Single Sign-On

Single Sign-On (SSO) allows users to log into MetaDefender Managed File Transfer without having to enter the active directory credentials or creating a local account. Enabling SSO is available for Identity Providers (IdP) supporting the OpenID Connect protocol.

For a step-by-step tutorial, refer to:

Requirements

Below are the technical requirements of MetaDefender® MFT supporting SSO.

Technical Details

SSO Details
ProtocolOpenID Connect
Authorization FlowAuthorization Code Flow
Required Scopesopenid , profile ,email
Response Mode

code and state in either:

  • OAuth 2.0 Form Post Response Mode
  • query Response Mode

Claims

Following are the claims used to propagate user details in MetaDefender® MFT. Claims are resolved in the following sequence, with the first claim found determining the value for the corresponding user detail.

Either the upn or the name claim is required; when neither exists, authentication will fail.
User DetailClaim(s)
User Name
  1. upn
  2. preferred_username
  3. name
Display Name
  1. unique_name
  2. name
Given Name
  1. given_name
Surname
  1. family_name
Email Address
  1. email
  2. upn

If details can not be populated due to missing claims, their values will be left empty.

Configuration

In order to set up single sign-on, go to "Settings" → "Single Sign-On."

NameDescription
Enable SSOTurn SSO integration on/off
Ignore TLS CertificateAccept requests from the IdP even if the certificate is not fully trusted
Load User ProfileAttempt to retrieve user claims by calling the/userinfo endpoint
Skip Endpoint ValidationIf enabled, the authority of the OpenID endpoints are not validated against the issuer; Find th__is information in the /.well-known/openid-configuration endpoint of the SSO provider.
Provider NameA friendly name that identifies the IdP in Managed File Transfer
AuthorityThe URL of the IdP
IP Address Or DomainThe IP or domain of the Managed File Transfer instance used to construct the Redirect URL
Redirect URIThe generated URL where users are redirected by the IdP after authentication
Client IDA unique identifier assigned by the identity provider to registered clients
Client SecretA randomly generated sequence issued by the identity provider and used in client authorization
Administrator EmailsA list of email addresses used for assigning administrative privileges to their owners ("administrator" role in Managed File Transfer)
Integration Scopes (Optional)A list of optional scopes for making requests to the IdP
Additional endpoints (Optional)Specifies a list of additional base addresses for endpoints

There is no technical limit to the number of Single Sign-On (SSO) users. Only the license user limit serves as a restriction.
Type to search, ESC to discard
Type to search, ESC to discard
Type to search, ESC to discard
Next to read:
Integrate with Okta
On This Page
Single Sign-OnRequirementsTechnical DetailsClaimsConfiguration