Setting up Single Sign On (SSO) for Sell accounts

<div class="body">
<div class="docs-wmp-link" style="text-align: right; font-size: 0.8em;">
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" target="_blank">What's my plan?</a>
</div>
<img alt="Available on all Sell plans" id="topic_tqr_m2l_dkb__image_kqh_lnc_qnb" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/plan_available_sell_all.png" width="850">
<p class="p">
Single Sign On (SSO) is available across all Sell plans for Zendesk Sell
accounts. If
your Sell account was created after January 7, 2020, or has been migrated
to Zendesk,
then it is a Zendesk Sell account. If your account was created before
January 7, 2020,
and has not yet been migrated, then it is a legacy Sell account.
</p>
<p class="p">This article covers the following topics:</p>
<div class="p">
<ul class="ul" id="topic_tqr_m2l_dkb__ul_xv1_txc_qnb">
<li class="li">
<a class="xref" href="#topic_lzr_xxc_qnb">Zendesk Sell accounts: Setting up
SSO</a>
</li>
<li class="li">
<a class="xref" href="#topic_a2w_fyc_qnb">Legacy Sell accounts: Setting up
SSO</a>
</li>
<li class="li">
<a class="xref" href="#topic_ojq_gyc_qnb">Logging in to Zendesk Sell with
SSO enabled</a>
</li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_lzr_xxc_qnb">
<h2 class="title topictitle2" id="ariaid-title2">Setting up SSO for Zendesk Sell accounts</h2>
<div class="body">
<p class="p">
For Zendesk accounts, all SSO settings are managed through the Zendesk
Admin
Center.
</p>
<p class="p">
<strong class="ph b">To set up SSO for a Zendesk Sell account</strong>
</p>
<ol class="ol" id="topic_lzr_xxc_qnb__ol_bvd_j3l_dkb">
<li class="li">
If you have multiple Zendesk products, you can access the Admin
Center directly
from your
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408839227290-Using-Zendesk-Admin-Center" target="_blank">Product Tray</a>.
<p class="p">
Alternatively, in
Sell, click <strong class="ph b">Settings</strong> (<img class="image" height="20" id="topic_lzr_xxc_qnb__image_hdb_bxw_jkb" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/settings_icon.png" width="20">),
then select
<strong class="ph b"><a class="xref" href="https://app.futuresimple.com/settings/sso" target="_blank">Integrations &gt; Single Sign On</a></strong>.
</p>
</li>
<li class="li">
Click <strong class="ph b">Configure</strong>.
<p class="p">
A new window opens for the Zendesk Admin
Center.
</p>
</li>
<li class="li">
Follow the guidance in
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408887505690-Enabling-SAML-single-sign-on#topic_1ms_gf3_l3" target="_blank">Enabling SAML single sign-on</a>
or
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408845838874" target="_blank">Enabling JWT single sign-on</a>
to set up
SSO.
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_a2w_fyc_qnb">
<h2 class="title topictitle2" id="ariaid-title3">Setting up SSO for legacy Sell accounts</h2>
<div class="body">
<div class="section" id="topic_a2w_fyc_qnb__section_ac1_n2l_dkb">
For legacy Sell accounts, all SSO settings are managed
directly in Sell. You must have admin rights to set up SSO in Sell.
<p class="p">
<strong class="ph b">To set up
SSO for a legacy Sell account</strong>
</p>
<ol class="ol" id="topic_a2w_fyc_qnb__ol_cc1_n2l_dkb">
<li class="li">
In Sell, click <strong class="ph b">Settings</strong> (<img class="image" height="20" id="topic_a2w_fyc_qnb__image_czn_t1x_jkb" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/settings_icon.png" width="20">),
then select
<strong class="ph b"><a class="xref" href="https://app.futuresimple.com/settings/sso" target="_blank">Integrations &gt; Single Sign On</a></strong>.
</li>
<li class="li">
Click <strong class="ph b">Configure</strong>.
<p class="p">
You'll see the Zendesk Sell account UUID, Service
Provider Issuer ID, and Service Provider Assertion Consumer
Service URL
information on this page. You'll need to provide this
information to
your identity provider.
</p>
</li>
<li class="li">
Select <strong class="ph b">Automatic Setup</strong> or
<strong class="ph b">Manual Setup</strong>.
</li>
<li class="li">
If you select <strong class="ph b">Automatic Setup</strong>,
enter the metadata URL for your
identity provider.
<p class="p">
Most identity providers offer one URL to transfer this
information.
</p>
</li>
<li class="li">
If your Identity Provider doesn't provide a single URL for
configuration,
select <strong class="ph b">Manual Setup</strong>, then enter
the following information:
<ul class="ul" id="topic_a2w_fyc_qnb__ul_jhy_h1d_qnb">
<li class="li">
Identity Provider Issuer ID, for example,
http://yourdomain/adfs/services/trust" target="_blank"http://yourdomain/adfs/services/trust.
</li>
<li class="li">
Identity Provider SSO URL, for example,
https://yourdomain/adfs/ls" target="_blank"https://yourdomain/adfs/ls.
