# Zoho One > Integrate Zoho One with Ironchip over SAML: create the application, add the identity provider, format the X.509 certificate and enable the routing policy. URL: https://docs.ironchip.com/en/identidad/integraciones/saas/zoho-one/ Ironchip acts as the SAML identity provider for Zoho One. This guide explains how to configure both sides and assign the users who can authenticate with Ironchip. ## Requirements - Access to the Ironchip admin console. - A user with permissions to make the configuration in Zoho One. ## Configure Ironchip ### Create the SAML application 1. In the Ironchip admin console, go to **Applications** and click the green **New application** button. [Image: New application button in the Applications section of the Ironchip admin console] 2. In the dialog, select **SAML** under **Standard authentication protocols**. [Image: SAML selected among the standard authentication protocols] 3. Give the application a descriptive name, for example `Zoho One`. ### Get the Identity Provider data In the **Configure service** step of the application, open the **Identity Provider** tab. Under **Single Sign On Service**, copy these values, which you will need in Zoho One: - **SSO URL** (Single Sign On Service): this will be your sign-in URL in Zoho. - **SLO URL**: obtained by replacing `/sso` with `/slo` in the previous URL. - **X.509 certificate**: copy it with its copy button. [Image: Configure service step of the new application in Ironchip with the Single Sign On Service URL] ## Configure Zoho One ### Add the identity provider 1. Open the Zoho One admin panel. In the top menu, open the space selector and click **Manage spaces**. [Image: Space selector with the Manage spaces option] 2. In the left side panel, go to **Security** > **Identity provider** and click **Add identity provider**. [Image: Security section with the Add identity provider button] 3. Select the **SAML** type and fill in the fields with the data you copied from Ironchip: - **Sign-in URL**: paste the Ironchip SSO URL. - **Sign-out URL**: paste the same URL, changing `/sso` to `/slo`. - **Name ID format**: select **Email address**. - **X509 certificate**: upload the `.crt` file with the formatted certificate (see the next section). ### Format the X.509 certificate The certificate you copied from Ironchip must have the right format before you import it. 1. Go to . 2. Paste the certificate content into the **X.509 cert** field and click **FORMAT X.509 CERTIFICATE**. [Image: Tool to format an X.509 certificate with the FORMAT X.509 CERTIFICATE button] 3. Copy the result and save it as a text file with a `.crt` extension (for example, `SAMLcert.crt`). 4. Go back to Zoho One and import the `.crt` file into the **X509 certificate** field. [Image: Zoho One Add identity provider form with the Ironchip URLs and the SAMLcert.crt certificate] :::caution[Check the certificate format] A correctly formatted certificate starts with `-----BEGIN CERTIFICATE-----` and ends with `-----END CERTIFICATE-----`. If it does not have this format, sign-in fails. ::: ### Exchange the metadata When you save the identity provider in Zoho One, the system shows the Service Provider metadata. 1. Copy these values: - **EntityID** / **Issuer**. - **Assertion Consumer Service (ACS) URL**. [Image: Zoho One SSO configuration with the assertion consumer service URL and the issuer] 2. Go back to the Ironchip admin console, open the SAML application you created and open the **Service Provider** tab. 3. Paste the copied values into the matching fields and save the changes. [Image: Entity ID and Assertion Consumer Services fields of the SAML application in Ironchip] ### Enable the identity provider in the policy 1. In Zoho One, go to **Security** > **Routing policies** and edit the **Default** policy. [Image: Routing policies with the Default policy] 2. Open the **Authentication modes** tab, turn on the **Identity provider** option and select the Ironchip checkbox. 3. Click **Update**. [Image: Policy authentication modes with the Ironchip identity provider selected] ## Generate access for users 1. Go back to the Ironchip admin console and finish creating the application by clicking **ADD**. 2. In **Your applications**, find the application and, in the **Add access** column, click **Add**. 3. Assign the users or groups who can authenticate in Zoho One through Ironchip. [Image: Ironchip Your applications list with the Add button in the Add access column next to Zoho One] ## Verify the integration 1. Ask a user you gave access to sign in to Zoho One with the Ironchip identity provider. 2. Zoho One redirects the user to Ironchip to authenticate. 3. When the user completes the authentication on their device, they return to Zoho One with their session started. ## Troubleshooting | Problem | Likely cause | Solution | | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | | Sign-in fails after importing the certificate | The certificate does not have the right format | Format it again with the tool above and check that it starts with `-----BEGIN CERTIFICATE-----` and ends with `-----END CERTIFICATE-----` | | Zoho One does not recognize the user | The **Name ID format** is not **Email address**, or the username of the access in Ironchip is not the user's email | Fix the format in Zoho One and edit the user's access to the application in Ironchip to set the username to their Zoho One email | | The user cannot authenticate | The user has no access to the application in Ironchip | In the application's **Add access** column, click **Add** and assign the user or their group |