Single Sign-On for Web Access

This guide is intended for IT administrators or individuals configuring Web Access for single sign-on (SSO).

For end user documentation on SSO, see Signing In and Signing Out.

Overview

Web Access offers SSO integration with Okta or with Microsoft Entra ID. SSO integration allows organizations to centralize authentication, enforce security policies, and implement multi-factor authentication (MFA).

When SSO is not configured, users must sign into Web Access using a username and password, typically their Active Directory credentials.

With SSO enabled, users see a “Log in with SSO“ button on the Login page. This button directs them to their identity provider (either Microsoft Entra ID or Okta), where they can authenticate using the credentials and methods established by their organization. After authentication, users' browsers are redirected back to Web Access, where they enter their Active Directory credentials to access Nasuni storage. On subsequent sign-ins via SSO, users do not need to input their Active Directory credentials again.

Alternatively, users can start at their identity provider's portal (Microsoft MyApps or the Okta dashboard). From there, they can click on the Web Access application icon or tile to be logged directly into Web Access.

SSO Configuration

Enabling SSO

SSO for Web Access is enabled and configured through the Nasuni Portal.

Configuration information applies to all Web Access instances within your account. After enabling, all users log into any Web Access instance by first authenticating with their configured identity provider.

When SSO is enabled for an existing instance, all users sign in via the “Sign In with SSO“ button.

The first time a user successfully signs in through SSO, they are prompted to enter their Active Directory credentials. This connects, or links, their SSO identity with the account they use to access Nasuni data.

Anonymous logins through Web Access are denied.

Disabling SSO

When SSO is disabled, users sign in using their Active Directory credentials. They continue to have access to any shared links they created through that Active Directory user when they were signing in through SSO.

Changing SSO Settings

SSO can be enabled and disabled at any time. The identity provider can also be changed at any time.

If SSO settings are changed, in particular if the Client or application ID has changed, the SSO user also changes. The next time the user signs in, they are prompted to enter their Active Directory credentials to link this new SSO user to their Active Directory account.

Linked Users

Multiple SSO users cannot share the same Active Directory credentials. If this happens, the user sees an error message such as:

“These credentials are linked to another user. Please contact your system administrator. (Error WA-1200, Ref ID <uuid>)”

If you believe this is happening in error, contact Nasuni Support.

Nasuni Data API and SSO

Nasuni Data API authentication, which uses the Web Access platform, is not affected by Web Access SSO.

Network requirements

Web Access-enabled appliances must have access to your configured identity servers (HTTPS outbound). If needed, you can configure the appliance to use an HTTPS proxy server. For more information, see HTTPS Proxy Configuration.

No inbound access is required.

SSO Authentication Flow

Web Access SSO uses the OpenID Connect (OIDC) “Authorization Code” flow. When SSO for Web Access is enabled, the login page displays a button titled “Sign in with SSO”. The title of this button can be customized.

When the user clicks the “Sign in with SSO” button, the web browser is redirected to the configured Identity Provider, where the user authenticates. This requires the user to enter their work credentials and typically complete a multi-factor authentication challenge.

A successful SSO authentication redirects the browser back to Web Access. Web Access verifies that the response is legitimate and looks up the authenticated SSO User.

If the SSO user is not linked to an Active Directory user or if the linked Active Directory user credentials are invalid, the user is presented with a page to enter their Active Directory credentials. These are then linked to that SSO user for future sign-ins.

Configuring SSO with Microsoft Entra ID

This section describes the procedure for configuring single sign-on for Web Access using Microsoft Entra ID. This procedure requires configuration steps in both the Microsoft Azure portal and the Nasuni Portal.

For more information on creating a Microsoft Entra application, see Quickstart: Add an enterprise application

System Requirements / Prerequisites

Before getting started, ensure that each of the following requirements has been met.

Registering an Enterprise Application in Azure Portal

Settings Required

Record the following information to complete the Web Access SSO Configuration through the Nasuni Portal.

Starting the application registration

To register an Enterprise Application, follow these steps:

1. Sign in to the Microsoft Entra admin center.

2. Navigate to Entra ID → Enterprise apps → All applications.

3. Click New application.

4. On the Browse Microsoft Entra Gallery page, click Create your own application.

Creating your own application

1. Enter a name for the application, such as “Nasuni Web Access”. This name is used with My Apps, but it is not used by Nasuni otherwise.

2. Click “Register an application to integrate with Microsoft Entra ID“ (app you are developing).

3. Click Create.

Registering an application

1. Select one of the following two choices, which controls who can access the application:

   - Accounts in this organizational directory only.

   - Accounts in any organizational directory (Any Microsoft Entra ID directory – Multitenant).

2. Enter the Redirect URI for the platform. The Platform Type is Web. The URI is in the form:

        https://<WEB_ACCESS_FQDN>/fs/auth/openid/callback

   For example,

       https://webaccess.example.com/fs/auth/openid/callback

3. Click Register to complete the application registration.

Managing single sign-on

The new Azure application is created.

