MyWorkDrive Support

How can we help you today?

SAML Single Sign On Configuration – Azure AD

You are here:
< Back

MyWorkDrive Azure AD SAML Overview

  MyWorkDrive supports SAML based Web File Manager Single Sign On (SSO) to Azure AD.   For SAML, MyWorkDrive acts as a Service Provider (SP) while the Azure AD acts as the identity provider (IdP).   In a typical scenario customers sync their Active Directory Credentials to Azure AD.  User logins are set to use the same upn suffix to login to Active Directory as they do in Azure AD (in most cases this is the companies Office 365 Subscription). Azure AD SAML MyWorkDrive Single Sign On

MyWorkDrive Azure AD SAML Setup

Before you start: Ensure the MyWorkDrive server is trusted for delegation as per our Delegation Article MyWorkDrive is listed an approved enterprise application in Azure AD – Information link : https://azuremarketplace.microsoft.com/marketplace/apps/aad.myworkdrive?tab=Overview Review the instructions in Microsoft’s tutorial and information links here: Tutorial:   https://docs.microsoft.com/azure/active-directory/saas-apps/myworkdrive-tutorial

Prerequisites

  • Ensure users have a upn suffix applied for domain name to match Azure AD Login name so they can login to your MyWorkDrive server with their email address (most companies sync their Active Directory to the same Azure AD directory that the use to login to Office 365).
  • Ensure the MyWorkDrive server is trusted for delegation as per our Delegation Article
  • Setup your own public SSL Certificate and Hostname pointing to your MyWorkDrive Server over port 443 (SSL) (using our *.myworkdrive.net domain is not supported) and ensure your server is publicly accessible.  View Support Article.

Setup Steps

  • Login to portal.azure.com as admin and connect to Azure AD Domain (if you are using Office 365 this is the same account you use to login to portal.office.com).
  • Click on Azure Active Directory, Enterprise Applications – New Application – Search for “MyWorkDrive” – Add MyWorkDrive as an Enterprise App.

  • Click Single sign-on
  • Enter your reply URL – this will be your host name followed by /SAML/AssertionConsumerService.aspx for example: https://yourserver.yourdomain.com/SAML/AssertionConsumerService.aspx If you intend to support multiple domain names for the server – such as both a Cloud Web Connector and Direct connection address, be sure to enter all of them as possible reply/response URLs.
  • Enter your sign-on URL if users will be logging on to MyWorkDrive directly (instead of accessing through myapps.microsoft.com portal) with your host name followed by: /Account/login-saml  for example:  https://yourserver.yourdomain.com/Account/login-saml.  Note that this is technically optional as you can retain a traditional login while only providing SSO as an option.
  • Single logout URL.  If you wish to use single logout, set your logout URL as https://yourserver.yourdomain.com/SAML/SLOService.aspx Note the additional information below about how AzureAD handles single logout.
  • Accept the default Entity ID of “MyWorkDrive” (This only needs to be changed if you have multiple MyWorkDrive Servers setup in your Azure AD configured Manually).
  • Set to allow all users to access the app by setting the SAML App properties “User Assignment Required” to No.OR     Assign users and groups in Azure Active Directory portal to the new MyWorkDrive App (Enterprise applications – All applications – MyWorkDrive – Single sign-on -SAML-based sign-on)           users and groups.  Note Domain Users groups do not sync to Azure AD by default. 
  • Copy the App Federation Signing Certificate Metadata URL to the clipboard.

  • On the MyWorkDrive Server in the admin panel, Enterprise Section, Enable SAML/ADFS SSO, Choose Azure AD SAML and paste in the Azure App Federation Metadata URL. Optionally click “Require SSO Login” (this will automatically redirect all connections to Azure AD SAML Login).  Click Save.  This will automatically pull down the Azure AD SSL Certificate and settings for you.

 

Test Access

Browse to the Azure user access URL specified in the application properties for direct access to the application e.g. https://yourserver.company.com.   If you set Azure AD SAML to required it will redirect the user automatically to /account/login-saml,  If not you will need to specify the full url e.g. https://yourserver.company.com/account/login-saml.  Login using Azure AD.  After successful login your test user will be redirected by the your MyWorkDrive Web Site and their assigned file shares will be displayed. Alternatively, if you are assigning users to the App in Azure AD you may browse to https://myapps.microsoft.com.  Login to Azure AD. Select the MyWorkDrive application.   The user is automatically logged into your MyWorkDrive browser Web File Manager.

SAML Logout

Azure Active Directory doesn’t support SAML logout. SP-initiated SLO, where a SAML logout request is sent to Azure AD, doesn’t cause a logout response to be returned. Instead, Azure AD displays a message indicating the user is logged out and that the browser windows should be closed. Logout from Azure AD doesn’t cause a logout request to be sent to the service provider. Azure AD doesn’t support configuring a SAML logout service URL for the service provider.

Troubleshooting

  • Ensure you are using a browser for testing in-private or incognito to eliminate any caching issues
  • Double check that user is able to login without SAML and they are using an email address that matches their UPN in Active Directory
  • User receives error: The signed in user [email protected] is not assigned a role for the application – as per setup notes above: Assign a user or group they are a member of in Azure Active Directory portal to the new MyWorkDrive App (Enterprise applications – All applications – MyWorkDrive – Single sign-on -SAML-based sign-on) users and groups or disable the user assignment required by setting it to no.
  • Folders are displaying as blank after logging user in:  Ensure the MyWorkDrive server is trusted for delegation as per our Delegation Article
  • User receives error: The reply URL specified in the request does not match the reply URL’s configured for the application – Check to ensure the URL specified in Azure AD SAML matches the public web address of the server and if reverse proxies are used they are not re-writing the URL.  Additionally if you are using your own hostname – e.g. https://yourserver.yourdomain.com be sure to disable the MyWorkDrive Cloud Web Connect under settings on your MyWorkDrive server (when the Cloud Web Connector is enabled we assume your using our *.myworkdrive.net and make changes to the reply URL to accommodate it).

 

 

SAML Single Sign On Configuration – Okta Outlook Online File Sharing