I have been looking for a Two-Factor Authentication that works well with Zimbra open source edition.

One of the products I looked at - eToken PASS(http://www.safenet-inc.com/multi-factor-authentication/authenticators/one-time-password-otp/etoken-pass/) requires software running on Windows and I don't have any Windows servers in-house so will not work for me. Also, some of the users who are using Outlook won't be able to authenticate using this method.

More straight forward option was: http://www.safenet-inc.com/multi-factor-authentication/authenticators/pki-usb-authentication/. This is basically a SSL certificate in the USB key. Apparently this works with browsers as well as email clients and does't require any additional backend software for authentication. Does anyone have any experience integrating similar devices with Zimbra?

Another issue is that I only need this two-factor auth for a limited number of users on the server. Is this even possible?


If you are using the etoken (pki-usb-authentication) you will probably do Client Certificate authentication in the browser. This would require to reconfigure the Apache server to require a client certificate. And here is the problem. You can not determine which user is about to authenticate, before the user/browser provided the client certificate. Thus users without a token/client certificate will not easily be able to authenticate. Nevertheless in such a solution you could enroll eToken to one user group and soft certificates to another user group.

You could use eToken PASS as a one time password generator. The eToken PASS can also be seeded, so you do not need to trust the vendor and distributor. You should take a look at the smartdisplayer display cards. These can not be seeded but are really cool, as the have an ePaper display and they fit into your purse. As another hardware device you might take a look at the Yubikey, which again can be seeded.

Congrats. You have no windows server ;-) So why not use a linux based authentication backend like privacyidea? Which supports all tokens mentioned.

As far as Zimbra is concerned there are again two possibilities.

A. You configure your webserver so that you need to do the two factor authentication before getting to the zimbra login screen. But in this case you might get problems with your smartphone apps. (Which you also would run into with the client certificates)

B. Authenticate the user with 2fa just within zimbra. It looks like zimbra at least supports SAML. You can setup privacyidea as a SAML Identity Provider and Zimbra as Service Provider. The User authenticates to the IdP with two factors and then gets logged in to ZImbra. Recently I wrote a howto on setting up privacyidea as a SAML IdP.

Hope this helps as a starting point.

  • I agree fully with the SAML approach. – Sibin Grasic Dec 1 '14 at 0:06
  • Most commercial SAML identity providers will do 2FA. OSS/free IdPs will also do 2FA, you'll just have to get down and dirty with a lot of config. Caveat: will work with Zimbra web interface (ZWC) only. Will not work for IMAP or other access routes. – identigral Jan 6 '15 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.