How to enable eduGAIN or InCommon-supported SSO for Dropbox

Updated Nov 17, 2023

Dropbox is a sponsored partner of eduGAIN and InCommon, and supports these standards. This article details how to enable eduGAIN or InCommon-supported single sign-on (SSO) for your Dropbox team account.

What are InCommon and eduGAIN?

eduGAIN

eduGAIN is an interfederation service that enables the secure exchange of identity, authentication and authorization info between participating federations.

InCommon

InCommon Federation, commonly shortened to InCommon, is a framework for trustworthy shared management of access to online resources. It is specific to the US market.

InCommon is often confused as an identity provider (IdP). In reality, InCommon is a protocol that your IdP may support to provide specific security enhancements to abide by the InCommon Standard.

How do I enable supported SSO with eduGAIN or InCommon?

Step 1: Configuring Shibboleth IdP to comply with eduGAIN or InCommon

If you're a Dropbox Education admin, contact your account team and request that they turn on the required eduGAIN or InCommon attribute setting.
Retrieve eduGAIN or InCommon metadata.
- Find metadata listed on the InCommon website.
- Find metadata listed on the eduGAIN website.
Set up the attribute filter.
- For US-based customers, Dropbox accepts the InCommon recommended essential attribute bundle.
  - Dropbox uses the email part of this bundle to identify users
  - Dropbox also requires that the transient ID is released
- Learn how to configure the InCommon essential attribute bundle.
  - In the attribute-filter.xml (/opt/shibboleth-idp/conf/attribute-filter.xml) file, make sure the attribute requester string value is https://dropbox.com/sp.

afp:AttributeFilterPolicy id="DROPBOX_INCOMMON"
       afp:PolicyRequirementRule 
xsi:type="basic:AttributeRequesterString"
          value="https://dropbox.com/sp"/

Step 2: Prepare needed information

To configure SSO in the Dropbox admin console, you'll need two pieces of information: the sign-in URL and the X.509 certificate.

The sign-in URL can be found in the eduGAIN or InCommon metadata under your organization's IdPSSODescriptor, and looks similar to this example:

SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
   Location="https://shibidp.university.edu/idp/profile/SAML2/Redirect/SSO"/

In this case the URL needed for Dropbox is below, which is also the URL that leads to the authentication portal.

https://shibidp.university.edu/idp/profile/SAML2/Redirect/SSO

The X.509 certificate is located in the credentials folder and is usually called idp.crt. A typical file path to this certificate is /opt/shibboleth-idp/credentials/idp.crt.

Step 3: Configure Dropbox admin console

Log in to dropbox.com with your Dropbox admin credentials.
Open the Admin console.
Click Settings.
Under Authentication, select Single sign-on.
Enable SSO in Optional or Required mode. (Optional mode is for testing and Required mode is for production.)
Paste the sign-in URL (collected earlier in this article).
Upload the X.509 certificate (collected earlier in this article).
Under SAML NameID Format, select Transient ID + Email Assertion.