Multi-Factor Authentication (MFA/2FA) for Freshdesk

Last updated on February 15, 2024

Overview

The purpose of this document is to introduce Rublon Authentication (Rublon Access Gateway) into the Freshdesk authentication process and enable the Two-Factor authentication process for Freshdesk users. To be able to achieve that, it is required to create a Rublon Access Gateway application as well as configure several SSO settings on the Freshdesk administration panel site. All needed steps will be described within this document.

Supported Authentication Methods

Authentication Method	Supported	Comments
Mobile Push	✔	N/A
WebAuthn/U2F Security Key	✔	N/A
Passcode	✔	N/A
SMS Passcode	✔	N/A
SMS Link	✔	N/A
Phone Call	✔	N/A
QR Code	✔	N/A
Email Link	✔	N/A
YubiKey OTP Security Key	✔	N/A

Installation

Required Components:

Rublon Access Gateway

Download the Rublon Access Gateway certificate

Sign in to Rublon Access Gateway
Go to Applications → All applications
Click the Download Certificate button
You will need the certificate in G Suite SSO settings and when adding app to Rublon Access Gateway.

Setup the Rublon Access Gateway integration

Login to Freshdesk and choose Admin Panel from the Left bar.
Select Security from the General Settings group:
Set the admin who will be getting notifications and click Single Sign On (SSO):
Turn on Single sign-on:
Choose SAML SSO from the drop down list in Single sign-on section.
Fill the required data from Rublon Access Gateway
1. For Entity ID provided by the idP, copy the value from Rublon Access Gateway metadata – Entity ID
2. For SAML SSO URL, use the SSO URL from Rublon Access Gateway
3. Choose Only Signed Response in Signed Options
4. Copy Logout URL from Rublon Access Gateway to Logout URL
5. Open the downloaded certificate and copy the value to Security certificate
Set Signing Options as Only Signed Response
Save the changes.

Force SAML authentication

In Step 4 in the previous section you can choose which methods are allowed to use. Set all to off and leave Single sign-on turned on. Make sure you have correctly configured SSO before you turn off other sign in methods

Add an application to Rublon Access Gateway

Login into your Rublon Access Gateway instance.
Open the Applications tab.
Select the Add application subtab
Fill the form with data where Freshdesk URL is https://YOUR_DOMAIN.freshdesk.com (where YOUR_DOMAIN is your domain registered within Freshdesk):
1. Application name for you to recognize it in the system
2. EntityID:
  1. Go to YOR_DOMAIN.freshworks.com/security and Sign in
  2. Choose the Login Method in Single sign-on
  3. Copy from the Entity ID from Service Provider(SP)
3. Assertion Consumer Service:
  1. Go to YOR_DOMAIN.freshworks.com/security and Sign in
  2. Choose the Login Method in Single sign-on
  3. Copy the following from Assertion Consumer Services:
4. NameID format: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
5. NameID attribute: your authentication source attribute name which will return your mail in Freshdesk.
6. Check Sign Response
7. Add the downloaded certificate from Rublon Access Gateway in the Certificate for singing field
8. Save the changes.