Setting up SAML single sign-on with Okta

What's my plan?

Quick Look: Admin Center > Account > Security > Single sign-on

Okta supports single sign-on for Zendesk using SAML (Secure Assertion Markup Language). For many of the settings used to configure single sign-on in Okta, you'll find much more detailed information in the Okta user interface. For more about Single sign-on using SAML support in Zendesk, see Enabling SAML single sign-on.

Note: You can also set up enterprise single sign-on with JWT. See Enabling JWT (JSON Web Token) single sign-on.

Configuring SAML must be done in both in your Okta account and in Zendesk. You start in Okta first and get the SAML information you'll need to complete the configuration in Zendesk.

This article includes the following topics:

• Configuring SAML in Okta
• Configuring SAML in Zendesk
• Assign users to SAML single sign-on with Okta
• Switching authentication methods

Configuring SAML in Okta

Sign in to Okta as an administrator and then follow the steps below.

To configure SAML for Zendesk in Okta

1. In Okta, from the drop-down list in the upper-right corner, make sure you are using the Classic UI interface (not the Developer Console).
2. Select Add Applications from the dashboard.
3. Click Add Application, then search for and choose Zendesk. The Add Zendesk wizard appears.
4. On the first screen, General Settings, add a name for the application and your Zendesk subdomain. For example, if your Zendesk URL is mycompany.zendesk.com, enter mycompany). Click Next.
5. On the second screen, Sign-On Options, select SAML 2.0. This is where you'll find the SAML SSO URL, the Remote logout URL, and the Certificate fingerprint. You need this information to complete the SAML setup in Zendesk.
6. Click the SAML 2.0 setup instructions for Zendesk link.

   A page appears with instructions on how to configure SAML in Zendesk. See Configuring SAML in Zendesk below for the latest information.

7. Copy the SAML SSO URL, the Remote logout URL, and the Certificate fingerprint.

   You need this information to configure SAML in Zendesk. When you've finished copying, close this window and return to your Okta dashboard.

8. (Optional) If you enable User Management, you'll be able to import users from Zendesk into your Okta account, provision new Zendesk accounts from Okta, and push Okta user profile updates and passwords to Zendesk.

   You'll find information about these Okta features in your Okta account and documentation.

9. (Optional) People allows you to select who in your Okta account has access to Zendesk. This step is not covered in this article. You'll find information about these Okta features in your Okta account and documentation.
10. When you've completed each step, click Next to complete and close the Zendesk configuration in Okta.

Configuring SAML in Zendesk

When your Zendesk for Okta setup is complete and the information you need for setting up SAML in Zendesk is available, sign in to your Zendesk account as an admin and enable SAML single sign-on. You'll need the SAML SSO URL, the Remote logout URL, and the Certificate fingerprint from Okta to complete your set up.

Note: When you enable single sign-on via SAML or JWT, be aware that passwords do not expire even if your Zendesk password policy is set to high because passwords are not stored in Zendesk. Additionally, if agents manually add a Zendesk password to their account, these passwords will not expire.

Assign users to SAML single sign-on with Okta

After configuring SAML single sign-on with Okta, assign this SSO option to end users, staff members (agents and administrators), or both. For more information, see Assigning SAML SSO to users.

Switching authentication methods

Important: If you use a third-party SSO method to create and authenticate users in Zendesk, then switch to Zendesk authentication, these users will not have a password available for login. To gain access, ask these users to reset their passwords from the Zendesk sign in page.