Plan requirement
| Subscription | Suite Professional or higher, Support Professional or higher |
| Access | Admin |
The other standard for connecting an identity provider. Same purpose as SAML, and the same two things go wrong.
Set it up
- Register Zendesk as an application with your provider.
- Take the client details it gives you.
- Enter them in the authentication settings.
- Set the scopes so the email address is included.
- Test with one account in a private window.
SAML or OpenID Connect
Both do the same job. Use whichever your identity provider supports best, and if it supports both, use the one your organisation already uses elsewhere.
Running both at once is a configuration nobody will remember the reasons for.
Scopes decide what arrives
If the email scope is not requested, Zendesk does not receive an address and cannot identify the person. This is the most common setup failure and it presents as a confusing error.
Redirect addresses must match exactly
Providers reject anything that does not match what was registered, down to the trailing slash. Copy it rather than typing it.
Test with a session still open
Private window, ordinary admin session untouched. If it goes wrong you can still reach the settings.
Then close the old route
Disable Zendesk passwords for team members once it works. Otherwise the account is still reachable by a path your provider does not govern, and the offboarding benefit is theoretical.
Watch the credentials
Client secrets can expire or be rotated. When one is, sign-in stops for everybody, so note the date wherever your team tracks such things.
Comments
0 comments
Article is closed for comments.