Accessing Zoho via Okta using SAML
You can configure SAML-based SSO with Okta as your identity provider (IdP) to let your users sign in to Zoho.
Required items from Okta
You will need the following items from Okta to configure SAML in
Zoho. You can follow the configuration steps to get these from Okta.
- Identity Provider Single Sign-On URL
- X.509 Certificate
Steps to configure SAML-based SSO
- Sign in at accounts.zoho.com.
- Click Organization in the left menu, then click SAML Authentication. If you can't find Organization, click View more.
- Click Download Metadata.
- Open the downloaded metadata file using your browser or a text editor.
- From the metadata file, copy and save the Entity ID and ACS URL.
- Sign in to your Okta Admin Console.
- Click Applications in the left menu, then click Applications.
- Click Create App Integration, select SAML 2.0, then click Next.
- Enter a name for the app in the App Name field, then click Next.
- Paste the copied ACS URL in the Single sign on URL field and the copied Entity ID in the Audience URI (SP Entity ID) field.
- In the Name ID Format field, select EmailAddress.
- Scroll down and click Next.
- Select I'm an Okta customer adding an internal app, then click Finish.
- In the next page, go to the Sign On tab.
- Scroll down and click View SAML setup instructions. A new page containing the IdP information will open.
- Copy the Identity Provider Single Sign-On URL and download the X.509 Certificate.
- Return to the SAML Authentication page at accounts.zoho.com.
- Configure SAML in your Zoho account using the downloaded certificate and copied URLs from Okta.
- Paste the Identity Provider Single Sign-On URL in the Sign-in URL field.
- Upload the certificate in the X.509 Certificate field. Make sure the certificate is in one of these formats: based-64 coded .cer, .crt, .cert, or .pem file.
Assign users to the app in Okta
Your users in
Okta can use this newly configured Zoho app to sign in to Zoho. However, before that, you need to assign your users to this app. You can follow
the instructions in the following Okta article to assign your users to
the app.
Test the SAML configuration
You
can test if the configuration is working properly using the following
steps. You will need to test these steps as a user in Okta.
SP-initiated flow:
- Go to your Zoho sign-in page.
- Enter your email address, then click Next. You will be redirected to Okta for authentication.
- If
you are not signed in to Okta already, enter your Okta credentials to
sign in. You will now be redirected back to Zoho and will be signed in.
IdP-initiated flow:
- Sign in to Okta end-user dashboard.
- Click on the SAML app you have configured for Zoho. You will be redirected to Zoho and will be signed in.
Enable single logout (SLO)
Okta
supports only SP-initiated single logout, i.e., when your users sign
out from Zoho, they will be automatically signed out from Okta as well.
But not the other way around. To learn more about how Okta SLO works,
refer to this article.
Steps to enable Single log-out:
- Go to SAML Authentication at accounts.zoho.com, then click Edit.
- Copy the Sign-in URL, replace the "sso" part of the URL with "slo", then enter it in the Sign-out URL field.
Example: - Sign-in URL:
https://zylker.okta.com/app/zylker_app_1/exkewk79Kq4696/sso/saml - Sign-out URL:
https://zylker.okta.com/app/zylker_app_1/exkewk79Kq4696/slo/saml - Scroll down and enable Single logout and Generate key pair.
- Click Submit. You may need to re-enter the X.509 certificate before this.
- Click Download in the top-right corner, then click Metadata.
- Open the file "zohometadata.xml" using a browser or text editor. From the metadata file, copy the Single logout URL and the Entity ID.
- Click Download in the top-right corner, then click Public Key. A file named "logoutcertificate.pem" will be downloaded.
- Go to the Okta admin console, then go to the application you have configured.
- Go to the General tab.
- Click Edit next to SAML settings.
- Click Next to move to Step 2: Configure SAML.
- Click Shown Advanced Settings below the General fields.
- Select the checkbox Allow application to enable Single Logout.
- Enter the copied SLO URL in the Single Logout URL field.
- Enter the entity ID in the SP Issuer field.
- Click Browse next to Signature Certificate, then browse for and select the previously downloaded "logoutcertificate.pem" file.
- Click Upload Certificate.
- Click Next, then click Finish.
If you encounter any errors while signing in using SAML, refer to our troubleshooting guide.
Access your files securely from anywhere
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Zoho Marketing Plus?
Everything you need to run your marketing
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
New to Zoho Survey?
Zoho Sheet Resources
Zoho Forms Resources
New to Zoho Sign?
Zoho Sign Resources
Sign, Paperless!
New to Zoho TeamInbox?
Zoho TeamInbox Resources
New to Zoho ZeptoMail?
Zoho DataPrep Resources
Design. Discuss. Deliver.
New to Zoho Workerly?
New to Zoho Recruit?
New to Zoho CRM?
New to Zoho Projects?
New to Zoho Sprints?
New to Zoho Assist?
New to Bigin?
Related Articles
Accessing Zoho via Google using SAML
You can use Google as an identity provider (IdP) to access Zoho applications. Google IdP is a user management platform for Google Apps and services. Required items from Google You will need the following items from Google to configure SAML in Zoho. ...Accessing Zoho via Auth0 using SAML
By configuring SAML based SSO with Auth0, you can let your users sign in to Zoho using their Auth0 credentials. Required items from Auth0 You will need the following items from Auth0 to configure SAML in Zoho. You can follow the configuration steps ...Accessing Zoho via AWS using SAML
By configuring SAML-based SSO with AWS, you can let your users sign in to Zoho using their AWS credentials. Required items from AWS: You will need the following items from AWS to configure SAML in Zoho. You can follow the configuration steps to get ...Accessing Zoho via Microsoft Entra ID using SAML
By configuring SAML based SSO with Microsoft Entra ID, you can let your users sign in to Zoho using their Entra ID credentials. Required items from Microsoft Entra ID You will need the following items from Microsoft Entra ID to configure SAML in ...Configure SAML in Zoho Accounts
Note: If you want to configure SAML for Zoho One/ Zoho Directory, you can refer to their respective help documents: Zoho One | Zoho Directory To create a SAML connection between Zoho and your identity provider (IdP), you will need to provide some ...
New to Zoho LandingPage?
Zoho LandingPage Resources