Add CyberArk as an IdP and enable Custom Authentication

Add CyberArk as an IdP and enable Custom Authentication

Custom authentication with CyberArk enables SAML-based single sign-on (SSO) from CyberArk to Zoho Directory. Once configured, users in your organisation can access Zoho Directory from CyberArk without signing in to Zoho Directory.

This article outlines the steps to configure custom authentication in Zoho Directory using CyberArk as the Identity Provider (IdP).

Prerequisites

In Zoho Directory - Roles required to perform this action:
  1. Organization Owner
  2. Organization Admin
  3. Security Admin role

In CyberArk: Configure SAML

  1. Sign in to the CyberArk admin console.
  2. Click Web Apps under Apps & Widgets in the left panel.
  3. Click Add Web Apps, then search for "Zoho".
  4. Click Add next to the Zoho - SAML option.
  5. Click Yes in the pop-up window that appears, then click Close. You will be redirected to the Settings page.
  6. Enter the domain name in the Zoho Domain field, then type "Zoho Directory" in the Name field.
  7. Click Save.
  8. Click Trust in the left menu, then check Manual Configuration under Service Provider Configuration.
  9. Provide the SP Entity ID / SP Issuer / Audience and the Assertion Consumer Service (ACS) URL in their respective fields.
    10. NotesYou can find the Issuer and ACS URL in Zoho Directory's Identity Providers page.
  10. Select emailAddress under NameID Format.
  11. Check Manual Configuration under Identity Provider Configuration.
  12. Click Signing Certificate, then click Download.
  13. Copy the Single Sign On URL and Single Logout URL. You'll need to submit these URLs and the downloaded Signing Certificate to add CyberArk as an IdP in Zoho Directory.
  14. Click Save.

In CuberArk: Deploy the app to users

  1. Sign in to the CyberArk admin console.
  2. Click Web Apps under Apps in the left pane.
  3. Click Zoho Directory, then click Permissions in the left menu.
  4. Click Add, then search for specific users or groups you want to enforce SSO for.
  5. Select the users, then click Add.
  6. Click Save.

In Zoho Directory: Add CyberArk as an IdP

  1. Sign in to Zoho Directory, then click Admin Panel.
  2. Click Security in the left menu.
  3. Select Routing Policies, then go to the Identity Providers tab.
  4. Click Add identity Provider.
  5. Choose SAML as the SSO Protocol, then enter the name of your IdP in the IdP name field.
  6. Under Sign-in URL, paste the Single Sign On URL copied from CyberArk.
  7. Under Sign-out URL, paste the Single Logout URL copied from CyberArk.
  8. Upload the Signing Certificate downloaded from CyberArk under X509 certificate field.
  9. Click Add. CyberArk will be added as an Identity Provider in Zoho Directory.

In Zoho Directory: Add Routing Policy to enable Custom Authentication

  1. On the same page, go to Routing Policies tab and click Add Policy.
  2. Enter a name for the policy, then select the members you want to apply the policy to.
  3. Select if any groups whose users should be excluded from the policy, even if they are part of the selected groups.
  4. Click Next.
  5. Under Authentication Modes, enable the Identity providers toggle, then select the IdP you added from the list.
  6. Click Next.
  7. Set Session Settings if required, then click Add. A routing policy will be created and members of this policy will use this IdP to sign in.