Prerequisites

1. Organization Owner/ Admin
   
2. Security Admin role
   

To add IdP:

1. Sign in to Zoho Directory, then click Admin Panel.
   
2. Click Security on the left menu.
   
3. Select Routing Policies, then go to the Identity Providers tab.
   
4. Click Add Identity Provider.
   
5. Select the SSO protocol for your IdP. The configuration steps vary depending on the protocol selected.
   

SAML

JWT

OIDC

SAML

1. Select SAML from the SSO Protocol dropdown.
   
2. Enter a name for your IdP in the IdP name field.
   
3. Copy the Assertion Consumer Services URL. You will need it to configure SSO at your IdP.
   
4. Copy the Issuer/Entity ID. You will need it to verify that the assertion is from Zoho at your IdP. 
   
5. Enter the following details obtained from your IdP:
   
1. Sign-in URL: The URL users are redirected to when signing in to Zoho.
   
2. Sign-out URL: The URL users are redirected to after signing out of Zoho.
   
3. Select the Name ID format in which the IdP sends the user's identifier in the SAML assertion.
   
4. X509 certificate: The certificate with which Zoho can check the digital signature on the IdP's authentication response. 

   
6. Enter the Sign-in parameters and Sign-out parameters if needed.
   
7. Click Add.
   

To allow users to sign in using this IdP, configure a Routing Policy and enable Identity Providers. Click here to know how to configure a routing policy.

JWT

1. Select JWT from the SSO Protocol dropdown.
   
2. Enter a name for your IdP in the IdP name field.
   
3. Copy the Assertion Consumer Services URL. You will need it to configure SSO at your IdP.
   
4. Enter the following details obtained from your IdP:
   
1. Sign-in URL: The URL users are redirected to when signing in to Zoho.
2. Sign-out URL: The URL users are redirected to after signing out of Zoho.
   
   
   
5. Select a signing algorithm.
   
1. HS256: The HS256 signing algorithm makes use of a secret key shared between the IdP and Zoho Directory to generate a hashing function, which serves as the signature.
   Copy the Secret Key. You will need it to configure SSO at your IdP.
   
   
2. RS256: The RS256, on the other hand, makes use of a public/private key pair. The IdP has a private key which generates a signature, and the service provider (Zoho) validates the signature using the public key.
   Upload the Verification Certificate downloaded from the IdP under X509 certificate field.
   
   
6. Enter the Sign-in parameters and Sign-out parameters if needed.
   
7. Click Add.
   

To allow users to sign in using this IdP, configure a Routing Policy and enable Identity Providers. Click here to know how to configure a routing policy.

OIDC

1. Select OIDC from the SSO Protocol dropdown.
   
2. Enter a name for your IdP in the IdP name field.
   
3. Enter the Client ID and Client Secret obtained from your IdP.
   
4. Copy the Redirect URL. You will need it to configure SSO at your IdP. 
   
   

   The Redirect URL will be generated only after the IdP is added. You can copy it after completing the configuration.
5. Enter the Issuer URL obtained from your IdP. This automatically retrieves the authorization URL and access token URL. Alternatively, if you do not provide the Issuer URL, enter the Authorization URL and Access Token URL manually.
   
6. Enter the Scopes, User information URL, and Sign-out URL if needed.
   
7. Click Add.
   

To allow users to sign in using this IdP, configure a Routing Policy and enable Identity Providers. Click here to know how to configure a routing policy.