1. Return to the home page.

2. Locate the application via Entra ID → Enterprise apps → All applications.

3. From the enterprise application you created, browse to Manage → Single sign-on.

4. Under Configure application properties, click Go to application.

Overview Essentials

Copy and note the following details:

• Application (client) ID

• Directory (tenant) ID

Adding a client secret

1. Navigate to the Manage → Certificates & secrets tab and click New client secret.

2. Enter a Description such as “Web Access SSO”.

3. Configure the Expiration. Set a reminder for the expiration date, because you must generate a new client secret and provide it to the Portal Web Access SSO User Interface before expiration.

4. Click Add. The secret is created and displayed.

5. Make note of the secret Value before leaving the page.

   Important: Azure only shows the secret value upon creation. You must copy and save the client secret value for this application now.

   Important: Secrets have a configurable lifetime. The Azure default is 6 months, and the maximum allowed is 24 months. When the client secret expires, users are not able to authenticate to Web Access.

6. The next step is to add the application to the My Apps portal.

7. Alternatively, you can skip straight to the last step: Nasuni Portal Configuration.

My Apps Portal (optional)

My Apps (myapps.microsoft.com) is a web-based portal for launching applications that use Microsoft Entra ID. You can add Web Access to the portal so that users in your organization can easily find and open it. When a user clicks the application icon, Web Access is launched directly, skipping the Login page.

This is called an Identity Provider-initiated (IdP-initiated) login because the user logs into the identity provider first and launches the app from the identity provider portal.

For more information, see My Apps portal overview - Microsoft Entra ID.

Adding Web Access to the Microsoft My Apps Portal

For a user to see an application in the portal:

• The application must be set to be visible in its properties.

• The application is assigned to the user or group.

• The application must have a Home page URL.

Setting “Visible to Users” property

1. Return to your application under Entra ID → Enterprise apps.
   If you have signed out:

   1. Open the Microsoft Entra admin center.

   2. Browse to Entra ID → Enterprise apps → All applications.

   3. Open your enterprise application.

2. Change the property:

   1. Browse to Manage → Properties.

   2. Select “Visible to users?” to Yes.

   3. Click Save. The setting turns blue after being saved.

Adding Users

1. Browse to Manage → Users and groups.

2. Click Add user/group to open the Add Assignment page.

3. Under “Users and groups”, select None Selected to open a “Users and groups” dialog.

4. Select the users and/or groups desired. For example, “All Company”. Note the caveat “When you assign a group to an application, only users directly in the group have access. The assignment does not cascade to nested groups.”

5. Click Assign.

Adding the home page URL

1. Return to Single sign-on settings.

   1. Open the Microsoft Entra admin center.

   2. Browse to Entra ID → Enterprise apps → All applications.

   3. Open your enterprise application.

   4. Click Manage → Single sign-on.

2. Under Configure application properties, click Go to application.

3. After navigating to the application, click the Manage → Branding & properties tab.

4. Add a Home page URL of the form:

    https://<WEB_ACCESS_FQDN>/fs

   For example,

    https://webaccess.example.com/fs

Adding a logo (optional)

You can also upload a logo for the My Apps tile.

The recommended image dimensions are 215 x 215 pixels with central image dimensions of 94 x 94 pixels. The file type can be  .bmp, .jpg, or .png. The file size must be less than 100 KB.

Verification

1. Navigate to myapps.microsoft.com to verify that the application is visible.

2. Click the icon to open the application.

3. Verify that the Home URL is correct.

Nasuni Portal Configuration for Microsoft Entra

Configuration information for SSO is entered through the Nasuni Portal.

To enter this information:

1. Log in to the portal portal.nasuni.com as a user with Administrator permission.

2. Navigate to Appliance Services → Web Access → Single Sign-On.

3. For SSO Provider, select “Microsoft”.

4. For Client ID, enter the Microsoft Entra ID Application ID you collected above.

5. For Client Secret, enter the Client Secret you created above.
   You need this again to make changes to these settings.

6. If you are using single-tenant Active Directory, enter your Azure tenant GUID. Otherwise, leave Azure tenant GUID blank. (Enter a single space if you cannot leave the field blank.)

7. (optional) Enter a Login Button label.

8. Click Save.

Portal changes are pulled by the appliances once an hour, so it might take up to an hour for the settings to be reflected on the appliance. To force this step, an administrator can log into the NMC, navigate to the Refresh License page on the Filers tab, select the appliance, and click Refresh subscription license.

Configuring SSO with Okta

Introduction

This section describes the procedure for configuring single sign-on for Web Access using Okta. This procedure requires configuration steps in both the Okta Admin Console and the Nasuni Portal.

