Enabling SAML single sign-on

<body>
<p id="docs-hc-snippet" style="display: none;">Zendesk supports enterprise single sign-on access to Zendesk accounts via Secure Assertion Markup Language (SAML),JSON Web Token (JWT), andOpenID Connect (IODC). With SSO, users can sign in once using their company sign-in form to gain access to multiple systems and service providers, including Zendesk products.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="suite_all">
<table>
<tbody>
<tr>
<td>
<strong>All Suites</strong>
</td>
<td>Team, Growth, Professional, Enterprise, or Enterprise Plus</td>
</tr>
</tbody>
</table>
</div>

<div class="article-banner" id="support_all">
<table>
<tbody>
<tr>
<td>
<strong>Support</strong>
</td>
<td>Team, Professional, or Enterprise</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Summary: <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">Enable SAML single sign-on to let users access multiple systems, including Zendesk, with one login via your company's identity provider. Configure multiple SAML SSO setups for team members and end users, assign them accordingly, and manage user data updates during authentication. Ensure your SAML server meets requirements and customize sign-in options. Additional user attributes can be passed for enhanced profiles and access control.</p>
</div>

<div class="body">

<div class="note fastpath">
<span class="fastpathtitle">Location: </span> <span class="ph">Admin Center &gt; Account &gt; Security &gt; Single
sign-on</span>
</div>
<p class="p">Zendesk supports enterprise single sign-on access to Zendesk accounts via Secure
Assertion Markup Language (SAML), <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408845838874" target="_blank">JSON Web Token (JWT)</a>, and
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/7957465432474" target="_blank">OpenID Connect (IODC)</a>. With
SSO, users can sign in once using their company sign-in form to gain access
to multiple systems and service providers, including Zendesk products. </p>
<p class="p">As a Zendesk admin, your role consists of enabling the SSO options. This article
describes how to enable multiple SAML single sign-on configurations that can
be used to authenticate team members (admins and agents, including light
agents and contributors), end users, or both.</p>
<div class="note important" id="topic-1__note_fk1_2rq_tyb">
<span class="importanttitle">Important:</span> When you use SSO, you are responsible
for verifying your users' identities, including their email addresses. If
you don't verify your users and their email addresses, your account is at
risk of unauthorized access, and Zendesk cannot guarantee or warrant the
security of your account. </div>
<p class="p">This article contains the following topics:</p>
<ul class="ul" id="topic-1__ul_dbq_btf_bfb">
<li class="li"><a class="xref" href="#topic_3kj_p23_l3">How SAML SSO for Zendesk works</a></li>
<li class="li"><a class="xref" href="#topic_u54_wc3_z2b">Requirements for enabling SAML SSO</a></li>
<li class="li"><a class="xref" href="#topic_1ms_gf3_l3">Enabling SAML SSO</a></li>
<li class="li"><a class="xref" href="#topic_b15_1gd_jhb">Assigning SAML SSO to users</a></li>
<li class="li"><a class="xref" href="#topic_f4z_nb4_z2b">Managing users in Zendesk after enabling SAML SSO</a></li>
<li class="li"><a class="xref" href="#topic_t41_h4b_2lb">Switching authentication methods</a></li>
</ul>
<p class="p">The IT team in a company is usually responsible for setting up and managing the
company's SAML authentication system. Their role is to implement SSO for
Zendesk on the system. Refer the team to the following topic in this
article:</p>
<ul class="ul" id="topic-1__ul_ikd_2tf_bfb">
<li class="li"><a class="xref" href="#topic_ttl_524_z2b">Technical implementation worksheet</a></li>
</ul>
<p class="p">Related articles:</p>
<div class="p">
<ul class="ul" id="topic-1__ul_z11_m1k_my">
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408883587226" target="_blank">Single sign-on (SSO)
options in Zendesk</a></li>
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5380943678106" target="_blank">Giving users
different ways to sign into Zendesk</a></li>
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408882128666" target="_blank">Accessing your
Zendesk account when your SSO service is
down</a></li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_3kj_p23_l3">
<h2 class="title topictitle2" id="ariaid-title2">How SAML SSO for Zendesk works</h2>
<div class="body">
<p class="p">SAML for Zendesk works the way SAML does with all other service
providers. A common use case is a company where all user
authentication is managed by a corporate authentication system such
as Active Directory or LDAP (generically referred to as an
<em class="ph i">identity provider</em> or <em class="ph i">IdP</em>). Zendesk establishes
a trust relationship with the identity provider and allows it to
authenticate and sign in users to Zendesk accounts.</p>
<p class="p">A common use case is a user who signs in to their corporate system at the
beginning of the work day. Once signed in, they have access to other
corporate applications and services (such as email or Zendesk
Support) without having to sign in separately to those services.</p>
<p class="p">If a user attempts to sign in directly to a Zendesk account, they are
redirected to your SAML server or service for authentication. Once
authenticated, the user is redirected back to your Zendesk account
and automatically signed in. </p>
<p class="p"><img class="image img-screenshot" height="NaN" id="topic_3kj_p23_l3__image_lmh_qj3_l3" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/saml_flow.png" width="NaN"></p>
<p class="p">Another supported workflow is giving users access to Zendesk after they
sign in to your company's website. When a user signs in to the
website using their website credentials, the website sends a request
to the identity provider to validate the user. The website then
sends the provider's response to the SAML server, which forwards it
to your Zendesk account, which grants a session to the user.</p>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_u54_wc3_z2b">
<h2 class="title topictitle2" id="ariaid-title3">Requirements for enabling SAML SSO</h2>
<div class="body">
<p class="p">Meet with the team in your company responsible for the SAML
authentication system (usually the IT team) to make sure your
company meets the following requirements: </p>
<ul class="ul" id="topic_u54_wc3_z2b__ul_c55_yc3_z2b">
<li class="li">
<p class="p">The company has a SAML server with provisioned users or
connected to an identity repository such as
Microsoft Active Directory or LDAP. Options include
using an in-house SAML server such as OpenAM, or a
SAML service such as Okta, OneLogin, or
PingIdentity.</p>
</li>
<li class="li">
<p class="p">If using an Active Directory Federation Services (ADFS)
server, forms-based authentication must be enabled.
