Single Sign-On (SSO)
Configure SAML 2.0 single sign-on for Business Premium and Enterprise deployments — service-provider values, identity provider setup, provisioning, and recovery.
Last updated July 17, 2026
#Availability
FileAgent SSO uses SAML 2.0 and is available on Business Premium and Enterprise. Administrators configure it under Settings → System Configuration → Security & Access → Single Sign-On.
If a license is downgraded below a plan that includes SSO, the configuration is preserved but SSO stops applying until an eligible license is active again. Local administrator sign-in remains available so you can always recover access.
#Service provider values
FileAgent is the SAML service provider. Use the base URL administrators actually use, including HTTPS and the port if you set a custom one.
| Setting | Value |
|---|---|
| ACS / Reply URL | https://fileagent.example.com/auth/sso/acs |
| Entity ID / Audience | https://fileagent.example.com/auth/sso/metadata |
| SP metadata URL | https://fileagent.example.com/auth/sso/metadata |
| Binding | HTTP-POST |
The Entity ID can be overridden in the SSO settings when your IdP requires a specific audience value. SAML URLs must use HTTPS.
#Identity provider configuration
Configure FileAgent as a SAML 2.0 application in your identity provider. Standard providers are supported, including Microsoft Entra ID, Okta, ADFS, OneLogin, Google Workspace SAML apps, and other generic SAML 2.0 IdPs. FileAgent does not use OIDC/OpenID Connect for SSO.
In FileAgent, enter the IdP issuer/entity ID, sign-in URL, and signing certificate (or metadata) supplied by your IdP. Signed SAML documents are required, SHA-1 signatures are rejected, and assertions are validated for issuer, audience, destination, recipient, time window, and replay protection.
#Provisioning and roles
SSO identifies users by normalized email address. Auto-provisioning is off by default. When enabled, new SSO users can be assigned a default role, restricted to allowed email domains or group claims, and mapped from IdP groups to FileAgent roles. Job-scoped access and archive permissions continue to apply after SSO sign-in, so identity (authentication) and FileAgent permissions (authorization) stay separate controls.
#Local sign-in and Force SSO
SAML SSO, LDAP sign-in, and local accounts can coexist. The sign-in screen shows SSO when it's enabled, configured, and licensed; administrators set the default login method. Force SSO can require standard users to sign in through the identity provider, while administrator local sign-in remains available as a recovery path unless an administrator explicitly disables that fallback.