Zendesk

This guide covers how to configure Zendesk ↗︎ as a SAML application in Cloudflare One.

• An identity provider configured in Cloudflare One
• Admin access to your Zendesk account

1. Go to your Zendesk administrator dashboard, typically available at <yourdomain>.zendesk.com/admin/security/sso.

2. In a separate tab or window, open the Cloudflare dashboard ↗︎, select your account, and go to Zero Trust > Access controls > Applications.

3. Select Create new application, then choose SaaS application.

4. Input the following values in the Cloudflare One application configuration:

   Cloudflare One field	Value
   Entity ID	https://<yoursubdomain>.zendesk.com
   Assertion Consumer Service URL	contents of SAML SSO URL in Zendesk account
   Name ID Format	Email

5. (Optional) Configure these Attribute Statements to include a user's first and last name:

   Cloudflare attribute name	IdP attribute value
   <first name>	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
   <last name>	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

   Zendesk will use the user's email address as their name ↗︎ if the name is not provided.

6. To determine who can access Zendesk, create an Access policy.

7. Copy the SSO Endpoint and Public Key.

8. Transform the public key into a fingerprint:

   1. Open a fingerprint calculator ↗︎.

   2. Paste the Public Key into X.509 cert.

   3. Wrap the value with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.

   4. Set Algorithm to SHA256 and select Calculate Fingerprint.

   5. Copy the Formatted FingerPrint value.

9. Add the Cloudflare values to the following Zendesk fields:

   Cloudflare IdP field	Zendesk field
   SSO Endpoint	SAML SSO URL
   Public Key (transformed to fingerprint)	Certificate Fingerprint

10. Go to https://<yourdomain>.zendesk.com/admin/security/staff_members and enable External Authentication > Single Sign On.

Users should now be able to log in to Zendesk if their Email address exists in the Zendesk user list.