Multi-Factor Authentication (MFA/2FA) for Zendesk

Last updated on October 16, 2024

Overview

The purpose of this document is to enable Rublon Two-Factor Authentication (2FA) for users logging in to Zendesk. In order to achieve that, you have to use Rublon Access Gateway. All required steps will be described in this document.

Supported Authentication Methods

Authentication Method	Supported	Comments
Mobile Push	✔	N/A
WebAuthn/U2F Security Key	✔	N/A
Passcode	✔	N/A
SMS Passcode	✔	N/A
SMS Link	✔	N/A
Phone Call	✔	N/A
QR Code	✔	N/A
Email Link	✔	N/A
YubiKey OTP Security Key	✔	N/A

Before you start

You need to install and configure Rublon Access Gateway itself before configuring Zendesk to work with it. Please read the Rublon Access Gateway documentation and follow the steps in Installation and Configuration sections. Afterwards, follow the Configuration section in this document.

Configuration

Follow these steps to enable Rublon 2FA in Zendesk.

Configure Rublon in Zendesk

1. Click the Zendesk Products icon located in the top-right corner and select Admin Center from the list.

2. Click Security settings inside the Security tile.

3. Select Single sign-on from the pane on the left and click Configure inside the SAML tile.

4. A SAML form will appear. Check Enabled and fill in the fields. Refer to the following image and table.

SAML SSO URL	Enter the value of SSO URL from Rublon Access Gateway (Applications → Information for configuring applications with Rublon Access Gateway).
Certificate fingerprint	You have to calculate a fingerprint from the certificate file downloaded from Applications → Information for configuring applications with Rublon Access Gateway → DOWNLOAD CERTIFICATE. Certificate fingerprint must be in SHA256. Use openssl or an online converter of your choice to calculate a SHA256 fingerprint of your certificate.
Remote logout URL	Enter the value of Logout URL from Rublon Access Gateway (Applications → Information for configuring applications with Rublon Access Gateway).
IP ranges	Leave blank so that all requests will be routed through Rublon 2FA.

5. Click Save to add your SAML configuration.

Enable Rublon for Staff members

1. In Admin Center, go to Security → Staff members.

2. Check External authentication and choose Single sign-on.

3. Click Save.

Note

We recommend you keep Zendesk authentication checked. This will ensure that you will still have access to the administrator’s features in case of any errors or changes in your Rublon integration.

Let’s assume example is the name of your Zendesk subdomain. If you have Zendesk authentication checked, you will be able to sign in to Zendesk using your old Zendesk credentials at https://example.zendesk.com/access/normal.

Once you tested logging in to Zendesk with Rublon 2FA and everything worked, you can get back to this form and uncheck Zendesk authentication.

Enable Rublon for End users

1. In Admin Center, go to Security → End users.

2. Check External authentication.

3. Click Save.

Note

Once you tested logging in to Zendesk with Rublon 2FA and everything worked, you can get back to this form and uncheck Zendesk authentication.

Add Zendesk to Rublon Access Gateway

1. In Rublon Access Gateway, go to Applications → Add application.

2. Fill in the form and click SAVE to add a new application. Refer to the following image and table.

Application name	Enter a name for the application, e.g. