Plan requirement
| Subscription | Any plan |
| Access | Admin |
Connecting Zendesk to Active Directory through ADFS. Same principles as any SAML setup, with its own details.
Set it up
- Add Zendesk as a relying party trust in ADFS.
- Configure the claim rules, including the email address.
- Restrict access to the right security group.
- In Admin Center, click Account in the sidebar, select Security > Single sign-on, click Create SSO configuration and choose SAML.
- Enter the SAML SSO URL, the Remote logout URL and the Certificate fingerprint (SHA2), and decide whether this applies to team members, end users or both.
- Test with one account in a private window.
ADFS is SAML, so the Zendesk side is the same as any other SAML provider. What differs is the claim rules and the certificate rollover, which is where this setup goes wrong.
The email claim is the critical one
Zendesk matches people by email address. Directory accounts sometimes hold a login name that is not the mail address, and sending the wrong one either fails or creates duplicate users.
Verify what the claim contains for a real account.
Restrict by security group
Rather than allowing everybody in the directory. Then Zendesk access follows group membership, which is what makes joining and leaving automatic.
Certificates expire
ADFS certificates roll over, and when one does without Zendesk being updated, sign-in stops for everybody at once.
Put the renewal in a calendar.
Internal and external access
ADFS is often reachable inside the network and through a proxy outside it. Agents working from home use a different path, so test both rather than only the office.
Keep a way in
Test in a private window with an admin session still open. A broken trust with no fallback locks out everybody, including whoever would fix it.
Involve the directory team
Claim rules and certificates belong to whoever runs ADFS. Contact pluscloud support and we will work through the Zendesk side with them.
Comments
0 comments
Article is closed for comments.