To configure SAML in Zoho, you need to obtain the below information from your identity provider. You can either enter the information manually or auto-fill it by uploading the metadata (based on how your IdP provides it).
- Sign-in URL
- Sign-out URL (optional)
- Name identifier
- X.509 Certificate (Make sure the certificate is in one of these formats: based-64 coded .cer, .crt, .cert, or .pem file)
To fill out these details:
- Sign in at accounts.zoho.com.
- Click Organization in the left menu, then click SAML Authentication. If you can't find Organization, click View More.
- Click Set up Now.
- Either auto-fill the required details by uploading the metadata file (which you got from your IdP) or manually enter them.
- The Name Identifier will be Email Address by default. If your IdP uses a different name identifier, select the applicable option.
- In the Zoho Service field, select the Zoho app to redirect to, when users sign in from the IdP. Learn more
Based on your SAML requirements, you can make use of the following options as well:
When your users sign in or sign out, your IdP may require their email address or username from Zoho. For example, when a user tries signing in to Zoho directly, they'll be redirected to IdP for authentication. The IdP will present a sign-in form to users for authentication. If the IdP can obtain the user's email address or username from Zoho, it can auto-fill this field on the sign-in form.
To send such information to your IdP, you need to enable Parameters. The Value field can be Username or Email Address. The parameter name you enter in the Name field will be used by the IdP to identify the values sent by Zoho.
Sign SAML requests
For SP-initiated SAML, Zoho will send SAML requests to your IdP (to authenticate the user). Your IdP may require that these requests are signed to ensure that:
- The requests are coming from Zoho and not any other source.
- The information sent in the request is not altered by a malicious actor.
To meet this signature requirement, you can enable the option to sign all SAML requests Zoho sends. A public key will be generated and available for download (on the SAML Authentication page). You'll need to provide this public key to your IdP for verifying the signed requests.
Generate key pair
After your IdP authenticates a user, it will send a SAML response to Zoho, which contains information about the authenticated user, among other details. To maintain the confidentiality of this information, the IdP may require that SAML responses be encrypted. To meet this requirement, you can generate a cryptographic key pair of public and private key. The private key will be kept secure. The public key will be available for download, and you'll need to provide it to your IdP. Your IdP will use this public key to encrypt the information in SAML responses and send them to Zoho. Since this information can only be decrypted using the private key that Zoho has kept secure, the information sent in responses remains confidential between your IdP and Zoho.
Note: If you enable the option Sign SAML requests, a key pair will be generated automatically.
There are two types of Single logout (SLO):
- SP-initiated SLO: When users sign out of Zoho, they will be automatically signed out of the IdP as well.
- IdP-initiated SLO: When users sign out of the IdP, they will be automatically signed out of Zoho as well.
For SLO to work, it must be supported by the IdP. Some IdP's support only type of SLO, some support both, and some support none.
To configure Single logout for your organization, you need to:
- Enable the Single logout option.
- Provide your IdP's sign-out URL to Zoho while configuring SAML.
- Provide Zoho's sign-out URL to your IdP. Zoho's sign-out URL can be found in the metadata file under the tag <md:SingleLogoutService>. For IdPs that are supported, the steps to enable single logout are described in the respective SAML help articles.
Just-in-Time (JIT) provisioning allows your users to get added to your Zoho organization when they sign in to Zoho for the first time through SAML. They will be added after validating the SAML response and their domain. If JIT is not enabled, you have to manually add your users to your Zoho organization before they can sign in with SSO.
Using JIT, you can also retrieve and auto-fill some user information fields in Zoho (from the IdP). To do that, map the following Zoho user information fields with the corresponding fields from your IdP when you enable JIT:
- First Name
- Last Name
- Display Name
Your IdP may either pre-define the attribute names or let you enter an attribute name of your own. If the latter is the case, enter an attribute name in Zoho and use the same name in your IdP.
To configure SAML-based SSO with the following IdPs, refer to their respective help articles: