Zoho SAML JIT Setup Guide

Item

Details

Pre-check

  • Prior configuration in Zoho is required.
  • Domain ownership and verification are required to apply SAML JIT.

  • The user's "last name" and "first name" are synced only when a new user is created via SAML JIT. They are not automatically updated on subsequent logins.

  • This manual describes how to configure SAML in Zoho Accounts.
    For details and the latest setup steps, please refer to the manual provided by Zoho.
    SAML Authentication Configuration in Zoho Accounts

Name ID

Email address

Custom attribute Note: For how to configure custom attributes, see here

SP Configuration

Configured by the administrator

Request SP to configure

Provisioning

API-based Provisioning supported (account management available in TrustLogin)

SAML JIT Provisioning supported (account management available in TrustLogin; user deletion not supported)
Note: For setup instructions when provisioning is not required, see here

None (accounts created in each system)

Access Method

SP-Initiated SSO

IdP-Initiated SSO

Verified Operation by Device

PC - Browser

PC - Desktop App

iOS - Standard Browser (Safari)

iOS - TrustLogin Mobile App In-App Browser

iOS - Native App

Android - Standard Browser (Chrome)

Android - TrustLogin Mobile App In-App Browser

Android - Native App


TrustLogin Admin Page Settings

  1. Log in to TrustLogin, open the "Admin Page > App" menu, and click the "Register App" button in the upper right of the screen.
    01.png

  2. Search on the "Register Company App" screen and select "Zoho (SAML)".
    02.png

  3. Note down the value of "Identity Provider URL" under "Identity Provider Information", and download the certificate using the "Get Certificate" button.
    03.png

  4. Change the file extension of the downloaded certificate to ".cer" so that the certificate file is in CER format.


Now, switch to configuring Zoho.
Do not click the "Register" button yet — open Zoho in a separate window.

Zoho Settings

  1. Log in to Zoho Directory and open the admin console. From "Domains > Add Domain", enter the domain name to verify.
    Zoho02.png

  2. Follow the displayed instructions to configure the domain's DNS records, and once the values have propagated, click the "Verify" button. For instructions on configuring DNS records, please refer to your domain registrar's help documentation.
    Zoho03.png

    DNS record updates can take up to approximately 72 hours to propagate. If you cannot complete verification right away, click the "Cancel" button to close the page, and once the values have propagated, you can resume verification from the "Domains" page.
    zohodomain.png

  3. Log in to Zoho Accounts with an organization administrator account, open "Organization > SAML Authentication" from the left menu, and click the "Configure" button.
    04.png

  4. Configure each item as follows.
    Sign-in URL The "Identity Provider URL" obtained from TrustLogin
    Zoho Service After login, select the service to redirect to
    Name Identifier Email address
    X.509 Certificate The "Certificate" obtained from TrustLogin, converted to CER format

    05 (3).png

  5. Turn on the toggle for "Auto-create accounts (Just-In-Time provisioning)" and add attributes using the + button. Enter the following into the "Attributes of the service (Identity Provider) used for authentication", then click the "Send" button.
    First Name first_name
    Last Name last_name

    Zoho.png

  6. Download the "Metadata" using the "Download" button.
    Zoho01.png

Now return to the TrustLogin Admin Page again.

TrustLogin Admin Page Settings (Continued)

  1. Upload the "Metadata" downloaded from Zoho to "Metadata" under "Service Provider Settings".
    07.png

  2. Click the "Save" button to save your settings.

TrustLogin User Settings

① When a user adds the app from My Page

  1. Click the "Add App" button on "My Page".
  2. On the "Register App" screen, select "Zoho (SAML)" and click the "Next" button in the upper right of the screen.
  3. If you want to change the "Display Name", enter it and click the "Save" button.

②When an administrator adds members

  1. Search for and click the "Zoho (SAML)" app in the "Admin Page > App" menu.
  2. Click "Add Member", select the user to add from the member list, and click the "Save" button to add them.

