Product documentation
XenMobile Server
View PDF

SAML for single sign-on with Citrix Files

December 7, 2023
Contributed by: 
K K C

You can configure XenMobile and ShareFile to use the Security Assertion Markup Language (SAML) to provide single sign-on (SSO) access to Citrix Files mobile apps. This functionality includes:

  • Citrix Files apps that are MAM SDK enabled or wrapped by using the MDX Toolkit

  • Non-wrapped Citrix Files clients, such as the website, Outlook plug-in, or sync clients

  • For wrapped Citrix Files apps. Users who log on to Citrix Files through the Citrix Files mobile app are redirected to Secure Hub for user authentication and to acquire a SAML token. After successful authentication, the Citrix Files mobile app sends the SAML token to ShareFile. After the initial logon, users can access the Citrix Files mobile app through SSO. They can also attach documents from ShareFile to Secure Mail mails without logging on each time.
  • For non-wrapped Citrix Files clients. Users who log on to Citrix Files using a web browser or other Citrix Files client are redirected to XenMobile. XenMobile authenticates the users, who then acquire a SAML token which is sent to ShareFile. After the initial logon, users can access Citrix Files clients through SSO without logging on each time.

To use XenMobile as a SAML identity provider (IdP) to ShareFile, you must configure XenMobile to use with Enterprise accounts, as described in this article. Alternatively, you can configure XenMobile to work only with storage zone connectors. For more information, see Use ShareFile with XenMobile.

For a detailed reference architecture diagram, see Architecture.

Prerequisites

Complete the following prerequisites before you can configure SSO with XenMobile and Citrix Files apps:

  • The MAM SDK or a compatible version of the MDX Toolkit (for Citrix Files mobile apps).

    For more information, see XenMobile compatibility.

  • A compatible version of Citrix Files mobile apps and Secure Hub.
  • ShareFile administrator account.
  • Connectivity verified between XenMobile and ShareFile.

Configure ShareFile access

Before setting up SAML for ShareFile, provide ShareFile access information as follows:

  1. In the XenMobile web console, click Configure > ShareFile. The ShareFile configuration page appears.

    ShareFile configuration settings

  2. Configure these settings:

    • Domain: Type your ShareFile subdomain name. For example: example.sharefile.com.
    • Assign to delivery groups: Select or search for the delivery groups that you want to be able to use SSO with ShareFile.
    • ShareFile Administrator Account Logon
    • User name: Type the ShareFile administrator user name. This user must have administrator privileges.
    • Password: Type the ShareFile administrator password.
    • User account provisioning: Leave this setting disabled. Use the ShareFile User Management Tool for user provisioning. See Provision user accounts and distribution groups.

  3. Click Test Connection to verify that the user name and password for the ShareFile administrator account authenticate to the specified ShareFile account.

  4. Click Save.

    • XenMobile syncs with ShareFile and updates the ShareFile settings ShareFile Issuer/Entity ID and Login URL.

    • The Configure > ShareFile page shows the App internal name. You need that name to complete the steps described later in Modify the Citrix Files.com SSO settings.

Set up SAML for Wrapped Citrix Files MDX Apps

You don’t need to use Citrix Gateway for single sign-on configuration with wrapped Citrix Files MDX apps. To configure access for non-wrapped Citrix Files clients, such as the website, Outlook plug-in, or the sync clients, see Configure the Citrix Gateway for Other Citrix Files Clients.

The following steps apply to iOS and Android apps and devices. To configure SAML for wrapped Citrix Files MDX apps:

  1. With the MDX Toolkit, wrap the Citrix Files mobile app. For more information about wrapping apps with the MDX Toolkit, see Wrapping Apps with the MDX Toolkit.

  2. In the XenMobile console, upload the wrapped Citrix Files mobile app. For information about uploading MDX apps, see To add an MDX app to XenMobile.

  3. Verify the SAML settings: Log on to ShareFile with the administrator user name and password you configured earlier.

  4. Verify that ShareFile and XenMobile are configured for the same time zone. Ensure that XenMobile shows the correct time for the configured time zone. If not, the SSO might fail.

Validate the Citrix Files mobile app

  1. On the user device, install and configure Secure Hub.

  2. From the XenMobile Store, download and install the Citrix Files mobile app.

  3. Start the Citrix Files mobile app. Citrix Files starts without prompting for user name or password.

Validate with Secure Mail

  1. On the user device, if it has not already been done, install and configure Secure Hub.

  2. From the XenMobile Store, download, install, and set up Secure Mail.

  3. Open a new email form and then tap Attach from Citrix Files. Files available to attach to the email are shown without asking for a user name or password.

Configure the Citrix Gateway for Other Citrix Files Clients

To configure access for non-wrapped Citrix Files clients, such as the website, Outlook plug-in, or the sync clients: Configure Citrix Gateway to support the use of XenMobile as a SAML identity provider as follows.

  • Disable home page redirection.
  • Create a Citrix Files session policy and profile.
  • Configure policies on the Citrix Gateway virtual server.

Disable home page redirection

Disable the default behavior for requests that come through the /cginfra path. That action enables users to see the original requested internal URL instead of the configured home page.

