Zm SSO is the Zimbra Collaboration Open Source Edition extension for single sign-on authentication to the Zimbra Web Client.
Copyright (C) 2020-present iWay Vietnam and/or its affiliates. All rights reserved.
dnf -y install java-11-openjdk java-11-openjdk-devel maven ant git make rpmdevtools rpm-build
yum -y install java-11-openjdk java-11-openjdk-devel maven ant git make rpmdevtools rpm-build
apt install -y openjdk-11-jdk maven ant git make
mkdir -p ~/projects/zimbra
cd ~/projects/zimbra
git clone https://github.com/iwayvietnam/zm-sso.git
cd ~/projects/zimbra/zm-sso
mvn clean package
The output should be like this:
--- maven-jar-plugin:3.0.2:jar (default-jar) @ zm-hab ---
Building jar: ~/projects/zimbra/zm-sso/target/zm-sso-1.0.0-1.jar
cd ~/projects/zimbra/zm-sso
ant jar
The output should be like this:
[jar] Building jar: ~/projects/zimbra/zm-sso/dist/zm-sso-1.0.0-1.jar
cd ~/projects/zimbra/zm-sso
make rpmbuild
The output should be like this:
Wrote: ~/rpmbuild/RPMS/noarch/zm-sso-1.0.0-1.el7.noarch.rpm
cd ~/projects/zimbra/zm-sso
ssh root@zimbra.server "mkdir -p /opt/zimbra/lib/ext/zm-sso"
scp target/*.jar root@zimbra.server:/opt/zimbra/lib/ext/zm-sso
scp target/dependencies/*.jar root@zimbra.server:/opt/zimbra/jetty_base/common/lib
scp conf/zm.sso.properties root@zimbra.server:/opt/zimbra/conf
ssh root@zimbra.server "su - zimbra -c '/opt/zimbra/bin/zmmailboxdctl restart'"
ssh root@zimbra.server "mkdir -p /tmp/zimbra"
scp ~/rpmbuild/RPMS/noarch/zm-sso-1.0.0-1.el7.noarch.rpm root@zimbra.server:/tmp/zimbra
ssh root@zimbra.server "rpm -Uvh /tmp/zimbra/zm-sso-1.0.0-1.el7.noarch.rpm"
The settings loaded from zm.sso.properties file. The location of this file is /opt/zimbra/conf/zm.sso.properties
vi /opt/zimbra/conf/zm.sso.properties
sso.defaultClient = SAML2Client
To handle authentication, a callback endpoint is necessary to receive callback calls from the identity server and finish the login process.
Config:
sso.callbackUrl = https://mail.zimbra-server.com/service/extension/sso/callback
saml.callbackUrl = https://mail.zimbra-server.com/service/extension/saml/callback
cas.callbackUrl = https://mail.zimbra-server.com/service/extension/cas/callback
oidc.callbackUrl = https://mail.zimbra-server.com/service/extension/oidc/callback
To handle the logout, a logout endpoint is necessary to perform:
Config:
First, if you don’t have one, you need to generate a keystore for all signature and encryption operations. Ex:
keytool -genkeypair -alias samlkey -keypass samlpasswd -keystore /opt/zimbra/conf/saml/keystore.jks -storepass samlpasswd -keyalg RSA -keysize 2048 -validity 3650
Config:
saml.keystorePath = file:/opt/zimbra/conf/saml/keystore.jks
saml.identityProviderMetadataPath = https://samltest.id/saml/idp
saml.serviceProviderEntityId = https://mail.zimbra-server.com/service/extension/saml/metadata
cas.loginUrl = https://cas.cas-server.com/cas/login
cas.protocol = CAS20
oidc.discoveryUri = https://demo.c2id.com/.well-known/openid-configuration
# SSO login by using default client. Specified in sso.defaultClient
zmprov md yourdomain.com zimbraWebClientLoginURL https://mail.zimbra-server.com/service/extension/sso/login
# or SSO login by using SAML client
# zmprov md yourdomain.com zimbraWebClientLoginURL https://mail.zimbra-server.com/service/extension/saml/login
# or SSO login by using CAS client
# zmprov md yourdomain.com zimbraWebClientLoginURL https://mail.zimbra-server.com/service/extension/cas/login
# or SSO login by using OpenID Connect client
# zmprov md yourdomain.com zimbraWebClientLoginURL https://mail.zimbra-server.com/service/extension/oidc/login
# Specified logout URL
zmprov md yourdomain.com zimbraWebClientLogoutURL https://mail.zimbra-server.com/service/extension/sso/logout
zimbra
user for global configuration:
# SSO login by using default client. Specified in sso.defaultClient
zmprov mcf zimbraWebClientLoginURL https://mail.zimbra-server.com/service/extension/sso/login
# or SSO login by using SAML client
# zmprov mcf zimbraWebClientLoginURL https://mail.zimbra-server.com/service/extension/saml/login
# or SSO login by using CAS client
# zmprov mcf zimbraWebClientLoginURL https://mail.zimbra-server.com/service/extension/cas/login
# or SSO login by using OpenID Connect client
# zmprov mcf zimbraWebClientLoginURL https://mail.zimbra-server.com/service/extension/oidc/login
# Specified logout URL
zmprov mcf zimbraWebClientLogoutURL https://mail.zimbra-server.com/service/extension/sso/logout
zimbra
user to restart Zimbra server: zmcontrol restart
This is primarily for allowance of untrusted ssl certificates in external data sources.
openssl s_client -servername idp.server.net -connect idp.server.net:443 </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' >/path/to/cert.pem
zmcertmgr addcacert /path/to/cert.pem
zmmailboxdctl restart
zmprov -l mcf +zimbraCsrfAllowedRefererHosts idp.server.net
zmmailboxdctl restart
Zm SSO is licensed under the GNU AFFERO GENERAL PUBLIC LICENSE, Version 3. See LICENSE for the full license text.