System Requirements / Prerequisites

Before getting started, ensure that each of the following requirements has been met.

Creating an Okta App Integration

Okta app integrations are registered connections between the Okta Universal Directory and external apps such as Web Access. App integrations on the Okta End-User Dashboard are sometimes referred to as tiles or apps.

Settings Required

As part of the app integration process, record the following information. This is required to complete the Web Access SSO Configuration through the Nasuni Portal.

Creating a new App Integration in the Okta Admin Console

To create and configure a new Okta App Integration, follow these steps:

1. Log in to the Okta Admin Console.  You might need to select [Admin] after logging into Okta.

2. Using the navigation bar, click Applications → Applications.

3. Click Create App Integration. The following dialog is displayed.

   

4. For the Sign-in method, select OIDC - OpenID Connect.  The Application type panel is displayed.

5. For Application type, select Web Application and click Next. The Application editor is displayed.

6. Click Next. A New Web App Integration page is shown.

   

7. Enter the App Integration name; for example Nasuni Web Access. The name cannot be changed later, and is not used by Nasuni.

8. (Optional) You might choose to set a Logo. This is optional and is not required.

9. For the Grant Type, select Authorization Code and leave Refresh Token unselected.

10. Sign-in redirect URIs:
    https://webaccess.example.com/fs/auth/openid/callback

11. Sign-out redirect URIs:
    https://webaccess.example.com/fs/auth/login

12. In the Trusted Origins section, leave the Base URIs empty.

    

13. In the Controlled access section, select whether to assign the app integration to:

    - Allow everyone in your organization to access. If you select this option, leave the “Enable Access with Federation Broker Mode” option selected.

    - Limit access to selected groups.

    Note: You can assign this option after you create the Okta App Integration.

14. Click Save. A message appears indicating that the Application was created successfully and the wizard closes.

Nasuni Web Access Application

1. The Application “General” tab is selected for the newly created Application.

2. From “Client Credentials”, record the “Client ID”.

3. From “Client Secrets”, click the eye icon to reveal the secret. Record the secret.

The configuration steps in the Okta Admin Console are now complete.

Adding to Okta Dashboard (optional)

The Okta Dashboard is a web-based portal for launching applications that integrate with Okta. You can add Nasuni Web Access to the portal, so that users in your organization can easily find and open it. When a user clicks the application icon, Web Access is launched directly, skipping the Login page.

This is called an Identity Provider-initiated (IdP-initiated) login, because the user logs into the identity provider first and launches the app from the identity provider portal.

1. Locate your app integration under the Okta Admin Console → Applications.

2. Under the General tab, scroll down to General Settings and select Edit.

3. Scroll further down in edit mode:

   1. Change Login initiated by to Either Okta or App.

   2. For Initiate login URI, enter your https://FQDN/fs

   3. Click Save.

Nasuni Portal Configuration for Okta

Configuration information for SSO is entered through the Nasuni Portal.

To enter this information:

1. Log in to the portal portal.nasuni.com as a user with Administrator permission.

2. Navigate to Appliance Services → Web Access → Single Sign-On.

3. For SSO Provider, select Okta.

4. For Client ID, enter the Application Integration Client ID you collected above.

5. For Client Secret, enter the Client Secret you created. You need this again to make changes to these settings.

6. Enter your Okta Base URL. You can find it by signing into your Okta administrator console and looking for your organization's name or domain in the upper-right corner.

7. Enter a Login Button label (optional).

8. Click Save.

Portal changes are pulled by the appliances once an hour, so it might take up to an hour for settings to be reflected on the appliance. To force this step, an administrator can log into the NMC, navigate to the Refresh License page on the Filers tab, select the appliance, and click Refresh subscription license.

Troubleshooting

The purpose of this section is to help you diagnose and remediate uncommon issues with the setup or operation of single-sign on for Nasuni Web Access.

Overview

Web Access SSO uses the OpenID Connect (OIDC) “Authorization Code” flow. The Authorization Code flow is an OAuth 2.0 grant type used by web and native applications to obtain access tokens. It is a secure two-step process that involves redirecting the user to an authorization server, obtaining an authorization code, and then exchanging that code for an access token.

IT administrators register Web Access as a client application through Microsoft Entra or Okta, yielding configuration settings including a client ID and secret. The IT administrator then enters these into Nasuni Portal’s “Web Access SSO” configuration page. These settings are then sent securely to all of an organization’s Nasuni Edge appliances.

If SSO configuration information is present, Web Access offers an SSO Sign-In option rather than a username/password sign-in page. After a user has been “authenticated” through their single sign-on provider, they enter their AD credentials in order to access their CIFS/SMB through Web Access.

SSO Protocol Errors

These errors might be seen during the SSO Login flow.

SSO User Access Codes

SSO Generic Errors

Microsoft Entra Troubleshooting

Okta Troubleshooting