Start free trial

Foldr as a Service Provider (SP) with Okta SSO

Updated 6 Feb 2026 Authentication & Security

The Foldr server can operate as a SAML single sign-on Identity Provider (IdP) or Service Provider (SP).

When acting as the Service Provider, the user is redirected to a third-party IdP such as Active Directory Federation Services, Microsoft Entra ID, Google or Okta to sign in before being directed back to the Foldr app ready to access their files. If the user is already signed into their IdP (Okta in this case), Foldr web app users will sign in automatically.

Security considerations: service accounts and user passwords for SMB share access

Active Directory and traditional Windows file services have no concept of SAML or SSO access tokens, so when users sign into Foldr without directly providing their password to the system, Foldr cannot provide the usual granular ACL / security permission access to shares for that user. There are two ways to address this:

  1. Use pre-defined service accounts in Foldr Settings and connect to each configured share with a master service account, ensuring ‘Use service account for all access’ is selected on the share configuration screen. This approach does not allow Foldr to respect a user’s actual security permissions; access follows the permissions that apply to the service account. The administrator can still control read or write access to each share for the service account using the share permissions in Foldr Settings > Shares.

  2. (Recommended) Prompt users for their password the first time they access the system by SSO. Once Foldr has the user’s password, it is encrypted, stored within the configuration database and used for future sessions. With this approach service accounts are not required for SMB share access and Foldr operates in the normal manner, respecting all existing security ACLs on the file servers providing the shares. Enable the prompt for network credentials feature when enabling the SSO service within Foldr Settings > Single Sign-On > Service Provider.

Setup process

  1. Ensure Foldr is publicly accessible and that a signed SSL certificate is installed on the server. If you do not already have an SSL certificate, consider using the built-in support for Let’s Encrypt to obtain one at no cost.

  2. Sign into the Okta Admin portal using your administrative credentials and click Applications > Applications in the left-hand panel.

  3. Click Create App Integration.

  4. Select SAML 2.0 and click Next.

  5. Give the app a suitable name, optionally provide an icon and click Next.

  6. In the Configure SAML tab, configure the Single sign-on URL and Audience URI fields as follows, replacing address-of-foldr with the external / public address of the Foldr server:

Single sign-on URL = https://address-of-foldr/sso/sp/acs

Audience URI = https://address-of-foldr/sso/sp/

  1. All other SAML settings on this tab can be left at their defaults. Click Next.

  2. In the Feedback tab, either provide Okta with feedback for the Foldr integration or simply select This is an internal app that we have created, then click Finish.

  3. The SAML summary screen will be displayed. Click More details.

  4. Copy the Sign on URL, Sign out URL and Issuer values.

  5. Download the Okta Signing Certificate.

  6. Navigate to Foldr Settings > Single Sign On > Service Provider and enable the toggle Use external Identity Provider.

  7. Select the required user redirection setting from the dropdown:

Redirect all LDAP users: users enter their Active Directory username into the Foldr sign-in UI first, and if the user is found in Active Directory they are redirected to Okta.

Redirect selected users & groups: the administrator selects which Active Directory or local Foldr users and groups will be redirected to Okta.

Redirect all users: the Foldr sign-in page is not shown and all users are automatically redirected to Okta to sign in.

  1. Paste the Okta-supplied Sign on URL, Sign out URL and Issuer values into the corresponding fields in Foldr Settings.

  2. Open the Okta signing certificate downloaded at step 11 in a text editor and paste the certificate into the Validation Certificate box in Foldr Settings.

  3. Click Save Changes.

  4. Navigate back to Okta, select Applications > Applications and edit the Foldr app created for the SSO integration. Click Assignments.

  5. Click Assign > Assign to People or Assign to Group as required, and search for the users or groups that should have access to Foldr. In this example we are assigning the Foldr app integration to the built-in ‘Everyone’ group.

Screenshot: Setup process

  1. After selecting the required user(s) or group, click Assign. The summary panel will update to reflect your selection.

The SSO integration is now complete. A user attempting to sign into Foldr should be redirected to Okta’s sign-in page based on the user redirection setting selected at step 13. After signing into Okta, and passing their MFA if enabled, the user is automatically redirected to Foldr and presented with their storage locations in the interface.

If the user is new to the Foldr server and the ‘Prompt LDAP users for network credentials’ toggle was enabled in Foldr Settings > Single Sign On > Service Provider, the user will be prompted to provide their Active Directory password to access SMB shares.

App compatibility

Okta SAML 2.0 single sign-on is supported in all Foldr apps (web, mobile and desktop) providing the ‘web sign-in’ feature is enabled on the server within Foldr Settings > Devices & Clients. Web sign-in is on by default for all app types.

← All articles