In the Tenant Configuration section of the Account Manager tool, Account Admins can set up and manage single sign-on (SSO) integrations for their users. Once an SSO integration is enabled, users can log in using their SSO credentials—eliminating the need to remember yet another password and enhancing security for your IT network.
This integration should be set up and maintained by a seasoned IT professional.
Note
Self-serve setup is only supported via OpenID Connect (OIDC). To set up or update a SAML integration, reach out to Filevine support.
Overview
OpenID Connect (OIDC) is a modern, lightweight protocol for SSO. Unlike SAML, OIDC works on keys which are rotated dynamically—without interruptions requiring manual intervention.
You can set up one or multiple SSO integrations, depending on your requirements and user base. For example, you might have one identity provider for badged employees, and another for contractors. You can set up an integration for both providers, and each one can be enabled, updated, or disabled independently of the other.
If your organization is currently using a SAML integration, and you want to switch to OIDC, follow the steps below to set up the OIDC integration first. That way, you can test out the integration without disrupting users’ current login path.
After setting up the OIDC integration, instruct your users to start using the new button. When you are confident that the new integration is working as expected, reach out to Filevine support to disable the SAML integration.
Setup
Navigate to the Account Manager and select the Tenant Configuration section. Under the SSO Identity Provider header, click + Add Identity Provider.
In the Add Identity Provider screen, follow the steps below.
Step 1: Protocol
Select OpenID Connect (OIDC). Click Continue.
Step 2: Register Filevine
Register the Filevine application in your identity provider, entering the values displayed on this screen where applicable.
For guidance on where to enter these values, refer to your specific provider. If you are using one of the following providers, take a look at their instructions for OIDC setup:
If your identity provider requires the Redirect URI upfront, use the placeholder value shown here. The final Redirect URI will be generated later in this process.
When finished, click Continue.
Step 3: Configuration
Once you have registered Filevine with your identity provider, it will generate the Client ID and Client Secret. Enter those values in the respective fields on this screen.
Enter your provider’s Discovery URL. All identity providers have a discovery URL that follows a standard format, ending with: /.well-known/openid-configuration
Users will login by clicking Sign in with [Button text] on the login screen. In the Button text field on this screen, enter the desired text. For example, you could enter the name of the provider (Okta, Ping, etc), the applicable user group (Employee SSO, Contractor SSO, etc), or something else.
The button text will also be the integration’s name in the SSO Identity Provider list.
When finished, click Continue.
Step 4: Your Final Redirect URL
Copy the Final Redirect URL and Sign-Out Redirect URL displayed here and paste them in your identity provider. If you used the placeholder Redirect URI from Step 2, the Final Redirect URL will replace it.
When finished click Enable.
You’ll see a message confirming whether the provider was successfully enabled. The provider’s Button text from Step 3 will be listed underneath the SSO Identity Provider header.
On the login screen, users can click Sign in with [Button text]. This action directs the user to the login screen for the identity provider. Once the user is authenticated, they are redirected back to Filevine.
Tip
If a user has already signed in to the identity provider on their browser, they’ll be signed in immediately after clicking this button.
Manage
Under the SSO Identity Provider header, all registered identity providers are listed, including their name (button text), creation date, and protocol type (OIDC or SAML).
To edit or disable a SAML provider, reach out to Filevine support.
To edit or disable an OIDC provider, click Edit next to the provider. In the Edit Identity Provider screen, you can view or edit the following fields:
- Client ID: enter a new ID, or leave blank to keep the current ID.
- Client Secret: enter a new secret, or leave blank to keep the current secret.
- Discovery URL: view the existing URL, or update the URL.
- Button Text: view or update the button displayed to users on the login page. This text also functions as the provider name in the SSO Identity Provider list.
- Final Redirect URL: view or copy the URL where users are redirected after signing in.
- Sign-Out Redirect URL: view or copy the URL where users are redirected after signing out.
When finished, click Save. You’ll see a message confirming whether the provider was successfully updated.
To disable the provider, click Disable. In the confirmation modal, click Disable again. You’ll see a message confirming whether the provider was successfully disabled.
The login path for this provider will no longer work, the button will no longer display on the login page, and the provider will show a Disabled tag in the SSO Identity Provider list. However, the configuration is preserved and can easily be re-enabled in the future if desired.
Heads Up!
Users who either have an active session or have bookmarked the Filevine URL may still be able to access Filevine via the disabled provider for a few days. If you need to revoke a user’s access entirely, follow the steps in the Add or Remove Members article.
To re-enable a disabled provider, click Edit next to the provider. Scroll down and click Enable. You’ll see a message confirming whether the provider was successfully enabled.
The login path for this provider will be reinstated, the button will reappear on the login page, and the Disabled tag will be removed from the provider in the list.
Comments
0 comments
Article is closed for comments.