Target audience: Workspace administrators

This article is part of the New LucidLink Single Sign-On (SSO) SAML 2.0 implementation series of articles.

Overview

As part of the New LucidLink Single Sign-On (SSO) SAML 2.0 implementation setup, a specialized file, known as an SSO key, is generated. The SSO key workflow serves as an additional layer of security, providing a Zero-Knowledge guarantee and ensuring that LucidLink has no access to the data stored in your Filespace.

Because of this Zero-Knowledge security model, single sign-on (SSO) authentication requires distributing the SSO key file to all domain members authenticating through your identity provider. They must upload the key on each device or browser during their login.

SSO Key Distribution

The SSO Key can be downloaded from the SSO Integration page for the Workspace.

The SSO Key must be loaded into the LucidLink application upon login if the user email is part of a verified domain in a workspace that requires SSO authentication - do not modify the SSO key file name or contents.

The SSO key could be distributed in the following ways:

• Your corporate MDM solution*
• Hosted on a file share only accessible to your filespace users
• Hosted within your corporate intranet service
• Securely transmitted or sent to each user

*Most mobile device management (MDM) suites provide a facility to distribute files securely throughout managed devices and endpoints. Additionally, the Active Directory Group Policy provides a capability compatible with our implementation.

Automatic key provisioning by platform

To avoid asking every user to upload the key manually, LucidLink can load the SSO key automatically on several platforms. Choose the section that matches the devices you manage.

Desktop (Windows and macOS)

The LucidLink desktop application loads the SSO Key file automatically if it is located in the current user's ~/.lucid-keys directory.

An example of the location on Windows would be the following:

C:\Users\john_smith\.lucid-keys

And on macOS:

/Users/john_smith/.lucid-keys

You can push the key file to this directory using your MDM solution, Active Directory Group Policy, or any of the distribution methods listed above.

iOS (MDM Managed App Configuration)

LucidLink for iOS supports automatic SSO domain key provisioning via Managed App Configuration (AppConfig). When configured, the app automatically applies the domain key during SSO sign-in, removing the need for users to manually upload an '.ssokey' or '.domainkey' file.

In your MDM solution, add a Managed App Configuration payload for the LucidLink app (com.lucidlink.ios.files) with the following structure:

<dict>
    <key>domainSecrets</key>
    <dict>
        <key>your-email-domain.com</key>
        <string>your-base64-encoded-domain-key</string>
    </dict>
</dict>

Where:

Each entry within domainSecrets:

You can provision keys for multiple domains in a single configuration:

<dict>
    <key>domainSecrets</key>
    <dict>
        <key>acme-corp.com</key>
        <string>abc123...</string>
        <key>other-org.com</key>
        <string>def456...</string>
    </dict>
</dict>

The 'domainSecrets' dictionary is delivered through the standard iOS Managed App Configuration mechanism (AppConfig). This is supported by all major MDM platforms including Jamf Pro, Microsoft Intune, VMware Workspace ONE, Mosyle, and others. Refer to your MDM's documentation for how to set Managed App Configuration for a specific app.

Android (MDM Managed Configuration)

The LucidLink Android app supports automatic SSO domain key provisioning through Android's managed configuration (Managed Restrictions). When configured, the app automatically obtains the domain key during SSO sign-in, removing the need for users to manually upload an '.ssokey' or '.domainkey' file.

Each MDM solution requires a custom configuration flow but the general structure of the payload is the same. In your MDM, add a configuration for the LucidLink app (com.lucidlink.android.files) with the following structure:

The exact format depends on your MDM console; the structure below shows the logical layout.

{
  "domain_secrets": [
    {
      "email_domain": "example.com",
      "domain_key": "some-secret-key-for-example-com"
    },
    {
      "email_domain": "anotherdomain.org",
      "domain_key": "some-secret-key-for-anotherdomain"
    }
  ]
}

Note: This data is managed by the Android platform and can only be read by the LucidLink application itself. No other third-party apps can access it under normal device security conditions.

The domain_secrets configuration is delivered through the standard managed configuration mechanism provided by Google. This is supported by all major MDM platforms including Microsoft Intune, Samsung Knox, VMware Workspace ONE, and others. Refer to your MDM's documentation for how to set Managed Configuration for a specific app.

How automatic provisioning behaves on mobile

The following applies to both iOS and Android automatic provisioning:

• Domain matching is case-insensitive — Acme-Corp.com and acme-corp.com are treated as the same domain.
• The domain is extracted from the user's email address (e.g. user@acme-corp.com → acme-corp.com).
• When a user signs in via SSO, the app checks the MDM configuration for a domain key matching the user's email domain before presenting the manual key upload screen.
• If a matching key is found and is valid, sign-in proceeds automatically — the user never sees the key upload step.
• If the key is invalid or cannot be verified, the user is shown an error message and can still upload the key manually as a fallback.
• If no matching key is found in the MDM config, the user is presented with the standard manual key upload screen.
• On Android, configuration changes pushed by your MDM take effect immediately without requiring the user to restart the app.