ShareFile Technical Presentation

Transcription

1 ShareFile Technical Presentation Joerg Vosse Senior Systems Engineer - Citrix ShareFile CEE joerg.vosse@citrix.com

2 ShareFile Enterprise Architecture Overview

3 ShareFile Document Cloud ShareFile.com ShareFile.eu SaaS application Clients Documents

4 ShareFile Document Cloud ShareFile.com ShareFile.eu SaaS application Business logic Web application Reporting Clients Mobile, Windows, Outlook, OS X, Web XenDesktop / XenApp Mobile Office Editor XenMobile DLP Policies Documents Citrix-managed Customer-managed Existing repositories

5 ShareFile Document Cloud Architecture Clients Authentication Sharefile integrated SAML 2.0 IdP Authorization Authorization SaaS Application USA or Europe Business Logic Web Application Reporting Document Storage Citrix-Managed Customer-Managed Existing Repositories

6 ShareFile Enterprise Clienttools Overview

7 Files & Folders available on any device

8 ShareFile Web User Interface

9 ShareFile Windows Synctool (Explorer)

10 ShareFile Mac Synctool (Finder)

11 ShareFile Outlook Plug-in Send or request files from Outlook using ShareFile plug-in Control attachment policy, link expiration, and access

12 ShareFile Mobile Client Personal Folders Shared Folders Favorite Folders Network Drives (R/W) SharePoint Document Libraries (R/W)

13 ShareFile Mobile Client (new design)

14 Built-in Mobile Content Editor

15 Microsoft Office Web Apps Integration HTML rendering of Microsoft Office and Adobe PDF documents Supported with Citrixmanaged StorageZones (only) today Rich file interaction without requiring download Leverages Microsoft web app viewer ᵒ PowerPoint animations ᵒ Excel calculations ᵒ MS Word & PDF rendering

16 ShareFile Enterprise In Virtual Environments

17 XenDesktop / XenApp integration Use Citrix Receiver to access published application or desktop Open ShareFile documents from a published application

18 XenDesktop / XenApp integration Use Citrix Receiver to access published application or desktop Open ShareFile documents from a published desktop

19 Without On-Demand Sync Every login to non-persistent desktop Full file download of ᵒ My Files & Folders ᵒ Shared Folders (if configured) Likely to cause a capacity issue on PVS or MCS differencing disk Increased write IO during sync

20 With On-Demand Sync Designed for XenDesktop and XenApp Same look & feel as normal Windows Sync 4 KB placeholder for each file Only brings over files when required ᵒ Copy ᵒ Opening/editing in application Files are uploaded when changed During next login the locally sync d files are deleted

21 Before & After On-Demand Sync Without On-Demand Sync - 20 MB With On-Demand Sync 4 KB

22 ShareFile Enterprise Secure File Sharing

23 Anonymous - Download

24 Contact Info Request - Download

25 Require Client Login - Download

26 ShareFile Enterprise Enterprise Security Controls

27 ShareFile Mobile Device Security Encryption at rest / in-transit Offline / Online access to files Device Restrictions File Self Destruct (Poison Pill) Passcode / Pin Code Modified Device Detection External Applications

28 ShareFile Mobile Device Security Encryption at rest Requires passcode Poison Pill Lost device protection / data expiration Remote Wipe Wipes only ShareFile app data Disable External Applications Prevent Open In 3rd party apps Provided by ShareFile Poison Pill Require password Data retention Encrypt files at rest Passcode lock Device lock Jail-break detection Remote wipe Wipe status and auditing Disable external applications Secure Sharing Network IP restrictions Session inactivity timeout

