On our fresh ZCS test environment, the Zimbra Social zimlet works fine.

On our production system, originally built at the 4.0.3 version, the Zimbra social zimlet throws Jetty /service/proxy 403 errors, like many others have reported here in the forums on various threads.

Using rrao's suggestion to create a new COS, we found that new COSs created under ZCS version 6 have the proper zimbraProxyAllowedDomains configured, but when upgrading from a version of ZCS earlier than 6.0.x, COSs in existence at the time of the upgrade do not get these parameters added.

Internally, we all use a COS called "reliablenetworks". We created a new COS called "relnet" and did the following:

Code:
zimbra@viognier:~> zmprov gc reliablenetworks > /tmp/cos_reliablenetworks
zimbra@viognier:~> zmprov gc relnet> /tmp/cos_relnet
After moving those files elsewhere, we ran a diff against them:

Code:
lmstone@ibm-r52:~/Desktop> diff cos_relnet cos_reliablenetworks | grep zimbraProxyAllowedDomains< zimbraProxyAllowedDomains: api.tr.im
< zimbraProxyAllowedDomains: api.bit.ly
< zimbraProxyAllowedDomains: *.twitter.com
< zimbraProxyAllowedDomains: *.tweetmeme.com
< zimbraProxyAllowedDomains: *.yimg.com
< zimbraProxyAllowedDomains: *.yahoo.com
< zimbraProxyAllowedDomains: *.digg.com
< zimbraProxyAllowedDomains: *.yahooapis.com
< zimbraProxyAllowedDomains: *.facebook.com
< zimbraProxyAllowedDomains: twitter.com
< zimbraProxyAllowedDomains: *.calcxml.com
< zimbraProxyAllowedDomains: *.maxmind.com
< zimbraProxyAllowedDomains: *.csgnetwork.com
lmstone@ibm-r52:~/Desktop>
So then all we needed to do was add those domains into the old, pre-existing COS:

Code:
zimbra@viognier:~> zmprov mc reliablenetworks +zimbraProxyAllowedDomains api.tr.im
zimbra@viognier:~> zmprov mc reliablenetworks +zimbraProxyAllowedDomains api.bit.ly
zimbra@viognier:~> zmprov mc reliablenetworks +zimbraProxyAllowedDomains *.twitter.com
zimbra@viognier:~> zmprov mc reliablenetworks +zimbraProxyAllowedDomains *.tweetmeme.com
zimbra@viognier:~> zmprov mc reliablenetworks +zimbraProxyAllowedDomains *.yimg.com     
zimbra@viognier:~> zmprov mc reliablenetworks +zimbraProxyAllowedDomains *.yahoo.com
zimbra@viognier:~> zmprov mc reliablenetworks +zimbraProxyAllowedDomains *.digg.com 
zimbra@viognier:~> zmprov mc reliablenetworks +zimbraProxyAllowedDomains *.yahooapis.com
zimbra@viognier:~> zmprov mc reliablenetworks +zimbraProxyAllowedDomains *.facebook.com
zimbra@viognier:~> zmprov mc reliablenetworks +zimbraProxyAllowedDomains twitter.com   
zimbra@viognier:~> zmprov mc reliablenetworks +zimbraProxyAllowedDomains *.calcxml.com
zimbra@viognier:~> zmprov mc reliablenetworks +zimbraProxyAllowedDomains *.maxmind.com
zimbra@viognier:~> zmprov mc reliablenetworks +zimbraProxyAllowedDomains *.csgnetwork.com
zimbra@viognier:~>
After doing that, accounts in the old reliablenetworks COS now worked fine with the social zimlet and we deleted the test relnet COS.

Hope that helps,
Mark

P.S. And yes, we do name our Zimbra servers after wines!