Zendesk does not support Windows Integrated
Authentication (WIA). For more information, see
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408834714650" target="_blank">Setting up single
sign-on using Active Directory with ADFS and
SAML</a>.</p>
</li>
<li class="li">Zendesk-bound traffic is over HTTPS, not HTTP.</li>
</ul>
<div class="p">You'll need the following information to configure a SAML SSO method in
Zendesk. Your IT team should be able to provide this to you.<ul class="ul" id="topic_u54_wc3_z2b__ul_sn2_tm3_z2b">
<li class="li">The remote login URL for your SAML server (sometimes
called SAML Single Sign-on URL) </li>
<li class="li">(Optional) The remote logout URL where Zendesk can
redirect users after they sign out of Zendesk</li>
<li class="li">(Optional) A list of IP ranges to redirect users to the
appropriate sign-in option. Users making requests
from the specified IP ranges are routed to the
remote SAML authentication sign-in form. Users
making requests from IP addresses outside the ranges
are routed to the normal Zendesk sign-in form. If
you don't specify a range, all users are redirected
to the remote authentication sign-in form.</li>
<li class="li">The SHA2 fingerprint of the SAML certificate from your
SAML server. X.509 certificates are supported and
should be in PEM or DER format, but you'll still
need to provide a SHA2 fingerprint for the X.509
certificate. There is no upper limit on the size of
the SHA fingerprint.
</li>
</ul>
</div>
<p class="p">The IT team may require additional information from Zendesk to configure
the SAML implementation. Refer them to the <a class="xref" href="#topic_ttl_524_z2b">Technical implementation worksheet</a> in this
article.</p>
<p class="p">After you've confirmed that you meet the requirements and have all of the
necessary information, you're ready to <a class="xref" href="#topic_1ms_gf3_l3">enable SAML
SSO</a>.</p>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested1" id="topic_1ms_gf3_l3">
<h2 class="title topictitle2" id="ariaid-title4">Enabling SAML SSO</h2>
<div class="body">
<p class="p">Admins can enable SAML single sign-on only for end users, only for team
members (including light agents and contributors), or for both
groups. You can create multiple SAML SSO configurations. Before you
start, obtain the required information from your company's IT team.
See <a class="xref" href="#topic_u54_wc3_z2b">Requirements for enabling SAML SSO</a>.</p>
<p class="p"><strong class="ph b">To enable SAML single sign-on in Zendesk</strong></p>
<div class="p">
<ol class="ol" id="topic_1ms_gf3_l3__ol_j5z_4qj_l3">
<li class="li" dir="ltr"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_1ms_gf3_l3__d8e322" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Security &gt; Single sign-on</strong>.</span></li>
<li class="li">Click <strong class="ph b">Create SSO configuration</strong> then select
<strong class="ph b">SAML</strong>.</li>
<li class="li">Enter a unique <strong class="ph b">Configuration name</strong>.</li>
<li class="li">For <strong class="ph b">SAML SSO URL</strong>, enter the remote login URL for
your SAML server. <p class="p">In SAML metadata, the SAML SSO
URL is typically listed inside the
<code class="ph codeph">&lt;SingleSignOnService&gt;</code> element.
Do not use the entityID URL.</p>
</li>
<li class="li">Enter the SHA-256 <strong class="ph b">Certificate fingerprint</strong>. This
is required for us to communicate with your SAML
server.</li>
<li class="li">(Optional) For <strong class="ph b">Remote logout URL</strong>, enter a logout
URL where users should be redirected after they sign
out of Zendesk.</li>
<li class="li">(Optional) For <strong class="ph b">IP ranges</strong>, enter a list of IP
ranges if you want to redirect users to the
appropriate sign-in option. <p class="p">Users making requests
from the specified IP ranges are routed to the
remote SAML authentication sign-in form. Users
making requests from IP addresses outside the
ranges are routed to the normal Zendesk sign-in
form. Don't specify a range if you want all users
to be redirected to the remote authentication
sign-in form.</p>
</li>
<li class="li">Select <strong class="ph b">Show button when users sign in</strong> to add a
<strong class="ph b">Continue with SSO</strong> button to the Zendesk
sign-in page. <p class="p">You can customize the button label
by entering a value in the <strong class="ph b">Button name</strong>
field. Custom button labels are useful if you add
multiple SSO buttons to the sign-in page. See
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408882188570#topic_rqg_yw4_2yb" target="_blank">Adding "Continue
with SSO" buttons to the Zendesk sign-in
page</a> for more information.</p>
</li>
<li class="li">Click <strong class="ph b">Save</strong>.<p class="p">By default, enterprise SSO
configurations are inactive. You must <a class="xref" href="#topic_b15_1gd_jhb">assign the
SSO configuration to users</a> to activate
it.</p>
</li>
</ol>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title5" class="topic nested1" id="topic_b15_1gd_jhb">
<h2 class="title topictitle2" id="ariaid-title5">Assigning SAML SSO to users</h2>
<div class="body">
<p class="p">After creating your SAML SSO configuration, you must activate it by
assigning it to end users, team members, or both.</p>
<p class="p"><strong class="ph b">To assign an SSO configuration to team members or end users</strong></p>
<ol class="ol" id="topic_b15_1gd_jhb__ol_i5x_ggd_jhb">
<li class="li" dir="ltr">Open the Security settings for team members or end
users. <ul class="ul" id="topic_b15_1gd_jhb__ul_vyz_pxr_5qb">
<li class="li"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_b15_1gd_jhb__d8e292" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Security &gt; Team member
authentication</strong>.</span></li>
<li class="li"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_b15_1gd_jhb__d8e307" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Security &gt; End user
authentication</strong>.</span></li>
</ul>
</li>
<li class="li">Select <strong class="ph b">External authentication</strong> to show the authentication
options. </li>
<li class="li">Select the name(s) of the SSO configuration(s) you want to use.
