Issue symptoms
Agents in the Support interface see inline images as broken links.
Conditions
An account has the three settings listed below.
- Help center is host-mapped.
- Attachments require authentication to download.
- Agents authenticate through SSO.
Resolution steps
This issue happens because of the way the three settings listed interact. With host mapping, end users see the host-mapped domain in the help center, but agents still use the Zendesk domain in the agent interface. Attachments are accessed through the host-mapped domain, so end users can see them.
With SSO, it's possible for agents to authenticate directly into the agent interface without going through the help center. SSO authenticates agents into the Zendesk domain, but not the host-mapped domain. When this happens, agents don't have permission to see attachments at first. The attachments are on the host-mapped domain. That's why inline images appear broken in the agent interface.
Agents can fix this issue at any time by opening Guide. To switch from Support to Guide, use the Zendesk Products icon.
SSO admins can fix this issue for all agents by including the host-mapped domain in their SSO.
Change the agent's return_to URL to be their host-mapped domain with /agent applied to the end.
For example, if mycompany.zendesk.com is host-mapped to support.mycompany.com, the return_to URL would be support.mycompany.com/agent. This will send agents directly to the agent interface with the host-mapped credentials applied. Additionally, ensure this method is used with agents only. End-users will result in an authentication error.
relay_state
or return_to_url
to have the browser take them there.
7 comments
CJ Johnson
I'm not seeing any way to add a domain to the SSO settings in Zendesk. What are the steps to implement this fix?
1
Brenda Cardinez
-1
CJ Johnson
The answer to my question, is that this lives under the "branding" settings, which is wildly un-intuitive.

0
Matti Ketonen
This SSO fix is not good. We are using a passwordless authentication via SAML for our customers and for our staff. We can't change the host mapping, as that would make our customers to get redirected to an area that they can't access.
0
Dane
SSO authentication for End users and Team Members have different section in the Admin Center. You can just try to set it up for the Team Member authentication to resolve the issue with inline images.
0
Brook Watson
Disabling "Enable secure downloads" provides a temporary fix, but that exposes our ticket attachments to the potential for bots to index those images. This exposes potentially sensitive client information.
Trying to append "/agent" to our host mapped domain generates additional zendesk errors where the CNAME does not match. Cannot add /agent to our CNAME entry in DNS, only accepts FQDN.
The root cause appears to be recent browser security enhancements around CORS. Haven't tried disabling the CORS and Cross Site browser security settings, but this appears to be why attachments that need to be authenticated from host mapped domains using 3rd party SSO providers no longer works.
1
Tim Spence
This resolution appears to fix the issue for Chrome users, but for Firefox you need to add an exception in the Enhanced Tracking Protection functionality for the Zendesk site itself, and the zdusercontent.com site where the attachment is stored.
For Safari, I can't find a way to add a site exception other than turning its protection off entirely.
1