How can I set up multiple Zendesk SSO integrations in separate help centers?

How can I set up separate Zendesk single sign-on integrations for each help center?

The default Zendesk authentication method allows you to create multiple single sign-on (SSO) options. To set up multiple Zendesk SSO integrations in separate help centers, you can use the don't choose option and show different buttons for different SSO logins. Alternatively, you can follow the workaround below.

To create this workflow:

Set a primary SSO method. The primary method applies when a user selects button names from the help center or navigates directly to the sign-in link.

Set a non-primary SSO method. The non-primary method requires users to sign in with an identity provider-initiated (IDP-initiated) sign-in instead of a service provider (SP). This configuration is for users who start at the SSO provider sign-in page, such as Okta. You can use the provider sign-in page to authenticate into Zendesk and other sites.

Ensure IDP-initiated sign-ins have the proper shared secret for JSON Web Token (JWT) or certificate for Security Assertion Markup Language (SAML) to authenticate users.

For more information on how to host a script to allow multiple identity providers without requiring IDP-initiated logs, see Multibrand - Using multiple JWT Single Sign-on URL's.

See the image below to compare the sign-in steps of IDP and SP. The examples use SAML but work similarly to JWT.

SP initiated login:

IDP initiated login:

Note: You can have both SAML and JWT active with JWT as the default. For example, create an “Agent tab" on your custom landing page for JWT.

For more information on SSO, see Single sign-on (SSO) options in Zendesk.