Configure SAML in Zoho Accounts
Note: If you want to configure SAML for Zoho One/ Zoho Directory, you can refer to their respective help documents:
Zoho One |
Zoho Directory
To create a SAML connection between Zoho and your identity provider (IdP), you will need to provide some details from Zoho to your IdP, and vice versa. You can get Zoho's details from the Zoho metadata and provide them to your IdP while configuring SAML. Similarly, you will need to get the required details from your IdP to configure SAML in Zoho.
Configure SAML in your IdP (using Zoho's Metadata)
To configure Zoho as a service provider in your Identity Provider (IdP), you will need to provide Zoho's details. These details can be found in the metadata file, which you can download from your Zoho account. You can upload the metadata file to your IdP or enter the details manually. Refer to your IdP's documentation or support to learn how.
Zoho's metadata file contains the following details:
- Entity ID (or issuer URL/identifier)
- ACS URL (or reply URL/single sign-on URL)
- Sign-out URL
- NameIDFormat
- ZOID (which is the last part of the ACS URL)
To download Zoho metadata:
- Sign in at accounts.zoho.com.
- In the left menu, under Organization, click SAML Authentication.
- Click Download Metadata. A file named "zohometadata.xml" will be downloaded.
- To view and copy the required details, open the file using a browser or text editor.
Configure SAML in Zoho
To configure SAML in Zoho, you need to obtain the below information from your identity provider. You can either enter the information manually or auto-fill it by uploading the metadata (based on how your IdP provides it).
- Sign-in URL
- Sign-out URL (optional)
- Name identifier
- X.509 Certificate (Make sure the certificate is in one of these formats: based-64 coded .cer, .crt, .cert, or .pem file)
To fill out these details:
- Sign in at accounts.zoho.com.
- Click Organization in the left menu, then click SAML Authentication. If you can't find Organization, click View More.
- Click Set up Now.
- Either auto-fill the required details by uploading the metadata file (which you got from your IdP) or manually enter them.
- The Name Identifier will be Email Address by default. If your IdP uses a different name identifier, select the applicable option.
- In the Zoho Service field, select the Zoho app to redirect to, when users sign in from the IdP. Learn more
Based on your SAML requirements, you can make use of the following options as well:
Parameters
When your users sign in or sign out, your IdP may require their email address or username from Zoho. For example, when a user tries signing in to Zoho directly, they'll be redirected to IdP for authentication. The IdP will present a sign-in form to users for authentication. If the IdP can obtain the user's email address or username from Zoho, it can auto-fill this field on the sign-in form.
To send such information to your IdP, you need to enable Parameters. The Value field can be Username or Email Address. The parameter name you enter in the Name field will be used by the IdP to identify the values sent by Zoho.
Sign SAML requests
For SP-initiated SAML, Zoho will send SAML requests to your IdP (to authenticate the user). Your IdP may require that these requests are signed to ensure that:
- The requests are coming from Zoho and not any other source.
- The information sent in the request is not altered by a malicious actor.
To meet this signature requirement, you can enable the option to sign all SAML requests Zoho sends. A public key will be generated and available for download (on the SAML Authentication page). You'll need to provide this public key to your IdP for verifying the signed requests.
Generate key pair
After your IdP authenticates a user, it will send a SAML response to Zoho, which contains information about the authenticated user, among other details. To maintain the confidentiality of this information, the IdP may require that SAML responses be encrypted. To meet this requirement, you can generate a cryptographic key pair of public and private key. The private key will be kept secure. The public key will be available for download, and you'll need to provide it to your IdP. Your IdP will use this public key to encrypt the information in SAML responses and send them to Zoho. Since this information can only be decrypted using the private key that Zoho has kept secure, the information sent in responses remains confidential between your IdP and Zoho.
Note: If you enable the option Sign SAML requests, a key pair will be generated automatically.
Single logout
There are two types of Single logout (SLO):
- SP-initiated SLO: When users sign out of Zoho, they will be automatically signed out of the IdP as well.
- IdP-initiated SLO: When users sign out of the IdP, they will be automatically signed out of Zoho as well.
For SLO to work, it must be supported by the IdP. Some IdP's support only type of SLO, some support both, and some support none.
To configure Single logout for your organization, you need to:
- Enable the Single logout option.
- Provide your IdP's sign-out URL to Zoho while configuring SAML.
- Provide Zoho's sign-out URL to your IdP. Zoho's sign-out URL can be found in the metadata file under the tag <md:SingleLogoutService>. For IdPs that are supported, the steps to enable single logout are described in the respective SAML help articles.
Just-In-Time provisioning
Just-in-Time (JIT) provisioning allows your users to get added to your Zoho organization when they sign in to Zoho for the first time through SAML. They will be added after validating the SAML response and their domain. If JIT is not enabled, you have to manually add your users to your Zoho organization before they can sign in with SSO.
Using JIT, you can also retrieve and auto-fill some user information fields in Zoho (from the IdP). To do that, map the following Zoho user information fields with the corresponding fields from your IdP when you enable JIT:
- First Name
- Last Name
- Display Name
Your IdP may either pre-define the attribute names or let you enter an attribute name of your own. If the latter is the case, enter an attribute name in Zoho and use the same name in your IdP.
To learn more about the terms used here, check out our
SAML Terminologies glossary.
To configure SAML-based SSO with the following IdPs, refer to their respective help articles:
Access your files securely from anywhere
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Zoho Marketing Plus?
Everything you need to run your marketing
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
New to Zoho Survey?
Zoho Sheet Resources
Zoho Forms Resources
New to Zoho Sign?
Zoho Sign Resources
Sign, Paperless!
New to Zoho TeamInbox?
Zoho TeamInbox Resources
New to Zoho ZeptoMail?
Zoho DataPrep Resources
Design. Discuss. Deliver.
New to Zoho Workerly?
New to Zoho Recruit?
New to Zoho CRM?
New to Zoho Projects?
New to Zoho Sprints?
New to Zoho Assist?
New to Bigin?
Related Articles
Accessing Zoho via Google using SAML
You can use Google as an identity provider (IdP) to access Zoho applications. Google IdP is a user management platform for Google Apps and services. Required items from Google You will need the following items from Google to configure SAML in Zoho. ...Accessing Zoho via Auth0 using SAML
By configuring SAML based SSO with Auth0, you can let your users sign in to Zoho using their Auth0 credentials. Required items from Auth0 You will need the following items from Auth0 to configure SAML in Zoho. You can follow the configuration steps ...Accessing Zoho via AWS using SAML
By configuring SAML-based SSO with AWS, you can let your users sign in to Zoho using their AWS credentials. Required items from AWS: You will need the following items from AWS to configure SAML in Zoho. You can follow the configuration steps to get ...Troubleshoot SAML related errors
Error Message Reason Solution Your organization has configured SAML authentication, please sign in via SAML credentials You cannot sign in to your Zoho account via any linked account, if your organization has mandated you to sign in only through SAML ...Sign in using SAML
SAML is a protocol that allows you to configure single sign-on (SSO) for Zoho with your identity provider (IdP). Once SAML-based SSO is configured for an organization, all the organization users can directly sign in to Zoho using their IdP ...
New to Zoho LandingPage?
Zoho LandingPage Resources