29 Mobile DLP Controls with XenMobile Provided by ShareFile Disable download Require password Data retention Encrypt files at rest Passcode lock Device lock Jail-break detection Remote wipe Wipe status and auditing Disable external applications Secure Sharing Network IP restrictions Session inactivity timeout Constrain clipboard cut and copy Constrain clipboard paste Constrain external applications Constrain URL Schemes Block camera Block microphone Block screen capture Block compose Disable print Require Citrix Worx Home authentication Provided by MDX Wrapping Define maximum offline period Require regular re-authentication Wipe data after security event Online access only Constrain Wi-Fi networks Require internal network Constrain network access App update grace period Require device encryption Require device pattern screen lock

30 Mobile Device Deployment Public App Store Mobile Application Management (MAM) Mobile Device Management (MDM)

31 Mobile Device Deployment Public App Store Mobile Application Management (MAM) Mobile Device Management (MDM)

32 Windows / OS X Device Registration Restricts login to devices only with a valid access key

33 Sharing Controls Blacklist / Whitelist Prohibit sharing with specific domains Restrict sharing to only specific domains Require Client Login Disables anonymous sharing of documents Restricts ability for recipients to forward shared documents to someone else Client 2-step verification 2-step verification on untrusted devices using SMS messages, Google Authenticator

34 ShareFile Enterprise Storage Zones

35 ShareFile with StorageZones Choose where your data is stored Cloud On-Prem Best economics, most elastic Meet compliance & security requirements

36 ShareFile with StorageZones Choose where your data is stored Cloud On-Prem Existing Systems Best economics, most elastic Meet compliance & security requirements StorageZone Connectors Mobile productivity with existing data sources

37 ShareFile with Citrix-managed StorageZones ShareFile.com Object Store

38 ShareFile with customer-managed StorageZones Object Store

39 ShareFile StorageZones ShareFile.com Object Store Citrix-managed Customer-managed Network Shares StorageZone Connectors Existing Systems

40 ShareFile StorageZone options Object Store Cloud-optimized storage technology Either Citrix-managed or customer-managed Full ShareFile feature set (Sync, Send/Share, retention, versioning, etc.) Existing Systems Network shares, SharePoint Typically in customer datacenter Feature set determined by repositories capabilities

41

42 ShareFile Enterprise Authentication Options

43 Authentication Options ShareFile Managed Customer IdP Uses address and a ShareFile password Passwords are stored hashed in the ShareFile Control Plane Admin portal supports password policy management Requires customer provided and configured SAML 2.0 identity provider Supports Forms, Basic, and Windows Integrated protocols Tested with ADFS 2.0, PingFederate, SiteMinder, Okta Supported only with Enterprise tools Unified storefront for all applications, data and services Instant user provisioning and deprovisioning Single sign-on with Citrix Worx Real-time SaaS application monitoring Comprehensive access control policies

44 SAML Authentication Employee account is still required in ShareFile Folder Access Control Licensing Employees will be matched by address Employee password will never be sent to SaaS Application Tier ShareFile Authentication can be blocked for Employee users Basic, Integrated Windows Authentication, and Forms are supported for all Enterprise clients

45 SAML How it works Client 1 Client requests ShareFile SSO login URL 2 Client discovers identity provider 3 Client redirected to identify provider 4 Client requests identity provider URL User has access 5 Identity Provider identifies the user 6 User is authenticated and is redirected to Assertion Consumer Service URL with SAML response 7 User agent requests ACS URL 8 ACS validates SAML response and redirects user agent to ShareFile URL 6 9 User agent requests ShareFile URL Service Provider (sharefile.com) Identity Provider (e.g. XenMobile, ADFS)

46 IdP / SP Authentication ShareFile.com SAML Service Provider (SP) Trust SAML Identity Provider (IdP) LDAP Customer Active Directory Rights Claims Signed

47 So how do we get the Identity? <NameID Attribute Store (AD) Rule Transform Claims

48 SAML: IDP-Initiated Sign-On SAML Identity Provider (IDP) ShareFile.com Service Provier (SP) Go to sharefile.com Claims + Claims

49 SAML: SP-Initiated Sign-On SAML Identity Provider (IDP) ShareFile.com Service Provider (SP) Request../adfs/ls + Request 401(Auth Challenge)../adfs/ls + Request Claims + Claims