<p class="p">Single sign-on might not cover all use cases, so
Zendesk authentication remains active by default.
</p>
</li>
<li class="li">Select how you'd like to allow users to sign in. <p class="p"><img class="image img-screenshot" id="topic_b15_1gd_jhb__image_ms1_dy4_2yb" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_security_choose-sign_in.png" width="400"></p>
<p class="p"><strong class="ph b">Let them
choose</strong> allows users to sign in using any
active authentication method. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5380943678106" target="_blank">Giving users
different ways to sign into
Zendesk</a>.</p>
<p class="p"><strong class="ph b">Redirect to SSO</strong> only
allows users to authenticate using the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408882188570#topic_c55_3sf_vsb" target="_blank">primary SSO
configuration</a>. Users don’t see additional
sign-in options, even if those authentication
options are active. When you select <strong class="ph b">Redirect to
SSO</strong>, the <strong class="ph b">Primary SSO</strong> field appears for
you to select the primary SSO configuration.
</p>
</li>
<li class="li">Click <strong class="ph b">Save</strong>.</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title6" class="topic nested1" id="topic_f4z_nb4_z2b">
<h2 class="title topictitle2" id="ariaid-title6">Managing users in Zendesk after enabling SAML SSO</h2>
<div class="body">
<p class="p">After enabling SAML single sign-on in Zendesk, changes made to users
outside Zendesk don't automatically sync to your Zendesk account.
Users are updated in Zendesk at the point of authentication. For
example, if a user is added to your internal system, the user is
added to your Zendesk account when they sign in to Zendesk. When
changes are made to the user's data in your internal system (such as
name or email address), any attributes shared in the payload of the
SAML are updated in Zendesk. If a user is deleted from your internal
system, the user will no longer be able to sign in to Zendesk.
However, their account will still exist in Zendesk. </p>
<p class="p">By default, the only user data stored in Zendesk when single sign-on is
enabled is the user's name and email address. Zendesk does not store
passwords. As a result, you should turn off any automated email
notifications from Zendesk about passwords.</p>
<p class="p">To provide a better customer experience, you might want to store more
than just the user's name and email address in Zendesk. See <a class="xref" href="#topic_d1r_523_l3">Obtaining additional
user data</a>.</p>
</div>
<div aria-labelledby="ariaid-title7" class="topic nested2" id="id_r5s_yzm_pcc">
<h3 class="title topictitle3" id="ariaid-title7">Turning off password notification emails from Zendesk</h3>
<div class="body">
<p class="p" dir="ltr">A Zendesk user profile is created for any new user who accesses your
Zendesk account through SAML, JWT, or OpenID Connect (OIDC) single sign-on.
Because users are authenticated through an IdP with a non-Zendesk password, the
profile is created without a password because they don't need to sign in to
Zendesk directly. </p>
<p class="p" dir="ltr">Because new users who sign in to Zendesk through SSO are verified
through an IdP, they don't receive email notifications to verify their account.
However, it is still recommended to turn off these automated email notifications
to prevent them from being sent if the IdP does not successfully verify the
user. In the case of SSO, user verification must always occur through the
IdP.</p>
<p class="p"><strong class="ph b">To turn off password notification emails</strong></p>
<ol class="ol" id="id_r5s_yzm_pcc__d9e25">
<li class="li"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="id_r5s_yzm_pcc__d8e810" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_people_icon.png">
<strong class="ph b">People</strong> in the sidebar, then select <strong class="ph b">Configuration &gt; End users</strong>.</span></li>
<li class="li">In the <strong class="ph b">Account emails</strong> section, deselect <strong class="ph b">Also send a welcome email
when a new user is created by an agent or administrator</strong>.</li>
<li class="li">In <strong class="ph b">Allow users to change their password</strong>, deselect this option.</li>
</ol>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title8" class="topic nested1" id="topic_t41_h4b_2lb">
<h2 class="title topictitle2" id="ariaid-title8">Switching authentication methods</h2>
<div class="body">
<p class="p">If you use a third-party SSO method to create and authenticate users in
Zendesk and then switch to Zendesk authentication, these users will
not have a password available for login. To gain access, ask these
users to reset their passwords from the Zendesk sign-in page.</p>
</div>
</div>
<div aria-labelledby="ariaid-title9" class="topic nested1" id="topic_ttl_524_z2b">
<h2 class="title topictitle2" id="ariaid-title9">Technical implementation worksheet</h2>
<div class="body">
<p class="p">This section is for the team in the company responsible for the company's
SAML authentication system. It provides details about the Zendesk
SAML SSO implementation.</p>
<p class="p">Topics covered:</p>
<ul class="ul" id="topic_ttl_524_z2b__ul_tyk_hgf_bfb">
<li class="li"><a class="xref" href="#topic_eqz_shy_1fb">Required user data to identify the user being authenticated</a></li>
<li class="li"><a class="xref" href="#topic_dzb_qx5_2v">Configuring the identity provider for Zendesk</a></li>
<li class="li"><a class="xref" href="#topic_hzw_rt4_z2b">Configuring the SAML server for Zendesk</a></li>
<li class="li"><a class="xref" href="#topic_s2n_hg1_bfb">Parameters returned to your remote sign-in and sign-out URLs</a></li>
<li class="li"><a class="xref" href="#topic_xx3_ym4_21c">Using RelayState to redirect users after authentication</a></li>
<li class="li"><a class="xref" href="#topic_2dp_mf3_l3">Troubleshooting the SAML configuration for Zendesk</a></li>
</ul>
</div>
<div aria-labelledby="ariaid-title10" class="topic nested2" id="topic_eqz_shy_1fb">
<h3 class="title topictitle3" id="ariaid-title10">Required user data to identify the user being authenticated</h3>
<div class="body">
<p class="p">When you implement SAML SSO access to Zendesk accounts, you
specify certain user data to identify the user being
authenticated. </p>
<p class="p">These topics describe the data you need to provide:</p>
<ul class="ul">
<li class="li"><a class="xref" href="#topic_dzb_ul5_2v">Specifying the user's email address in the SAML subject's NameID</a></li>
<li class="li"><a class="xref" href="#topic_dzb_gl5_2v">Specifying two required user attributes in the SAML assertion</a></li>
</ul>
</div>
<div aria-labelledby="ariaid-title11" class="topic nested3" id="topic_dzb_ul5_2v">
<h4 class="title topictitle4" id="ariaid-title11">Specifying the user's email address in the SAML subject's NameID</h4>
<div class="body">
<p class="p">Zendesk uses email addresses to uniquely identify users.
