Summary

This document will guide you through the steps to enable multi-factor authentication and Single-Sign On for the online office suite Zoho (https://www.zoho.com/) using SAML2.

System Requirements

• PhenixID Authentication Server 3.0 or higher
• Zoho administration rights
• The users to be federated must be present in Zoho directory

Instruction

Overview

This document will guide you through the steps to enable multi-factor authentication and Single-Sign on for Zoho

PhenixID Authentication Services acting as SAML IdP

1. Login to Configuration Manager.
2. Setup PhenixID Authentication Services as a SAML IdP using one of the Federation scenarios described here. (If the desired authentication method is not provided by a scenario, use the documentation for the SAML authenticator here)
3. Fetch the user mail value (corresponding to the Zoho userID) from the user store configured.
4. Use mail as Name ID attribute.
5. Click on the Execution flow tab.
6. Change the NameID format to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress by adding a Misc param to the AssertionProvider valve:
   
7. Save changes.
8. Click General->View SAML Metadata.
9. Save the IDP Signing Certificate as a file (follow this instruction)
10. Fetch the IdP Post SSO value (Sign-in URL. see below).
11. Fetch the IdP Post SLO value (Sign-out URL. see below).

Configure Zoho

1. Follow this guide on how to add Custom SAML Authentication for Zoho. Set these values:
   1. Sign-in URL = <Set to value fetched in previous step>
   2. Sign-out URL = <Set to value fetched in previous step>
   3. Change password URL = <Leave blank>
   4. Verification certificate = <Upload the IDP Signing certificate created in previous step >
   5. Save
   6. Click “Download metadata” to download Zoho SAML SP Metadata
      1. This link is only visible on first config. If you need to reconfigure and download metadata again, you can download the metadata using Zoho Accounts -> Organization -> SAML Authentication.
   7. Save the metadata file file

Add trust to Zoho on PhenixID Authentication Services

1. Login to configuration manager
2. Open Scenarios->Federation->SAML Metadata upload
3. Click the plus sign
4. Add Zoho SAML SP Metadata by uploading the file downloaded in previous step.

Test

1. Browse to Zoho
2. Enter your email address
3. This should result in a redirect to PhenixID Authentication Server
4. Authenticate
5. If authentication was successful, a redirect to Zoho should occur (with SAML assertion)
6. The user should now be logged in.