Zimbra FOSS Two Factor Authentication: 5 Easy Steps

Zimbra FOSS two factor authentication is a login that asks for a second code after the password. The first version of this post, written in 2019, announced a community project and then added a long step list. Most of those steps cannot be traced to any Zimbra documentation: they used zmprov attributes that do not appear in the Administrator Guide, and they told you to run apt upgrade on a Zimbra server. This rewrite keeps what can be checked and removes the rest.

How this article was written: there is no Zimbra server in the author's lab, so nothing here is a fresh test and no command output is shown. The facts about the Admin Console come from the Zimbra Administrator Guide, section "Two Factor Authentication", read on 2026-11-01. The guide does not say which edition (Network or open source) includes each option, so check the feature list of your own version before you plan a rollout.

Contents

• What the 2019 post was about
• Where Zimbra FOSS two factor authentication is configured today
• The four Zimbra FOSS two factor authentication settings
• A safe rollout plan for Zimbra FOSS two factor authentication
• Mistakes to avoid with Zimbra FOSS two factor authentication
• FAQ

What the 2019 post was about

The original post pointed to a crowdfunding page for a community project, and listed what the project would deliver: a patch for the login screen that accepts a code, PrivacyIDEA and a PrivacyIDEA LDAP proxy in Docker containers to manage the tokens, a Zimlet for the web client with a Java SOAP extension on the server, installation documentation, and everything released under GNU GPLv2. This is the plan of that project as it was written then. The crowdfunding page now answers with an error (HTTP 403 when checked), and the project repository could not be found again, so the article cannot tell you that those parts are available.

If you need a token-based setup with PrivacyIDEA, check the current state of the project first.

Where Zimbra FOSS two factor authentication is configured today

According to the guide, the 2FA function lets you set a second set of security requirements for any or all critical mailboxes. You can set it for user accounts, for a class of service (COS), or both. All of it is done in the Admin Console, in a container called "Two Factor Authentication":

• New account: Home, Add Accounts, Add Account, click Next until Advanced, then scroll down to Two Factor Authentication.
• Existing account: Home, Manage, Accounts, select the account, Edit from the gear icon, Advanced in the left panel, then the Two Factor Authentication container.
• Class of service: Home, Configure, Class of Service, the COS, Advanced, Two Factor Authentication.

For Zimbra FOSS two factor authentication, using the COS is the easier way for many users, because every account in that class gets the same rule. This is the correct answer to "how do I enable it for bulk users"; the old post suggested a zmprov ma command, but no such 2FA attribute is named in the guide.

The four Zimbra FOSS two factor authentication settings

The Two Factor Authentication container, summarised from the Administrator Guide.

The guide lists the same four parameters for accounts and for a COS. Here they are, with the wording of the guide:

Setting	What the guide says
Enable two factor authentication	Enable or disable the function for the selected account or COS.
Require two-step authentication	Make the use of the function mandatory.
Number of one-time codes to generate	The maximum number of 6-digit passcodes the account can view and use. The passcode is shown once the first login credentials are accepted, and each passcode lives for 15 seconds.
Enable application passcodes	Users can generate exception codes for legacy applications that do not support two-factor authentication.

The practical meaning of these Zimbra FOSS two factor authentication options is simple. The first switch turns the feature on, so a user can enrol. The second switch makes it compulsory, and until you set it, people can keep using only a password. The third controls how many codes are generated, and the 15-second life of a code is short, so a user must type it quickly. The fourth is the one that prevents support calls: an IMAP or POP client on a phone or an old desktop program cannot show a second prompt, so it needs a separate application passcode.

A safe rollout plan for Zimbra FOSS two factor authentication

The guide does not give a rollout plan for Zimbra FOSS two factor authentication, so the list below is advice built from its settings, not a tested procedure:

1. Create a test COS with "Enable two factor authentication" on and "Require" off, and move one test account into it. Use zmprov to create the account and check its status before and after.
2. Log in to the web client with the test account and confirm the second code is requested and accepted within 15 seconds.
3. Turn on application passcodes and test every mail client you support. Generate one passcode per application.
4. Only then move real users, a group at a time, and set "Require" on the COS when everyone has enrolled.
5. Keep one administrator account outside the rule until you are sure that nobody is locked out.

Mistakes to avoid with Zimbra FOSS two factor authentication

• Following Zimbra FOSS two factor authentication steps with attributes such as zimbraTwoFactorAuthEnabled or zimbraTwoFactorAuthMandatory from the old post. They are not in the guide, so do not run them on a production server.
• Running apt upgrade as a "Zimbra update". Zimbra has its own upgrade procedure; see the Administrator Guide and the posts about the Zimbra LDAP multi-master install before you touch a production system.
• Making 2FA mandatory before application passcodes are enabled, which locks legacy mail clients out.
• Assuming the second code protects mail clients that connect over IMAP; the guide says legacy applications "do not support two-factor authentication" and use exception codes.

FAQ

Is Zimbra FOSS two factor authentication free? The guide does not tie the function to a licence, and the old claim "free of charge" was not verified. Check your edition.

Do I need Google Authenticator? The guide does not name an authenticator app, and it does not use the word TOTP, so the old instructions to scan a QR code are not backed by it. Follow the enrolment screen of your own version.

Can I use it for a whole domain? The guide describes accounts and classes of service. Put the domain's users in one COS to cover them.