You should specify the user's email address in the
SAML subject's name ID.</p>
<p class="p">For example:</p>
<pre class="pre codeblock"><code> &lt;saml:Subject&gt;
&lt;saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"&gt;stevejobs@yourdomain.com&lt;/saml:NameID&gt;
&lt;saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"&gt;
&lt;saml:SubjectConfirmationData NotOnOrAfter="2014-04-23T21:42:47.412Z"/&gt;
&lt;/saml:SubjectConfirmation&gt;
&lt;/saml:Subject&gt;</code></pre>
<p class="p"> If the givenname and surname attributes aren't provided,
Zendesk will use the username of the email address
provided in the
<code class="ph codeph">&lt;saml:Subject&gt;</code>
<code class="ph codeph">&lt;saml:NameID&gt;</code> element as the
name of the user. The first part of an email address
before the '@' symbol is the username. </p>
<p class="p">If the email's username has a period character in it,
then we will use it to parse out a first name and
last name. If there is no period character, then the
whole username becomes the name of the user in
Zendesk. For example, if the email address
<code class="ph codeph">&lt;saml:Subject&gt;&lt;saml:NameID&gt;</code>
is <em class="ph i">stanley.yelnats@yourdomain.com</em>, the user's
name in Zendesk would be stored as <em class="ph i">Stanley
Yelnats</em>; however, if the email address is
<em class="ph i">stanleyyelnats@yourdomain.com</em>, the user
name in Zendesk would be stored as
<em class="ph i">Stanleyyelnats</em>.</p>
<div class="p">
<div class="note note" id="topic_dzb_ul5_2v__note_frk_z1s_kxb">
<span class="notetitle">Note:</span> If you're setting up
Microsoft Entra SSO, ensure the Name claim points
to the field where your users' login email
addresses are stored. This value is usually
<strong class="ph b">user.mail</strong>, but your setup may be
different.</div>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title12" class="topic nested3" id="topic_dzb_gl5_2v">
<h4 class="title topictitle4" id="ariaid-title12">Specifying two required user attributes in the SAML assertion</h4>
<div class="body">
<p class="p">If you specify the <em class="ph i">givenname</em> and <em class="ph i">surname</em>
attributes, you must use the full namespace rather
than the friendly names. For example: where the
friendly name might be 'surname', the actual value
you need to specify for the attribute is
<em class="ph i">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname</em></p>
<table border="1" cellpadding="4" cellspacing="0" class="simpletable" id="topic_dzb_gl5_2v__simpletable_ih2_xzr_5sb" summary="">
<col style="width:25%">
<col style="width:25%">
<col style="width:25%">
<col style="width:25%">
<thead>
<tr class="sthead">
<th class="stentry" id="d48e676" style="vertical-align:bottom;text-align:left;">Concept</th>
<th class="stentry" id="d48e679" style="vertical-align:bottom;text-align:left;">Attribute</th>
<th class="stentry" id="d48e682" style="vertical-align:bottom;text-align:left;">Description</th>
<th class="stentry" id="d48e685" style="vertical-align:bottom;text-align:left;">Example value</th>
</tr>
</thead>
<tbody>
<tr class="strow">
<td class="stentry" headers="d48e676" style="vertical-align:top;">first name</td>
<td class="stentry" headers="d48e679" style="vertical-align:top;">givenname</td>
<td class="stentry" headers="d48e682" style="vertical-align:top;">The given name of this user.