  1. Edit the settings for the Citrix Gateway virtual server that is used for XenMobile logons. In Citrix ADC, go to Other Settings and then clear the checkbox labeled Redirect to Home Page.

    Citrix ADC screen

  2. Under ShareFile (now called ShareFile), type your XenMobile internal server name and port number.

  3. Under Citrix Endpoint Management, type your XenMobile URL. Your version of Citrix Gateway can refer to the older product name AppController.

    This configuration authorizes requests to the URL that you entered through the /cginfra path.

Create a Citrix Files session policy and request profile

Configure these settings to create a Citrix Files session policy and request profile:

  1. In the Citrix Gateway configuration utility, in the left-hand navigation pane, click Citrix Gateway > Policies > Session.

  2. Create a session policy. On the Policies tab, click Add.

  3. In the Name field, type ShareFile_Policy.

  4. Create an action by clicking the + button. The Create Session Profile page appears.

    Citrix Gateway Session Profile screen

    Configure these settings:

    • Name: Type ShareFile_Profile.
    • Click the Client Experience tab and then configure these settings:
      • Home Page: Type none.
      • Session Time-out (mins): Type 1.
      • Single Sign-on to Web Applications: Select this setting.
      • Credential Index: Click PRIMARY.
    • Click the Published Applications tab.

    Citrix Gateway Session Profile screen

    Configure these settings:

    • ICA Proxy: Click ON.
    • Web Interface Address: Type your XenMobile Server URL.

    • Single Sign-on Domain: Type your Active Directory domain name.

      When configuring the Citrix Gateway Session Profile, the domain suffix for Single Sign-on Domain must match the XenMobile domain alias defined in LDAP.

  5. Click Create to define the session profile.

  6. Click Expression Editor.

    Citrix Gateway Session Profile screen

    Configure these settings:

    • Value: Type NSC_FSRD.
    • Header Name: Type COOKIE.

  7. Click Create and then click Close.

    Citrix Gateway Session Profile screen

Configure policies on the Citrix Gateway virtual server

Configure these settings on the Citrix Gateway virtual server.

  1. In the Citrix Gateway configuration utility, in the left navigation pane, click Citrix Gateway > Virtual Servers.

  2. In the Details pane, click your Citrix Gateway virtual server.

  3. Click Edit.

  4. Click Configured policies > Session policies and then click Add binding.

  5. Select ShareFile_Policy.

  6. Edit the auto-generated Priority number for the selected policy so that it has the highest priority (the smallest number) in relation to any other policies listed. For example:

    VPN Virtual Server Session Policy Binding screen

  7. Click Done and then save the running Citrix ADC configuration.

Modify the Citrix Files.com SSO settings

Make the following changes for both MDX and non-MDX Citrix Files apps.

Important:

A new number is appended the internal application name:

  • Each time you edit or recreate the Citrix Files app
  • Each time you change the ShareFile settings in XenMobile

As a result, you must also update the Login URL in the Citrix Files website to reflect the updated app name.

  1. Log on to your ShareFile account (https://<subdomain>.sharefile.com) as a ShareFile administrator.

  2. In the ShareFile web interface, click Admin and then select Configure Single Sign-on.

  3. Edit the Login URL as follows:

    Here’s a sample Login URL before the edits: https://xms.citrix.lab/samlsp/websso.do?action=authenticateUser&app=ShareFile_SAML_SP&reqtype=1.

    Sample Login URL

    • Insert the Citrix Gateway virtual server external FQDN plus /cginfra/https/ in front of the XenMobile Server FQDN and then add 8443 after the XenMobile FQDN.

      Here’s a sample of an edited URL: https://nsgateway.acme.com/cginfra/https/xms.citrix.lab:8443/samlsp/websso.do?action=authenticateUser&app=SHareFile_SAML_SP&reqtype=1

    • Change the parameter &app=ShareFile_SAML_SP to the internal Citrix Files application name. The internal name is ShareFile_SAML by default. However, every time you change your configuration, a number is appended to the internal name (ShareFile_SAML_2, ShareFile_SAML_3, and so on). You can look up the App internal name on the Configure > ShareFile page.

      Here’s a sample of an edited URL: https://nsgateway.acme.com/cginfra/https/xms.citrix.lab:8443/samlsp/websso.do?action=authenticateUser&app=ShareFile_SAML&reqtype=1

    • Add &nssso=true to the end of the URL.

      Here’s a sample of the final URL: https://nsgateway.acme.com/cginfra/https/xms.citrix.lab:8443/samlsp/websso.do?action=authenticateUser&app=ShareFile_SAML&reqtype=1&nssso=true.

  4. Under Optional Settings, select the Enable Web Authentication checkbox.

    Optional Settings screen

Validate the configuration

Do the following to validate the configuration.

  1. Point your browser to https://<subdomain>sharefile.com/saml/login.

    You are redirected to the Citrix Gateway logon form. If you are not redirected, verify the preceding configuration settings.

  2. Enter the user name and password for the Citrix Gateway and XenMobile environment that you configured.

    Your Citrix Files folders at <subdomain>.sharefile.com appear. If you do not see your Citrix Files folders, ensure that you entered the proper logon credentials.

SAML for single sign-on with Citrix Files
December 7, 2023
Contributed by: 
K K C
December 7, 2023
Contributed by: 
K K C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.