</li>
<li class="li">
Identity Provider certificate fingerprint. This is
the SHA-1
fingerprint of the token signing certificate installed
in the ADFS
instance.
</li>
</ul>
</li>
<li class="li">
Click <strong class="ph b">Save</strong>.
<p class="p">You have now configured your SSO settings.</p>
<p class="p">
The
following table lists the parameter name, parameter value,
and any
comments about each SSO setting.
</p>
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" frame="border" id="topic_a2w_fyc_qnb__table_gc1_n2l_dkb" rules="all" style="margin-left: 0px; margin-right: auto;" summary="">
<colgroup>
<col>
<col>
<col>
</colgroup>
<tbody class="tbody">
<tr class="row">
<td class="entry nocellnorowborder" style="vertical-align: top;">
<strong class="ph b">Parameter Name</strong>
</td>
<td class="entry nocellnorowborder" style="vertical-align: top;">
<strong class="ph b">Parameter Value</strong>
</td>
<td class="entry cell-norowborder" style="vertical-align: top;">
<strong class="ph b">Comments</strong>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" style="vertical-align: top;">Single Sign On URL</td>
<td class="entry nocellnorowborder" style="vertical-align: top;">
Service Provider Assertion Consumer Service
URL value
from Zendesk Sell settings
</td>
<td class="entry cell-norowborder" style="vertical-align: top;">
<p class="p">
This is a custom URL for each Zendesk
Sell account,
based on UUID generated during SSO
configuration.
</p>
<p class="p">
The same value should be used for
Recipient URL and
Destination URL if these are defined
independently.
</p>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" style="vertical-align: top;">Audience Restriction</td>
<td class="entry nocellnorowborder" style="vertical-align: top;">
Service Provider Issuer ID value from
Zendesk Sell
settings
</td>
<td class="entry cell-norowborder" style="vertical-align: top;">
This is a custom URL for each Zendesk
Sell account,
based on UUID generated during SSO
configuration.
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" style="vertical-align: top;">NameID Format</td>
<td class="entry nocellnorowborder" style="vertical-align: top;">EmailAddress</td>
<td class="entry cell-norowborder" style="vertical-align: top;"> </td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" style="vertical-align: top;">Application Username</td>
<td class="entry nocellnorowborder" style="vertical-align: top;">Email</td>
<td class="entry cell-norowborder" style="vertical-align: top;"> </td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" style="vertical-align: top;">Response</td>
<td class="entry nocellnorowborder" style="vertical-align: top;">Signed</td>
<td class="entry cell-norowborder" style="vertical-align: top;"> </td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" style="vertical-align: top;">Assertion</td>
<td class="entry nocellnorowborder" style="vertical-align: top;">Signed &amp; Encrypted</td>
<td class="entry cell-norowborder" style="vertical-align: top;"> </td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" style="vertical-align: top;">Signature Algorithm</td>
<td class="entry nocellnorowborder" style="vertical-align: top;">RSA-SHA1</td>
<td class="entry cell-norowborder" style="vertical-align: top;"> </td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" style="vertical-align: top;">Digest Algorithm</td>
<td class="entry nocellnorowborder" style="vertical-align: top;">SHA1</td>
<td class="entry cell-norowborder" style="vertical-align: top;"> </td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" style="vertical-align: top;">Single Log Out URL</td>
<td class="entry nocellnorowborder" style="vertical-align: top;"> </td>
<td class="entry cell-norowborder" style="vertical-align: top;">Leave this empty, as it is not supported.</td>
</tr>
<tr class="row">
<td class="entry row-nocellborder" style="vertical-align: top;">Default RelayState</td>
<td class="entry row-nocellborder" style="vertical-align: top;"> </td>
<td class="entry cellrowborder" style="vertical-align: top;">Leave this empty, as it is not supported.</td>
</tr>
</tbody>
</table>
</div>
</li>
</ol>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested1" id="topic_ojq_gyc_qnb">
<h2 class="title topictitle2" id="ariaid-title4">Logging in to Zendesk Sell with SSO enabled</h2>
<div class="body">
<p class="p">
With SSO enabled, users continue to log in to Zendesk Sell from their
default login
page, but you'll need to enter the email address registered to Sell,
that is, your
login email.
</p>
<p class="p">
Zendesk Sell automatically verifies the email address against your
identity provider,
and if you're already logged in to your identity provider, you'll
be automatically
logged into Sell.
</p>
<p class="p">
If you're not already logged into your identity provider, you'll
be redirected to
their login page to enter your login details. As soon as you're authenticated,
you'll be automatically logged into Zendesk Sell.
</p>
<p class="p">
If you're logging in from a Sell mobile app, enter your Zendesk Sell
email address in
order to begin the sign in process on your device. Depending on your
device, you'll
be redirected to your browser or your identity provider's app to
complete sign in.
</p>
<p class="p">
If you're an administrator on your Zendesk Sell account, you'll be
able to select an
option to log in with an email and password on the login page. All
non-administrator
users will need to use SSO to log in.
</p>
<p class="p">
You need administrator rights to change the email address registered
to Sell.
Non-admin accounts won't be able to change the email address used
to log in.
</p>
</div>
</div>