You must specify the full namespace for this
attribute. </td>
<td class="stentry" headers="d48e685" style="vertical-align:top;">
<pre class="pre codeblock"><code>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname</code></pre>
</td>
</tr>
<tr class="strow">
<td class="stentry" headers="d48e676" style="vertical-align:top;">last name</td>
<td class="stentry" headers="d48e679" style="vertical-align:top;">surname</td>
<td class="stentry" headers="d48e682" style="vertical-align:top;">The surname of this user. A user in
Zendesk is created or updated in accordance with
this user's given name and surname. See example
below. You must specify the full namespace for
this attribute. </td>
<td class="stentry" headers="d48e685" style="vertical-align:top;">
<pre class="pre codeblock"><code>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname</code></pre>
</td>
</tr>
</tbody>
</table>
<p class="p">Given name and surname example:</p>
<pre class="pre codeblock"><code>&lt;saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"&gt;
&lt;saml:AttributeValue xsi:type="xs:anyType"&gt;James&lt;/saml:AttributeValue&gt;
&lt;/saml:Attribute&gt;
&lt;saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"&gt;
&lt;saml:AttributeValue xsi:type="xs:anyType"&gt;Dietrich&lt;/saml:AttributeValue&gt;
&lt;/saml:Attribute&gt;</code></pre>
<p class="p">Zendesk supports <a class="xref" href="#topic_d1r_523_l3">additional user attributes</a>.
Talk to your Zendesk Support admin about their data
requirements in Support.</p>
</div>
</div>
<div aria-labelledby="ariaid-title13" class="topic nested3" id="topic_d1r_523_l3">
<h4 class="title topictitle4" id="ariaid-title13">Obtaining additional user data</h4>
<div class="body">
<p class="p">The only user data required by Zendesk from your
authentication system is the user's given name,
surname, and email address. The given name and
surname are the only attribute names you should use
to capture information about a user's name. However,
you can get more data by asking your IT team to add
user attributes to the SAML assertions the identity
provider sends to Zendesk when users sign in. </p>
<p class="p">A SAML assertion contains one or more statements about
the user. One statement is the authorization
decision itself – whether or not the user was
granted access. Another statement can consist of
attributes describing the signed-in user.</p>
<p class="p">Zendesk supports the following additional user attributes
for signed-in users. Define your data requirements
in Support, then meet with your IT team to discuss
adding user attributes to the SAML assertions. </p>
<div class="p">Note the following considerations:<ul class="ul" id="topic_d1r_523_l3__ul_o5l_ghf_kfc">
<li class="li">Zendesk only recognizes these additional user
attributes if the attribute names outlined in the
table below are used in the assertion's attribute
statement. If you try to use the full namespace
for these attributes, they'll be ignored.</li>
<li class="li">Attribute names are case sensitive, so you
must match the exact casing shown in the tables
below.</li>
</ul>
</div>
<div class="p">
<table border="1" cellpadding="4" cellspacing="0" class="simpletable" id="topic_d1r_523_l3__simpletable_qg2_dqr_5sb" summary="">
<col style="width:50%">
<col style="width:50%">
<thead>
<tr class="sthead">
<th class="stentry" id="d48e774" style="vertical-align:bottom;text-align:left;">Attribute name</th>
<th class="stentry" id="d48e777" style="vertical-align:bottom;text-align:left;">Description</th>
</tr>
</thead>
<tbody>
<tr class="strow">
<td class="stentry" headers="d48e774" style="vertical-align:top;">organization</td>
<td class="stentry" headers="d48e777" style="vertical-align:top;">The name of an organization to add the
user to. If the organization doesn't exist in
Zendesk, it won't be created. The user will still
be created, but they won't be added to any
organization.<p class="p">If <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408838140314" target="_blank"><strong class="ph b">Allow users to
belong to multiple organizations</strong></a> is
turned on, additional organizations append the
original organization and are considered secondary
organizations. This does not delete the existing
memberships.</p>
<p class="p">If you'd like to pass multiple
organization names at the same time, use the
<strong class="ph b">organizations</strong> attribute instead. Using the
organizations attribute overwrites the existing
list of organizations. The organization names must
be passed in a string, separated by
commas.</p>
</td>
</tr>
<tr class="strow">
<td class="stentry" headers="d48e774" style="vertical-align:top;">organization_id</td>
<td class="stentry" headers="d48e777" style="vertical-align:top;">The organization's <a class="xref" href="https://developer.zendesk.com/api-reference/ticketing/organizations/organizations/" target="_blank">external ID</a>
in the Zendesk API. If both organization and
organization_id are supplied, organization is
ignored. If the organization doesn't exist in
Zendesk, it won't be created. The user will still
be created, but they won't be added to any
organization.<p class="p">If <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408838140314" target="_blank"><strong class="ph b">Allow users to
belong to multiple organizations</strong></a> is
turned on, additional organizations append the
original organization and are considered secondary
organizations. This does not delete the existing
memberships.</p>
<p class="p">If you'd like to pass multiple
organization IDs at the same time, use the
<strong class="ph b">organization_ids</strong> attribute instead. Using
the organization_ids attribute overwrites the
existing list of organizations. The organization
IDs must be passed in a string, separated by
commas.</p>
</td>
</tr>
<tr class="strow">
<td class="stentry" headers="d48e774" style="vertical-align:top;">phone</td>
<td class="stentry" headers="d48e777" style="vertical-align:top;">A phone number, specified as a
string.</td>
</tr>
<tr class="strow">
<td class="stentry" headers="d48e774" style="vertical-align:top;">tags</td>
<td class="stentry" headers="d48e777" style="vertical-align:top;">Tags to set on the user. The tags will
replace any other tags that may exist in the
user's profile.</td>
</tr>
<tr class="strow">
<td class="stentry" headers="d48e774" style="vertical-align:top;">remote_photo_url</td>
<td class="stentry" headers="d48e777" style="vertical-align:top;">URL for a photo to set on the user
profile. </td>
</tr>
<tr class="strow">
<td class="stentry" headers="d48e774" style="vertical-align:top;">locale (for agents)<p class="p">locale_id (for end
users)</p>
</td>
<td class="stentry" headers="d48e777" style="vertical-align:top;">The locale in Zendesk, specified as a
number. To get a list of valid numbers, see <a class="xref" href="https://developer.zendesk.com/rest_api/docs/support/locales" target="_blank">Locales</a> in the API
docs.</td>
</tr>
<tr class="strow">
<td class="stentry" headers="d48e774" style="vertical-align:top;">role</td>
<td class="stentry" headers="d48e777" style="vertical-align:top;">The user's role. Can be set to
<strong class="ph b">end-user</strong> , <strong class="ph b">agent</strong>, or <strong class="ph b">admin</strong>.