Zoho SAML JIT Setup Guide

Item

Details

Pre-check

  • Prior configuration in Zoho is required.
  • Domain ownership and verification are required to apply SAML JIT.

  • The user's "last name" and "first name" are synced only when a new user is created via SAML JIT. They are not automatically updated on subsequent logins.

  • This manual describes how to configure SAML in Zoho Accounts.
    For details and the latest setup steps, please refer to the manual provided by Zoho.
    SAML Authentication Configuration in Zoho Accounts

Name ID

Email address

Custom attribute Note: For how to configure custom attributes, see here

SP Configuration

Configured by the administrator

Request SP to configure

Provisioning

API-based Provisioning supported (account management available in TrustLogin)

SAML JIT Provisioning supported (account management available in TrustLogin; user deletion not supported)
Note: For setup instructions when provisioning is not required, see here

None (accounts created in each system)

Access Method

SP-Initiated SSO

IdP-Initiated SSO

Verified Operation by Device

PC - Browser

PC - Desktop App

iOS - Standard Browser (Safari)

iOS - TrustLogin Mobile App In-App Browser

iOS - Native App

Android - Standard Browser (Chrome)

Android - TrustLogin Mobile App In-App Browser

Android - Native App


TrustLogin Admin Page Settings

  1. Log in to TrustLogin, open the "Admin Page > App" menu, and click the "Register App" button in the upper right of the screen.
    01.png

  2. Search on the "Register Company App" screen and select "Zoho (SAML)".
    02.png

  3. Note down the value of "Identity Provider URL" under "Identity Provider Information", and download the certificate using the "Get Certificate" button.
    03.png

  4. Change the file extension of the downloaded certificate to ".cer" so that the certificate file is in CER format.


Now, switch to configuring Zoho.
Do not click the "Register" button yet — open Zoho in a separate window.

Zoho Settings

  1. Log in to Zoho Directory and open the admin console. From "Domains > Add Domain", enter the domain name to verify.
    Zoho02.png

  2. Follow the displayed instructions to configure the domain's DNS records, and once the values have propagated, click the "Verify" button. For instructions on configuring DNS records, please refer to your domain registrar's help documentation.
    Zoho03.png

    DNS record updates can take up to approximately 72 hours to propagate. If you cannot complete verification right away, click the "Cancel" button to close the page, and once the values have propagated, you can resume verification from the "Domains" page.
    zohodomain.png

  3. Log in to Zoho Accounts with an organization administrator account, open "Organization > SAML Authentication" from the left menu, and click the "Configure" button.
    04.png

  4. Configure each item as follows.
    Sign-in URL The "Identity Provider URL" obtained from TrustLogin
    Zoho Service After login, select the service to redirect to
    Name Identifier Email address
    X.509 Certificate The "Certificate" obtained from TrustLogin, converted to CER format

    05 (3).png

  5. Turn on the toggle for "Auto-create accounts (Just-In-Time provisioning)" and add attributes using the + button. Enter the following into the "Attributes of the service (Identity Provider) used for authentication", then click the "Send" button.
    First Name first_name
    Last Name last_name

    Zoho.png

  6. Download the "Metadata" using the "Download" button.
    Zoho01.png

Now return to the TrustLogin Admin Page again.

TrustLogin Admin Page Settings (Continued)

  1. Upload the "Metadata" downloaded from Zoho to "Metadata" under "Service Provider Settings".
    07.png

  2. Click the "Save" button to save your settings.

TrustLogin User Settings

① When a user adds the app from My Page

  1. Click the "Add App" button on "My Page".
  2. On the "Register App" screen, select "Zoho (SAML)" and click the "Next" button in the upper right of the screen.
  3. If you want to change the "Display Name", enter it and click the "Save" button.

②When an administrator adds members

  1. Search for and click the "Zoho (SAML)" app in the "Admin Page > App" menu.
  2. Click "Add Member", select the user to add from the member list, and click the "Save" button to add them.