Skip to main content
The SAML page of SafeShare Administration (below) allows: A SafeShare administrator can configure an external Identity Provider (IdP) service (also known as an Identity Assertion Provider) to work with their Cocoon Data Platform instance using Security Assertion Markup Language (SAML) 2.0. (Be aware that the Cocoon Data Platform does not support SAML version 1.0.) Upon successfully establishing this configuration, the Cocoon Data Platform can then delegate the authentication of any Cocoon Data user to this IdP service through a separate URL, thereby providing the Cocoon Data Platform with single sign-on support. (‘Any Cocoon Data user’ includes SafeShare administrators as well as users within an organisation, regardless of the organisation/s they belong to.) Once a user has successfully authenticated to the Cocoon Data Platform’s IdP service, the IdP automatically issues a SAML token (representing this user) back to the Cocoon Data Platform, which in turn exchanges this SAML token for an access/refresh token. Configuring an IdP service on the Cocoon Data Platform has the following requirements:
  • An IdP metadata file - this is a SAML-standard XML file that can be obtained from your IdP service and contains configuration information for 3rd party services (such as the Cocoon Data Platform) to interact with the IdP service itself.
  • The IdP’s email field - Cocoon Data user accounts (on the Cocoon Data Platform) are matched against this user field on the IdP service. Note that this field configuration information may not be part of the IdP metadata file.
  • A private key and public X.509 certificate (for the Cocoon Data Platform) - this X.509 certificate is uploaded (either manually or automatically) to the IdP service, which the IdP service then uses to communicate securely with the Cocoon Data Platform.
    Note: The IdP metadata file also contains a public X.509 certificate for the IdP service, which the Cocoon Data Platform uses to communicate securely with the IdP service.
The Cocoon Data Platform’s Access Service does not support the creation of users on an IdP service. Currently, users on an IdP service will need to be added or updated directly on the IdP itself (for example, through an LDAP server). Be aware that new Cocoon Data user accounts created on the Cocoon Data Platform as a result of adding them either:will not automatically be added to the IdP service.Therefore, if a configured IdP service is enabled on the Cocoon Data Platform, then these users can only authenticate through the Cocoon Data Platform’s own sign-in URL (as opposed to the Cocoon Data Platform’s single sign-on URL that delegates authentication to the IdP service).If, however, these Cocoon Data users subsequently have an equivalent account (i.e. with the same email address) created directly on the IdP service, then these users can take advantage of the Cocoon Data Platform’s single sign-on URL.
IdP/SAML page

​
Adding an IdP service configuration

To add an IdP service configuration to the Cocoon Data Platform:
  1. Ensure you are signed in to SafeShare Administration.
  2. Click the SAML option on the left of the SafeShare Administration interface to open the SAML page.
  3. Click the Add IdP Configuration button.
  4. In the Add IdP Configuration dialog box, complete the IdP service configuration fields described in the table (below).
  5. Click Save and the IdP service configuration will appear on the SAML page.
    Notes:
    • Once the IdP service has been configured successfully, users can then authenticate to the IdP service by specifying into their browser’s URL field, the base URL of your SafeShare for Web instance (which is also the Cocoon Data Platform URL), appended by /sso (for single sign-on) - e.g:
      https://safe-share.xy-company.com/sso
    • To allow your Cocoon Data users to sign out from the IdP service, ensure that the IdP service has been configured to allow this and if necessary, that sufficient instructions are provided to these users on how to sign out from the IdP. Otherwise, your users will continue to be signed in to SafeShare for Web whenever they revisit the single sign-on URL (above) and then click the Single Sign-on button.
    • It is only possible to add one IdP service configuration, which can then be edited below.
The following table describes all IdP-related fields which are required by the Cocoon Data Platform for a successful connection to an IdP service.

​
Editing the IdP service configuration

  1. Ensure you are signed in to SafeShare Administration.
  2. Click the SAML option on the left of the SafeShare Administration interface to open the SAML page.
  3. Click the Edit IdP Configuration link.
  4. In the Edit IdP Configuration dialog box, modify the IdP service configuration fields described in the table (above).
  5. Click Save and the IdP service configuration will be updated.

​
Disabling or re-enabling the IdP service configuration

Disabling the IdP service configuration disables single sign-on capabilities to the Cocoon Data Platform (through this configured IdP service). Therefore, if the IdP service configuration is disabled, users will no longer be able to use the base URL of your SafeShare for Web instance, appended by /sso to sign in to Cocoon Data - e.g: https://safe-share.xy-company.com/sso To disable, enable or re-enable the IdP service configuration:
  1. Ensure you are signed in to SafeShare Administration.
  2. Click the SAML option on the left of the SafeShare Administration interface to open the SAML page.
  3. To:
    • Disable the IdP service configuration - click the (green) Enabled button until it reads Disabled.
    • Enable or re-enable the IdP service configuration - click the (red) Disabled button until it reads Enabled.