Default is
<strong class="ph b">end-user</strong>.</td>
</tr>
<tr class="strow">
<td class="stentry" headers="d48e774" style="vertical-align:top;">custom_role_id</td>
<td class="stentry" headers="d48e777" style="vertical-align:top;">Applicable only if the value of the
<strong class="ph b">role</strong> attribute above is <strong class="ph b">agent</strong>. You
can get the ids of your custom roles with the
<a class="xref" href="https://developer.zendesk.com/rest_api/docs/support/custom_roles" target="_blank">Custom Roles API</a>.
</td>
</tr>
<tr class="strow">
<td class="stentry" headers="d48e774" style="vertical-align:top;">external_id</td>
<td class="stentry" headers="d48e777" style="vertical-align:top;">A user id from your system if your users
are identified by something other than an email
address or if their email addresses are subject to
change. Specified as a string.<p class="p">When an
<code class="ph codeph">external_id</code> is included in a SAML
assertion, it serves as the primary identifier for
the user. If a new email address is provided along
with an existing <code class="ph codeph">external_id</code>, the
new email replaces the previous primary email
address for the user. The user's old primary email
address is removed. Secondary email addresses
cannot be set through SAML.</p>
</td>
</tr>
<tr class="strow">
<td class="stentry" headers="d48e774" style="vertical-align:top;">user_field_&lt;key&gt;</td>
<td class="stentry" headers="d48e777" style="vertical-align:top;">A value for a custom user field in
Zendesk Support. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408822051866" target="_blank">Adding custom
fields to users</a>. The &lt;key&gt; is the
field key assigned to the custom user field in
Zendesk Support. Example:
<code class="ph codeph">user_field_employee_number</code> where
<code class="ph codeph">employee_number</code> is the field key
in Zendesk. Sending a
null value or an empty string in the attribute
value will remove any custom field value set in
Zendesk Support.
</td>
</tr>
</tbody>
</table>
</div>
<div class="p">Zendesk also supports a series of <a class="xref" href="https://www.incommon.org/federation/attributes/" target="_blank">InCommon Federation
Attributes</a> to set user attributes as part
of the sign in. For Federation attributes, you
should specify the full namespace with the attribute
name, not the friendly name.
Examples:<table border="1" cellpadding="4" cellspacing="0" class="simpletable" id="topic_d1r_523_l3__simpletable_w15_pqr_5sb" summary="">
<col style="width:50%">
<col style="width:50%">
<thead>
<tr class="sthead">
<th class="stentry" id="d48e959" style="vertical-align:bottom;text-align:left;">Friendly name</th>
<th class="stentry" id="d48e962" style="vertical-align:bottom;text-align:left;">SAML2 formal name</th>
</tr>
</thead>
<tbody>
<tr class="strow">
<td class="stentry" headers="d48e959" style="vertical-align:top;">ou (organization unit)</td>
<td class="stentry" headers="d48e962" style="vertical-align:top;">urn:oid:2.5.4.11</td>
</tr>
<tr class="strow">
<td class="stentry" headers="d48e959" style="vertical-align:top;">displayName</td>
<td class="stentry" headers="d48e962" style="vertical-align:top;">urn:oid:2.16.840.1.113730.3.1.241</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title14" class="topic nested2" id="topic_dzb_qx5_2v">
<h3 class="title topictitle3" id="ariaid-title14">Configuring the identity provider for Zendesk</h3>
<div class="body">
<div class="p">The following attributes are required to specify the identify
provider:<table border="1" cellpadding="4" cellspacing="0" class="simpletable" id="topic_dzb_qx5_2v__simpletable_dnj_3bs_5sb" summary="">
<col style="width:50%">
<col style="width:50%">
<thead>
<tr class="sthead">
<th class="stentry" id="d48e1001" style="vertical-align:bottom;text-align:left;">Attribute</th>
<th class="stentry" id="d48e1004" style="vertical-align:bottom;text-align:left;">Value</th>
</tr>
</thead>
<tbody>
<tr class="strow">
<td class="stentry" headers="d48e1001" style="vertical-align:top;">entityID</td>
<td class="stentry" headers="d48e1004" style="vertical-align:top;">
https://<em class="ph i">yoursubdomain</em>.zendesk.com</td>
</tr>
<tr class="strow">
<td class="stentry" headers="d48e1001" style="vertical-align:top;">AudienceRestriction</td>
<td class="stentry" headers="d48e1004" style="vertical-align:top;">
<em class="ph i">yoursubdomain</em>.zendesk.com
</td>
</tr>
</tbody>
</table>
</div>
<p class="p">For both values, replace <em class="ph i">your_subdomain</em> with the Zendesk
Support subdomain. If you're unsure of the subdomain, ask
your Zendesk admin.</p>
<p class="p">Zendesk enforces the <code class="ph codeph">AudienceRestriction</code>
attribute.</p>
<div class="note note">
