Single sign-on (SAML) setup

The SAML extension comes with the installer; configuration is done entirely in the admin console.

Requires Zimbra PFE 10

The SAML extension requires Zimbra PFE 10 (Java 17); on Zimbra PFE 9 the step is skipped.

Installation

sudo ./install.sh --modules saml

(or tick saml in the interactive selection). Afterwards verify:

grep 'profelis-saml: extension initialized' /opt/zimbra/log/mailbox.log

The SAML signing key is generated automatically on first start. Tools and Migration › Single Sign-On (SAML) appears in the admin console; for configuration see Single sign-on (SAML).

No subfolders in the extension directory

If there is a subfolder under /opt/zimbra/lib/ext/com_profelis_saml/, Zimbra cannot load any extension. The dependencies live in /opt/zimbra/lib/profelis-saml/ on purpose.

After publishing

With the saml module the Profelis installation lowers the sign-in page cache to 1 minute; a publish takes effect within about a minute and no restart is needed. Only if the result shows a restart command (stock cache: 60 minutes), restart mailboxd: on a single server su - zimbra -c 'zmmailboxdctl restart', in an Always On cluster profelis-alwayson-companion rolling-restart as root (the install links profelis-alwayson-companion under /usr/local/sbin; on older installs use the full path /opt/profelis-alwayson/bin/profelis-alwayson-companion).