Revision as of 10:32, 20 December 2017 by Shanxt (talk | contribs) (SAML Readme)

SAML Readme

   KB 20404        Last updated on 2017-12-20  

(one vote)

Included in Network Edition at the following location:


The Zimbra SAML extension provides support for the "Browser/POST Profile of SAML" - Section 4.1.2 of Zimbra is the "Destination
Site" in the context of this section of the spec.

The flow for a user on a browser would be:

1. User authenticates with an IdP which can act as a SAML Provider.
2. The IdP redirects the browser to Zimbra SAML extension URL (<zimbra_base_url>/service/extension/samlreceiver) and
   passes along a SAML Response (containing a SAML Assertion).
3. The SAML extension checks the validity of the SAML Response, and then looks up the Subject inside the SAML assertion
   which should be the email address corresponding to user's Zimbra account.
4. Finally, a Zimbra cookie corresponding to that Zimbra account is returned to the browser and is redirected to the
   default Zimbra mail URL.

Zimbra Setup

- Create "saml" directory under /opt/zimbra/lib/ext; Copy samlextn.jar under it.

- Add the SAML signing certificate to the domain:

    zmprov md <domain> zimbraMyoneloginSamlSigningCert <saml-signing-cert-base64-data>

Note for SAML Provider

SAML Provider must POST the SAML Response at the following URL for SSO:


This SAML Consumer extension requires that the Subject Name Identifier inside the SAML Assertion must be the account
email address, so configure the Provider accordingly.


  • Check /opt/zimbra/log/zmmailboxd.out for exceptions - it's more useful than mailbox.log in this case
  • In 8.7.11, set zimbraCsrfRefererCheckEnabled to FALSE or add the domain to zimbraCsrfAllowedRefererHosts. Setting it to FALSE is preferred.
  • Also in 8.7.11, we've seen the existing certificate stored in 'zimbraMyOneLoginSamlSigningCert' doesn't load in certain situations, especially after an upgrade. To fix this, we'll simply have to reload the certificate.

To do this, either get a copy of the certificate, or recreate it from the output of:

zmprov gd zimbraMyOneLoginSigningCert

After that, null the value:

zmprov md zimbraMyOneLoginSigningCert ' '

And then set it to the new certificate.

Verified Against: Zimbra Collaboration 8.0, 7.0 Date Created: 04/16/2014
Article ID: Date Modified: 2017-12-20

Try Zimbra

Try Zimbra Collaboration with a 60-day free trial.
Get it now »

Want to get involved?

You can contribute in the Community, Wiki, Code, or development of Zimlets.
Find out more. »

Looking for a Video?

Visit our YouTube channel to get the latest webinars, technology news, product overviews, and so much more.
Go to the YouTube channel »

Jump to: navigation, search