<span class="notetitle">Note:</span> If you're setting up <a class="xref" href="https://learn.microsoft.com/en-us/entra/identity/saas-apps/zendesk-tutorial" target="_blank">Microsoft Entra
SSO</a>, you may need to use
<em class="ph i">https://yoursubdomain</em>.zendesk.com or
<em class="ph i">yoursubdomain</em>.zendesk.com (without the
<em class="ph i">https://</em> prefix) as the
Entity ID value.</div>
</div>
</div>
<div aria-labelledby="ariaid-title15" class="topic nested2" id="topic_hzw_rt4_z2b">
<h3 class="title topictitle3" id="ariaid-title15">Configuring the SAML server for Zendesk</h3>
<div class="body">
<p class="p">Some SAML servers may require the following information when
configuring an integration with Zendesk:</p>
<ul class="ul" id="topic_hzw_rt4_z2b__ul_d2l_tt4_z2b">
<li class="li">
<p class="p">Access Consumer Service (ACS) URL:
Specify <strong class="ph b">https://yoursubdomain.zendesk.com/access/saml</strong>
(case sensitive), where 'accountname' with your
Support subdomain</p>
</li>
<li class="li">
<p class="p">Redirects to SAML Single Sign-on URL: Use <strong class="ph b">HTTP
POST</strong></p>
</li>
<li class="li">
<p class="p">Hashing algorithm (ADFS): Zendesk supports the
SHA-2 algorithm when using Active Directory
Federation Services (ADFS)</p>
</li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title16" class="topic nested2" id="topic_s2n_hg1_bfb">
<h3 class="title topictitle3" id="ariaid-title16">Parameters returned to your remote sign-in and sign-out URLs</h3>
<div class="body">
<p class="p">When redirecting users to your authentication system, Zendesk
appends the following parameters to the remote sign-in and
remote sign-out URLs.</p>
<div class="p">
<strong class="ph b">Remote sign-in URL parameters</strong><table border="1" cellpadding="4" cellspacing="0" class="simpletable" id="topic_s2n_hg1_bfb__simpletable_kgs_qbs_5sb" summary="">
<col style="width:50%">
<col style="width:50%">
<thead>
<tr class="sthead">
<th class="stentry" id="d48e1118" style="vertical-align:bottom;text-align:left;">Attribute</th>
<th class="stentry" id="d48e1121" style="vertical-align:bottom;text-align:left;">Description</th>
</tr>
</thead>
<tbody>
<tr class="strow">
<td class="stentry" headers="d48e1118" style="vertical-align:top;">brand_id</td>
<td class="stentry" headers="d48e1121" style="vertical-align:top;">The brand of the Help Center the user was
on when they attempted to sign in. For more
information, see <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408828794778" target="_blank">Creating a Help
Center for one of your brands</a>.</td>
</tr>
</tbody>
</table>
</div>
<div class="p">
<strong class="ph b">Remote sign-out URL parameters</strong><table border="1" cellpadding="4" cellspacing="0" class="simpletable" id="topic_s2n_hg1_bfb__simpletable_ej1_tbs_5sb" summary="">
<col style="width:50%">
<col style="width:50%">
<thead>
<tr class="sthead">
<th class="stentry" id="d48e1146" style="vertical-align:bottom;text-align:left;">Attribute</th>
<th class="stentry" id="d48e1149" style="vertical-align:bottom;text-align:left;">Description</th>
</tr>
</thead>
<tbody>
<tr class="strow">
<td class="stentry" headers="d48e1146" style="vertical-align:top;">email</td>
<td class="stentry" headers="d48e1149" style="vertical-align:top;">Email of the user signing out.</td>
</tr>
<tr class="strow">
<td class="stentry" headers="d48e1146" style="vertical-align:top;">external_id</td>
<td class="stentry" headers="d48e1149" style="vertical-align:top;">A unique identifier from your system
stored in the Zendesk user profile. </td>
</tr>
<tr class="strow">
<td class="stentry" headers="d48e1146" style="vertical-align:top;">brand_id</td>
<td class="stentry" headers="d48e1149" style="vertical-align:top;">The brand of the Help Center the user was
on when they signed out. For more information, see
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408828794778" target="_blank">Creating a Help
Center for one of your brands</a>.</td>
</tr>
</tbody>
</table>
</div>
<p class="p">If you prefer not to receive email and external id information in
the sign-out URL, ask your Zendesk admin to specify blank
parameters in the <strong class="ph b">Remote logout URL</strong> field in the
admin interface. See <a class="xref" href="#topic_1ms_gf3_l3">Enabling SAML SSO</a>. For example:
<strong class="ph b">https://www.yourdomain.com/user/signout/?email=&amp;external_id=</strong>.</p>
</div>
</div>
<div aria-labelledby="ariaid-title17" class="topic nested2" id="topic_xx3_ym4_21c">
<h3 class="title topictitle3" id="ariaid-title17">Using RelayState to redirect users after authentication</h3>
<div class="body">
<p class="p"><code class="ph codeph">RelayState</code> is a parameter used to maintain the
state of the originating request throughout the SSO process.
