Skip to main content
A Safe Share administrator can configure an external Identity Provider (IdP) service (also known as an Identity Assertion Provider) to work with their Covata Platform instance using Security Assertion Markup Language (SAML) 2.0. (Be aware that the Covata Platform does not support SAML version 1.0.) Upon successfully establishing this configuration, the Covata Platform can then delegate the authentication of any Covata user to this IdP service through a separate URL, thereby providing the Covata Platform with single sign-on support. (‘Any Covata user’ includes Safe Share administrators as well as users within an organization, regardless of the organization/s they belong to.) Once a user has successfully authenticated to the Covata Platform’s IdP service, the IdP automatically issues a SAML token (representing this user) back to the Covata Platform, which in turn exchanges this SAML token for an access/refresh token. Configuring an IdP service on the Covata Platform has the following requirements:
  • An IdP metadata file - this is a SAML-standard XML file that can be obtained from your IdP service and contains configuration information for 3rd party services (such as the Covata Platform) to interact with the IdP service itself.
  • The IdP’s email field - Covata user accounts (on the Covata Platform) are matched against this user field on the IdP service. Note that this field configuration information may not be part of the IdP metadata file.
  • A private key and public X.509 certificate (for the Covata Platform) - this X.509 certificate is uploaded (either manually or automatically) to the IdP service, which the IdP service then uses to communicate securely with the Covata Platform.
    Note: The IdP metadata file also contains a public X.509 certificate for the IdP service, which the Covata Platform uses to communicate securely with the IdP service.
The Covata Platform’s Access Service does not support the creation of users on an IdP service. Currently, users on an IdP service will need to be added or updated directly on the IdP itself (for example, through an LDAP server). Be aware that new Covata user accounts created on the Covata Platform as a result of adding them either:will not automatically be added to the IdP service.Therefore, if a configured IdP service is enabled on the Covata Platform, then these users can only authenticate through the Covata Platform’s own sign-in URL (as opposed to the Covata Platform’s single sign-on URL that delegates authentication to the IdP service).If, however, these Covata users subsequently have an equivalent account (i.e. with the same email address) created directly on the IdP service, then these users can take advantage of the Covata Platform’s single sign-on URL.
IdP/SAML page

​
Configuring an IdP service

The SAML page of Safe Share Administration (above) allows:

​
Adding an IdP service configuration

To add an IdP service configuration to the Covata Platform:
  1. Sign in to Safe Share Administration.
  2. Click the SAML option on the left of the Safe Share Administration interface to open the SAML page.
  3. Click the Add IdP Configuration button.
  4. In the Add IdP Configuration dialog box, complete the IdP service configuration fields described in the table (below).
  5. Click Save and the IdP service configuration will appear on the SAML page.
    Notes:
    • Once the IdP service has been configured successfully, users can then authenticate to the IdP service by specifying into their browser’s URL field, the base URL of your Safe Share for Web instance (which is also the Covata Platform URL), appended by /sso (for single sign-on) - e.g:
      https://safe-share.xy-company.com/sso
    • To allow your Covata users to sign out from the IdP service, ensure that the IdP service has been configured to allow this and if necessary, that sufficient instructions are provided to these users on how to sign out from the IdP. Otherwise, your users will continue to be signed in to Safe Share for Web whenever they revisit the single sign-on URL (above) and then click the Single Sign-on button.
    • It is only possible to add one IdP service configuration, which can then be edited below.
The following table describes all IdP-related fields which are required by the Covata Platform for a successful connection to an LDAP server/user directory.

​
Editing the IdP service configuration

  1. Sign in to Safe Share Administration.
  2. Click the SAML option on the left of the Safe Share Administration interface to open the SAML page.
  3. Click the Edit IdP Configuration link.
  4. In the Edit IdP Configuration dialog box, modify the IdP service configuration fields described in the table (above).
  5. Click Save and the IdP service configuration will be updated.

​
Disabling or re-enabling the IdP service configuration

Disabling the IdP service configuration disables single sign-on capabilities to the Covata Platform (through this configured IdP service). Therefore, if the IdP service configuration is disabled, users will no longer be able to use the base URL of your Safe Share for Web instance, appended by /sso to sign in to Covata - e.g: https://safe-share.xy-company.com/sso To disable, enable or re-enable the IdP service configuration:
  1. Sign in to Safe Share Administration.
  2. Click the SAML option on the left of the Safe Share Administration interface to open the SAML page.
  3. To:
    • Disable the IdP service configuration - click the (green) Enabled button until it reads Disabled.
    • Enable or re-enable the IdP service configuration - click the (red) Disabled button until it reads Enabled.