Skip to content
IronchipIronchipIronchip Documentation

Zoho One

Ironchip acts as the SAML identity provider for Zoho One. This guide explains how to configure both sides and assign the users who can authenticate with Ironchip.

Requirements

Section titled “Requirements”
  • Access to the Ironchip admin console.
  • A user with permissions to make the configuration in Zoho One.

Configure Ironchip

Section titled “Configure Ironchip”

Create the SAML application

Section titled “Create the SAML application”

  1. In the Ironchip admin console, go to Applications and click the green New application button.

    New application button in the Applications section of the Ironchip admin console

  2. In the dialog, select SAML under Standard authentication protocols.

    SAML selected among the standard authentication protocols

  3. Give the application a descriptive name, for example Zoho One.

Get the Identity Provider data

Section titled “Get the Identity Provider data”

In the Configure service step of the application, open the Identity Provider tab. Under Single Sign On Service, copy these values, which you will need in Zoho One:

  • SSO URL (Single Sign On Service): this will be your sign-in URL in Zoho.
  • SLO URL: obtained by replacing /sso with /slo in the previous URL.
  • X.509 certificate: copy it with its copy button.

Configure service step of the new application in Ironchip with the Single Sign On Service URL

Configure Zoho One

Section titled “Configure Zoho One”

Add the identity provider

Section titled “Add the identity provider”

  1. Open the Zoho One admin panel. In the top menu, open the space selector and click Manage spaces.

    Space selector with the Manage spaces option

  2. In the left side panel, go to Security > Identity provider and click Add identity provider.

    Security section with the Add identity provider button

  3. Select the SAML type and fill in the fields with the data you copied from Ironchip:

    • Sign-in URL: paste the Ironchip SSO URL.
    • Sign-out URL: paste the same URL, changing /sso to /slo.
    • Name ID format: select Email address.
    • X509 certificate: upload the .crt file with the formatted certificate (see the next section).

Format the X.509 certificate

Section titled “Format the X.509 certificate”

The certificate you copied from Ironchip must have the right format before you import it.

  1. Go to https://www.samltool.com/format_x509cert.php.

  2. Paste the certificate content into the X.509 cert field and click FORMAT X.509 CERTIFICATE.

    Tool to format an X.509 certificate with the FORMAT X.509 CERTIFICATE button

  3. Copy the result and save it as a text file with a .crt extension (for example, SAMLcert.crt).

  4. Go back to Zoho One and import the .crt file into the X509 certificate field.

    Zoho One Add identity provider form with the Ironchip URLs and the SAMLcert.crt certificate

Exchange the metadata

Section titled “Exchange the metadata”

When you save the identity provider in Zoho One, the system shows the Service Provider metadata.

  1. Copy these values:

    • EntityID / Issuer.
    • Assertion Consumer Service (ACS) URL.

    Zoho One SSO configuration with the assertion consumer service URL and the issuer

  2. Go back to the Ironchip admin console, open the SAML application you created and open the Service Provider tab.

  3. Paste the copied values into the matching fields and save the changes.

    Entity ID and Assertion Consumer Services fields of the SAML application in Ironchip

Enable the identity provider in the policy

Section titled “Enable the identity provider in the policy”

  1. In Zoho One, go to Security > Routing policies and edit the Default policy.

    Routing policies with the Default policy

  2. Open the Authentication modes tab, turn on the Identity provider option and select the Ironchip checkbox.

  3. Click Update.

    Policy authentication modes with the Ironchip identity provider selected

Generate access for users

Section titled “Generate access for users”

  1. Go back to the Ironchip admin console and finish creating the application by clicking ADD.

  2. In Your applications, find the application and, in the Add access column, click Add.

  3. Assign the users or groups who can authenticate in Zoho One through Ironchip.

    Ironchip Your applications list with the Add button in the Add access column next to Zoho One

Verify the integration

Section titled “Verify the integration”
  1. Ask a user you gave access to sign in to Zoho One with the Ironchip identity provider.
  2. Zoho One redirects the user to Ironchip to authenticate.
  3. When the user completes the authentication on their device, they return to Zoho One with their session started.

Troubleshooting

Section titled “Troubleshooting”
Problem Likely cause Solution
Sign-in fails after importing the certificate The certificate does not have the right format Format it again with the tool above and check that it starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----
Zoho One does not recognize the user The Name ID format is not Email address, or the username of the access in Ironchip is not the user’s email Fix the format in Zoho One and edit the user’s access to the application in Ironchip to set the username to their Zoho One email
The user cannot authenticate The user has no access to the application in Ironchip In the application’s Add access column, click Add and assign the user or their group

© 2026 IRONCHIP TELCO, S.L. All rights reserved. For AI assistants: every page has a Markdown version (add .md to the URL) and the index is at /llms.txt.