#Setting up Zoho SAML with Authentik

1 messages · Page 1 of 1 (latest)

lunar valley
#

Hi everyone, I've been stuck for a few days and can't figure out the problem.

When I upload the metadata, it shows that the format is being passed:
md:NameIDFormaturn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
md:NameIDFormaturn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
md:NameIDFormaturn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat>
md:NameIDFormaturn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
but again, I don’t understand why this is happening:
saml:Subject
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">7</saml:NameID>
</saml:Subject>
I’m going through all the options in the identity provider, and it always returns unspecified.

Even though I’ve tried using all the standard NameID formats, it always returns unspecified.

candid panther
#

Is this when you initiate the sign in flow from Authentik? I've noted I can only get the saml integration working if I initiate the login flow from the zoho side.

lunar valley
#

@candid panther yes, I try to integrate zoho and Authentik.
the XML file zoho is
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="zoho.eu">
<md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
ds:X509Data
ds:X509Certificate==</ds:X509Certificate></ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:KeyDescriptor use="encryption">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
ds:X509Data
ds:X509Certificate==</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://accounts.zoho.eu/logout/samlsp/20087073645"/>
md:NameIDFormaturn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://accounts.zoho.eu/signin/samlsp/20087073645" index="0" isDefault="true"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://accounts.zoho.eu/signin/samlsp/20087073645" index="1"/>
</md:SPSSODescriptor>
</md:EntityDescriptor>

Answer Zoho Support
“Invalid Email Address”
Reason: The SAML response received from the IdP uses the NameID format as Unspecified, whereas Zoho is configured to expect the NameID format as Email.

Resolution:

To resolve this issue, please update the configuration on your IdP (Authentik) and set the NameID format to Email instead of Unspecified.

#

when I log To Zoho from Authentik
the SAML Provider

image.png
#

and I get format:unspecified
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
saml:Subject
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">[email protected]</saml:NameID>
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData NotOnOrAfter="2025-05-13T15:53:54Z"
Recipient="https://accounts.zoho.eu/signin/samlsp/20087073645"
/>
</saml:SubjectConfirmation>
</saml:Subject>
<saml:Conditions NotBefore="2025-05-13T15:43:54Z"
NotOnOrAfter="2025-05-13T15:53:54Z"
/>
<saml:AuthnStatement AuthnInstant="2025-05-13T15:48:43Z"
SessionIndex="c10c66aec59b63badc63992ff50be558593bd07747256ed6a783f4d37da4d162"
SessionNotOnOrAfter="2025-07-12T15:48:54Z"
>
saml:AuthnContext
saml:AuthnContextClassRef[email protected]</saml:AuthnContextClassRef>
</saml:AuthnContext>
</saml:AuthnStatement>
saml:AttributeStatement
<saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
saml:AttributeValue[email protected]</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
</saml:Assertion>
</samlp:Response>

image.png
lunar valley
#

@candid panther hello, any ideas?