SSO Strategies

An SSOStrategy is a way for users to sign in via another identity provider, such as Okta or Auth0.

It is rare that you will need to use API endpoints for managing these, and we recommend instead managing these via the web interface. Nevertheless, we share the API documentation here.

List SSO Strategies

SDK Method

Files::SsoStrategy.list

Return Object

List<SsoStrategy>

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Site Admin permissions.

Additional Arguments

Example Request

begin
  sso_strategies = Files::SsoStrategy.list
  sso_strategies.auto_paging_each do |sso_strategy|
    # Operate on sso_strategy
  end
rescue Files::NotAuthenticatedError => e
  puts "Authentication Error Occurred (#{e.class.to_s}): " + e.message
rescue Files::Error => e
  puts "Unknown Error Occurred (#{e.class.to_s}): " + e.message
end

Show SSO Strategy

SDK Method

Files::SsoStrategy.find

Return Object

SsoStrategy

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Site Admin permissions.

Method Arguments

ArgumentDescription
id
int64
Required		Sso Strategy ID.

Example Request

begin
  sso_strategy = Files::SsoStrategy.find(id)
  # Operate on sso_strategy
rescue Files::NotAuthenticatedError => e
  puts "Authentication Error Occurred (#{e.class.to_s}): " + e.message
rescue Files::Error => e
  puts "Unknown Error Occurred (#{e.class.to_s}): " + e.message
end

Synchronize provisioning data with the SSO remote server

SDK Method

sso_strategy.sync

Return Object

nil

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Site Admin permissions.

Example Request

begin
  # Find the sso_strategy object by its id.
  sso_strategy = Files::SsoStrategy.find(id)
  sso_strategy.sync
rescue Files::NotAuthenticatedError => e
  puts "Authentication Error Occurred (#{e.class.to_s}): " + e.message
rescue Files::Error => e
  puts "Unknown Error Occurred (#{e.class.to_s}): " + e.message
end

The SsoStrategy Object

Some of the methods above return a SsoStrategy object. The attributes of this object are listed below.

AttributeDescription
protocol
string		SSO Protocol
Possible values: oauth2, saml, active_directory, open_ldap, scim
provider
string		Provider name
Possible values: google, auth0, okta, azure, box, dropbox, slack, onelogin, saml, idaptive, ldap, scim, jumpcloud, duo
label
string		Custom label for the SSO provider on the login page.
logo_url
string		URL holding a custom logo for the SSO provider on the login page.
id
int64		ID
enabled
boolean		Is strategy enabled? This may become automatically set to false after a high number and duration of failures.
user_count
int64		Count of users with this SSO Strategy
saml_provider_cert_fingerprint
string		Identity provider sha256 cert fingerprint if saml_provider_metadata_url is not available.
saml_provider_issuer_url
string		Identity provider issuer url
saml_provider_metadata_content
string		Custom identity provider metadata
saml_provider_metadata_url
string		Metadata URL for the SAML identity provider
saml_provider_slo_target_url
string		Identity provider SLO endpoint
saml_provider_sso_target_url
string		Identity provider SSO endpoint if saml_provider_metadata_url is not available.
scim_authentication_method
string		SCIM authentication type.
Possible values: none, basic, token
scim_username
string		SCIM username.
scim_oauth_access_token
string		SCIM OAuth Access Token.
scim_oauth_access_token_expires_at
string		SCIM OAuth Access Token Expiration Time.
subdomain
string		Subdomain or domain name for your auth provider. Example: https://[subdomain].okta.com/
provision_users
boolean		Auto-provision users?
provision_groups
boolean		Auto-provision group membership based on group memberships on the SSO side?
deprovision_users
boolean		Auto-deprovision users?
deprovision_groups
boolean		Auto-deprovision group membership based on group memberships on the SSO side?
deprovision_behavior
string		Method used for deprovisioning users.
Possible values: disable, delete
provision_group_default
string		Comma-separated list of group names for groups to automatically add all auto-provisioned users to.
provision_group_exclusion
string		Comma-separated list of group names for groups (with optional wildcards) that will be excluded from auto-provisioning.
provision_group_inclusion
string		Comma-separated list of group names for groups (with optional wildcards) that will be auto-provisioned.
provision_group_required
string		Comma or newline separated list of group names (with optional wildcards) to require membership for user provisioning.
provision_email_signup_groups
string		Comma-separated list of group names whose members will be created with email_signup authentication.
provision_readonly_site_admin_groups
string		Comma-separated list of group names whose members will be created as Read-Only Site Admins.
provision_site_admin_groups
string		Comma-separated list of group names whose members will be created as Site Admins.
provision_group_admin_groups
string		Comma-separated list of group names whose members will be provisioned as Group Admins.
provision_attachments_permission
boolean
provision_dav_permission
boolean		Auto-provisioned users get WebDAV permission?
provision_ftp_permission
boolean		Auto-provisioned users get FTP permission?
provision_sftp_permission
boolean		Auto-provisioned users get SFTP permission?
provision_time_zone
string		Default time zone for auto provisioned users.
provision_company
string		Default company for auto provisioned users.
provision_require_2fa
string		2FA required setting for auto provisioned users. use_system_setting uses the site-wide setting, including SSO exemptions. always_require and never_require override the site-wide setting when user-level overrides are allowed.
Possible values: use_system_setting, always_require, never_require
provision_filesystem_layout
string		File System layout to use for auto provisioned users.
Possible values: site_root, user_root, partner_root, integration_centric
provider_identifier
string		URL-friendly, unique identifier for Azure SAML configuration
ldap_base_dn
string		Base DN for looking up users in LDAP server
ldap_domain
string		Domain name that will be appended to LDAP usernames
display_on_login_page
boolean		Should this strategy be displayed on the login page?
ldap_host
string		LDAP host
ldap_host_2
string		LDAP backup host
ldap_host_3
string		LDAP backup host
ldap_port
int64		LDAP port
ldap_provisioning_enabled
boolean		Use LDAP server settings for scheduled provisioning while using this SSO provider for authentication?
ldap_secure
boolean		Use secure LDAP?
ldap_type
string		LDAP server type
Possible values: active_directory, open_ldap
ldap_username
string		Username for signing in to LDAP server.
ldap_username_field
string		LDAP username field
Possible values: sAMAccountName, userPrincipalName