Latest revision as of 04:24, 21 September 2023

Zimbra Single Sign-On using SAML

KB 20404	Last updated on 2023-09-21	Last updated by Barry de Graaff	5.00 (one vote)	Verified in: ZCS 9.0 ZCS 10.0

KB 20404	Last updated on 2023-09-21
5.00 (one vote)

Did you know that Zimbra supports SAML single sign on? SAML is an open standard that allows you to have a single login page for all applications in your organization. SAML is a Zimbra Network Edition feature. Once you have set-up SAML you can easily add Multi Factor Authentication.

Zimbra is a SAML service provider and should work with most SAML identity providers. For a number of SAML identity providers we have provided set-up guides which can be found in the Zimlet Gallery using this link: https://gallery.zetalliance.org/extend/category/saml and below:

On prem

SimpleSAMLPhp

https://wiki.zimbra.com/wiki/Authentication/SimpleSAMLPhp

https://github.com/Zimbra/zimbra-auth-module-simplesamlphp/blob/main/README.md

https://github.com/Zimbra/zimbra-auth-module-simplesamlphp/blob/main/README-EXTENDED.md

Keycloak

https://github.com/Zimbra/keycloak

Hosted

Google Workspaces

https://github.com/Zimbra/google-workspaces-saml

Cisco Duo

https://github.com/Zimbra/cisco-duo-saml

JumpCloud

https://wiki.zimbra.com/wiki/Authentication/JumpCloud

Zimbra FOSS SAML

https://gallery.zetalliance.org/extend/items/view/zimbra-single-sign-on-saml

Verified Against: Zimbra 10	Date Created: 02/22/2021
Article ID: https://wiki.zimbra.com/index.php?title=Authentication/SAML	Date Modified: 2023-09-21

Try Zimbra

Try Zimbra Collaboration with a 60-day free trial.
Get it now »

Want to get involved?

You can contribute in the Community, Wiki, Code, or development of Zimlets.
Find out more. »

Other help Resources

User Help Page »
Official Forums »
Zimbra Documentation Page »

Looking for a Video?

Visit our YouTube channel to get the latest webinars, technology news, product overviews, and so much more.
Go to the YouTube channel »

@@ Line 2: / Line 2: @@
 __FORCETOC__
 <div class="col-md-12 ibox-content">
-= SAML Readme =
+= Zimbra Single Sign-On using SAML =
-{{KB|{{Unsupported}}|{{ZCS 8.0}}|{{ZCS 7.0}}|}}
+{{KB||{{ZCS 9.0}}|{{ZCS 10.0}}|}}
-{{WIP}}
 [[Category:Authentication]]
 [[Category:Administration]]
 [[Category:Configuration]]
-Included in Network Edition at the following location:
+Did you know that Zimbra supports SAML single sign on? SAML is an open standard that allows you to have a single login page for all applications in your organization. SAML is a Zimbra Network Edition feature. Once you have set-up SAML you can easily add Multi Factor Authentication.
+Zimbra is a SAML service provider and should work with most SAML identity providers. For a number of SAML identity providers we have provided set-up guides which can be found in the Zimlet Gallery using this link: https://gallery.zetalliance.org/extend/category/saml and below:
+= On prem =
-/opt/zimbra/extensions-network-extra/saml/README.txt
+== SimpleSAMLPhp ==
-<pre>
+https://wiki.zimbra.com/wiki/Authentication/SimpleSAMLPhp
-The Zimbra SAML extension provides support for the "Browser/POST Profile of SAML" - Section 4.1.2 of
+https://github.com/Zimbra/zimbra-auth-module-simplesamlphp/blob/main/README.md
-http://www.oasis-open.org/committees/download.php/3405/oasis-sstc-saml-bindings-1.1.pdf. Zimbra is the "Destination
-Site" in the context of this section of the spec.
-The flow for a user on a browser would be:
+https://github.com/Zimbra/zimbra-auth-module-simplesamlphp/blob/main/README-EXTENDED.md
-. User authenticates with an IdP which can act as a SAML Provider.
+== Keycloak ==
-. The IdP redirects the browser to Zimbra SAML extension URL (<zimbra_base_url>/service/extension/samlreceiver) and
-   passes along a SAML Response (containing a SAML Assertion).
-. The SAML extension checks the validity of the SAML Response, and then looks up the Subject inside the SAML assertion
-   which should be the email address corresponding to user's Zimbra account.
-. Finally, a Zimbra cookie corresponding to that Zimbra account is returned to the browser and is redirected to the
-   default Zimbra mail URL.
+https://github.com/Zimbra/keycloak
-Zimbra Setup
+= Hosted =
-------------
-- Create "saml" directory under /opt/zimbra/lib/ext; Copy samlextn.jar under it.
+== Google Workspaces ==
-- Add the SAML signing certificate to the domain:
+https://github.com/Zimbra/google-workspaces-saml
-    zmprov md <domain> zimbraMyoneloginSamlSigningCert <saml-signing-cert-base64-data>
+== Cisco Duo ==
+https://github.com/Zimbra/cisco-duo-saml
-Note for SAML Provider
+== JumpCloud ==
-----------------------
-SAML Provider must POST the SAML Response at the following URL for SSO:
+https://wiki.zimbra.com/wiki/Authentication/JumpCloud
-    <zimbra_base_url>/service/extension/samlreceiver
+= Zimbra FOSS SAML =
-This SAML Consumer extension requires that the Subject Name Identifier inside the SAML Assertion must be the account
+https://gallery.zetalliance.org/extend/items/view/zimbra-single-sign-on-saml
-email address, so configure the Provider accordingly.
-</pre>
+{{Article Footer|Zimbra 10|02/22/2021}}
-{{Article Footer|Zimbra Collaboration 8.0, 7.0|04/16/2014}}

Authentication/SAML: Difference between revisions

Latest revision as of 04:24, 21 September 2023

Contents

Zimbra Single Sign-On using SAML

On prem

SimpleSAMLPhp

Keycloak

Hosted

Google Workspaces

Cisco Duo

JumpCloud

Zimbra FOSS SAML

Products

Support

Learn

Community