50 ShareFile Enterprise User Provisioning

51 Manual

52 Bulk Import

53 User Management Tool

54 XenMobile AppController

55 ShareFile Enterprise API

56 Solutions Through Platforms Clients Platform V3 API ShareFile Connectors SDK (Data Sources) Partners

57 Web SharePoint Desktop Apps Mobile Apps Network Shares Personal Cloud ShareFile Platform.NET SDK Objective-C SDK Java SDK Javascript SDK Connectors SDK PowerShell SDK RESTful API ShareFile

58 ShareFile Developer

59 ShareFile Enterprise Communications & Diagrams

60 Client Communication Clients Mobile, Windows, Outlook, OS X, Web XenDesktop / XenApp ShareFile.com SAML IdP XenMobile Microsoft ADFS v2 CA SiteMinder Ping Federate/Identity SaaS Application Tier *.sharefile.com *.sharefile.eu / /24 S Z C Documents StorageZones Controller Amazon, Azure, on-premises

61 StorageZones Controller Req & Communication StorageZones Controller Windows Server 2008 R2 or 2012 R2 IIS Services with ASP.NET.NET Framework vcpu, 4GB RAM Public IP address with DNS Public SSL certificate SZC SZ C ShareFile.com Object Store SaaS Application Tier *.sharefile.com /24 *.sharefile.eu /24 ShareFile Data CIFS/SMB file share Service account SharePoint http/https Network Shares Network Shares CIFS/SMB Internal

62 External Firewall Internal Firewall ShareFile StorageZones Networking Diagram FQDN on External DNS with valid Public SSL cert Port 443 Port 80 or 443 (recommended) ShareFIle StorageZone Controller(s) (physical or virtual) DMZ Proxy (e.g. NetScaler) Port 80 on localhost health check Inbound from * on Port 443 Outbound to *.sharefile.com /24 *.sharefile.eu /24 Port 443 Port 80 on localhost health check

63 Optional Internet & Remote Users DMZ Internal Network Port 443 Worx Mail Worx Web Worx Home App Controller SZC.company.com ShareFile Client Device Manager Port 80 or 443 NetScaler StorageZone Controller Port 443 Port 443 App Controller User Provisioning Port 80 or 443 SharePoint SMB Optional Port 443 File Server Port 389 or 636 Port 389 or 636 Citrix-Managed Customer- Managed Active Directory

64 Optional Internet & Remote Users DMZ Internal Network Port 80 or 443 IdP SZC.company.com ShareFile Port 80 or 443 NetScaler StorageZone Controller Port 443 Port 443 App Controller User Provisioning Port 80 or 443 SharePoint SMB Optional Port 443 File Server Port 389 or 636 Port 389 or 636 Citrix-Managed Customer- Managed Active Directory

65 App Communication /saml/login SSO URL Download / Upload URL ShareFile.com Identity Provider SSO Data / Connectors NetScaler SZC C StorageZone Controller Internet DMZ Internal Network

66 ShareFile & XenMobile AppController ShareFile Docs.mdx ShareFile_SAML_SP Netscaler AppController

67 Inserting NetScaler ShareFile.com NetScaler Hash Validation StorageZones Controllers StorageZone request Load Balancing vserver StorageZone request / Content Switching vserver CIFS/SharePoint request Load Balancing vserver w/auth CIFS request /cifs LDAP SharePoint request /sp Authentication

68 NetScaler ShareFile Data Flow NetScaler StorageZone Controllers ShareFile.com Hash Validation Content Switching vserver StorageZone request StorageZone Load request Balancing vserver /

69 NetScaler ShareFile Data Flow NetScaler StorageZone Controllers ShareFile.com AAA Authentication CIFS request /cifs Content Switching vserver CIFS or SharePoint request LDAP Load Balancing vserver SharePoint request /sp

70 Q & A

71 Work better. Live better.