correct time for the configured time zone. If not, SSO might fail.

Validate the Citrix Files mobile app

1. On the user device, install and configure Secure Hub.

2. From the app store, download and install the Citrix Files mobile app.

3. Start the Citrix Files mobile app. Citrix Files starts without prompting for user name or password.

Validate with Secure Mail

1. On the user device, if it has not already been done, install and configure Secure Hub.

2. From the app store, download, install, and set up Secure Mail.

3. Open a new email form and then tap Attach from ShareFile. Files available to attach to the email are shown without asking for user name or password.

Configure Citrix Gateway for other Citrix Files clients

To configure access for non-wrapped Citrix Files clients, such as the website, Outlook plug-in, or the sync clients: Configure Citrix Gateway to support the use of Endpoint Management as a SAML identity provider as follows.

• Disable home page redirection.
• Create a Citrix Files session policy and profile.
• Configure policies on the Citrix Gateway virtual server.

Disable home page redirection

Disable the default behavior for requests that come through the /cginfra path. That action enables users to see the original requested internal URL instead of the configured home page.

1. Edit the settings for the Citrix Gateway virtual server that is used for Endpoint Management logons. In Citrix Gateway, go to Other Settings and then clear the check box labeled Redirect to Home Page.

   

2. Under ShareFile (now called Content Collaboration), type your Endpoint Management internal server name and port number.

3. Under Citrix Endpoint Management, type your Endpoint Management URL.

   This configuration authorizes requests to the URL you entered through the /cginfra path.

Create a Citrix Files session policy and request profile

Configure these settings to create a Citrix Files session policy and request profile:

1. In the Citrix Gateway configuration utility, in the left-hand navigation pane, click NetScaler Gateway > Policies > Session.

2. Create a session policy. On the Policies tab, click Add.

3. In the Name field, type ShareFile_Policy.

4. Create an action by clicking the + button. The Create NetScaler Gateway Session Profile page appears.

   

   Configure these settings:

   • Name: Type ShareFile_Profile.
   • Click the Client Experience tab and then configure these settings:
     • Home Page: Type none.
     • Session Time-out (mins): Type 1.
     • Single Sign-on to Web Applications: Select this setting.
     • Credential Index: Click PRIMARY.
   • Click the Published Applications tab.

   

   Configure these settings:

   • ICA Proxy: Click On.
   • Web Interface Address: Type your Endpoint Management server URL.

   • Single Sign-on Domain: Type your Active Directory domain name.

     When configuring the Citrix Gateway Session Profile, the domain suffix for Single Sign-on Domain must match the Endpoint Management domain alias defined in LDAP.

5. Click Create to define the session profile.

6. Click Expression Editor.

   

   Configure these settings:

   • Value: Type NSC_FSRD.
   • Header Name: Type COOKIE.

7. Click Create and then click Close.

   

Configure policies on the Citrix Gateway virtual server

Configure these settings on the Citrix Gateway virtual server.

1. In the Citrix Gateway configuration utility, in the left navigation pane, click NetScaler Gateway > Virtual Servers.

2. In the Details pane, click your Citrix Gateway virtual server.

3. Click Edit.

4. Click Configured policies > Session policies and then click Add binding.

5. Select ShareFile_Policy.

6. Edit the auto-generated Priority number for the selected policy so that it has the highest priority (the smallest number) in relation to any other policies listed. For example:

   

7. Click Done and then save the running Citrix Gateway configuration.

Modify the Citrix Files.com SSO settings

Make the following changes for both MDX and non-MDX Citrix Files apps.

Important:

A new number is appended to the internal application name:

• Each time you edit or recreate the Citrix Files app
• Each time you change the Content Collaboration settings in Endpoint Management

As a result, you must also update the Login URL in the Citrix Files website to reflect the updated app name.

1. Log on to your Content Collaboration account (https://<subdomain>.sharefile.com) as a Content Collaboration administrator.

2. In the Content Collaboration web interface, click Admin and then select Configure Single Sign-on.

3. Edit the Login URL as follows:

   Here’s a sample Login URL before the edits: https://xms.citrix.lab/samlsp/websso.do?action=authenticateUser&app=ShareFile_SAML_SP&reqtype=1.

   

   • Insert the Citrix Gateway virtual server external FQDN plus /cginfra/https/ in front of the Endpoint Management server FQDN and then add 8443 after the Endpoint Management FQDN.

     Here’s a sample of an edited URL: https://nsgateway.acme.com/cginfra/https/xms.citrix.lab:8443/samlsp/websso.do?action=authenticateUser&app=ShareFile_SAML_SP&reqtype=1

   • Change the parameter &app=ShareFile_SAML_SP to the internal Citrix Files application name. The internal name is ShareFile_SAML by default. However, every time you change your configuration, a number is appended to the internal name (ShareFile_SAML_2, ShareFile_SAML_3, and so on). You can look up the App internal name on the Configure > Content Collaboration page.

     Here’s a sample of an edited URL: https://nsgateway.acme.com/cginfra/https/xms.citrix.lab:8443/samlsp/websso.do?action=authenticateUser&app=ShareFile_SAML&reqtype=1

   • Add &nssso=true to the end of the URL.

     Here’s a sample of the final URL: https://nsgateway.acme.com/cginfra/https/xms.citrix.lab:8443/samlsp/websso.do?action=authenticateUser&app=ShareFile_SAML&reqtype=1&nssso=true.

4. Under Optional Settings, select the Enable Web Authentication check box.

   

Validate the configuration

Do the following to validate the configuration.

1. Point your browser to https://<subdomain>sharefile.com/saml/login.

   You are redirected to the Citrix Gateway logon form. If you are not redirected, verify the preceding configuration settings.

2. Enter the user name and password for the Citrix Gateway and Endpoint Management environment you configured.

   Your Citrix Files folders at <subdomain>.sharefile.com appear. If you do not see your Citrix Files folders, ensure that you entered the proper logon credentials.