It specifies the original URL the user was trying to access
before the SSO process started. After completing the SSO
process, you can forward the user to the
<code class="ph codeph">RelayState</code> URL to provide a
seamless user experience.</p>
<p class="p">The <code class="ph codeph">RelayState</code> parameter is optional in SAML. If
you don’t include it in your request, the user will be
directed to the default location based on their user
type.</p>
<ul class="ul" id="topic_xx3_ym4_21c__ul_xn5_cn4_21c">
<li class="li">For agents, the default location is the agent dashboard
in Zendesk Support.</li>
<li class="li">For end users, the default location is the home page of
the help center for your default brand.</li>
</ul>
<p class="p">When a user accesses a Zendesk link that requires signing in, and
you are using SAML, Zendesk redirects the user to the SSO
configuration you set up and, along with that, sends the URL
the user came from in the <code class="ph codeph">RelayState</code>
parameter.</p>
<p class="p">Example:</p>
<pre class="pre codeblock" id="topic_xx3_ym4_21c__codeblock_o2y_5n4_21c"><code>https://zendesk.okta.com/app/zendesk/exladafgzkYLwtYra2r7/sso/saml?<strong class="ph b">RelayState=https%3A%2F%2Fyoursubdomain.zendesk.com%2Fagent%2Ffilters%2F253389123456</strong>&amp;brand_id=361234566920&amp;SAMLRequest=[samlloginrequesthere]
</code></pre>
<p class="p">When constructing the SAML authentication request, add the
<code class="ph codeph">RelayState</code> parameter and set its
value to the URL sent from Zendesk in the SAML response.</p>
<p class="p">Example <code class="ph codeph">RelayState</code> parameter redirecting users
to
<em class="ph i">https://yoursubdomain.zendesk.com/agent/filters/253389123456</em>:</p>
<pre class="pre codeblock" id="topic_xx3_ym4_21c__codeblock_k4v_244_21c"><code>SAMLResponse=[SAMLpayloadhere]&amp;<strong class="ph b">RelayState=https%3A%2F%2Fyoursubdomain.zendesk.com%2Fagent%2Ffilters%2F253389123456
</strong></code></pre>
</div>
</div>
<div aria-labelledby="ariaid-title18" class="topic nested2" id="topic_2dp_mf3_l3">
<h3 class="title topictitle3" id="ariaid-title18">Troubleshooting the SAML configuration for Zendesk</h3>
<div class="body">
<p class="p">Here is Zendesk's SAML 2.0 metadata:</p>
<pre class="pre codeblock"><code>&lt;?xml version="1.0" encoding="UTF-8" standalone="yes"?&gt;
&lt;EntityDescriptor entityID="https://yoursubdomain.zendesk.com" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"&gt;
&lt;SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
&lt;NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress&lt;/NameIDFormat&gt;
&lt;AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://yoursubdomain.zendesk.com/access/saml"/&gt; &lt;!-- Note: replace 'accountname' with your Zendesk subdomain --&gt;
&lt;/SPSSODescriptor&gt;
&lt;/EntityDescriptor&gt;</code></pre>
<p class="p">Zendesk expects a SAML assertion that looks as follows: </p>
<div class="p">
<pre class="pre codeblock"><code>&lt;samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="s2202bbbb
afa9d270d1c15990b738f4ab36139d463" InResponseTo="_e4a78780-35da-012e-8ea7-005056
9200d8" Version="2.0" IssueInstant="2011-03-21T11:22:02Z" Destination="https://yoursubdomain.zendesk.com/access/saml"&gt;
&lt;saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;myidp.entity.id
&lt;/saml:Issuer&gt;
&lt;samlp:Status xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
&lt;samlp:StatusCode  xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
Value="urn:oasis:names:tc:SAML:2.0:status:Success"&gt;</code></pre>
</div>
<p class="p"><strong class="ph b">Note</strong>: Replace 'accountname' in the
<code class="ph codeph">Destination</code> attribute with your
Zendesk subdomain.</p>
<p class="p">Zendesk expects user attributes to be specified in an assertion's
attribute statement
(<code class="ph codeph">&lt;saml:AttributeStatement&gt;</code>)
as in the following example: </p>
<div class="p">
<pre class="pre codeblock"><code>&lt;saml:AttributeStatement&gt;
&lt;saml:Attribute Name="organization"&gt;
&lt;saml:AttributeValue xsi:type="xs:string"&gt;Acme Rockets&lt;/saml:AttributeValue&gt;
&lt;/saml:Attribute&gt;
&lt;saml:Attribute Name="tags"&gt;
&lt;saml:AttributeValue xsi:type="xs:string"&gt;tag1 tag2&lt;/saml:AttributeValue&gt;
&lt;/saml:Attribute&gt;
&lt;saml:Attribute Name="phone"&gt;
&lt;saml:AttributeValue xsi:type="xs:string"&gt;555-555-1234&lt;/saml:AttributeValue&gt;
&lt;/saml:Attribute&gt;
&lt;saml:Attribute Name="role"&gt;
&lt;saml:AttributeValue xsi:type="xs:string"&gt;agent&lt;/saml:AttributeValue&gt;
&lt;/saml:Attribute&gt;
&lt;saml:Attribute Name="custom_role_id"&gt;
&lt;saml:AttributeValue xsi:type="xs:string"&gt;12345&lt;/saml:AttributeValue&gt;
&lt;/saml:Attribute&gt;
&lt;/saml:AttributeStatement&gt;</code></pre>
</div>
<p class="p"> For the names and descriptions of the user attributes supported
by Zendesk, see the table in <a class="xref" href="#topic_d1r_523_l3">Obtaining additional user data</a> above. Note that the full namespace
isn't supported for optional user attributes.</p>
</div>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/4408887505690",
"url": "https://support.zendesk.com/hc/en-us/articles/4408887505690",
"headline": "Enabling SAML single sign-on",
"description": "You can enable and configure SAML single sign-on to authenticate users via your company's identity provider, managing access and user data synchronization for your account.",
"articleSection": "User sign-in",
"datePublished": "2021-10-16T16:35:54+00:00",
"dateModified": "2026-05-08T22:54:28.045551+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/4408887505690"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"@id": "https://support.zendesk.com/hc/"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
}
}</script><script id="fast-path-script">
//<![CDATA[
const fast_path_style = document.createElement('style');
fast_path_style.innerHTML = `#article-body .fastpath{font-size:.9em;background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 8px;margin-bottom:16px}#article-body .fastpath::before{content:none!important}`;
document.head.appendChild(fast_path_style);
//]]>
</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>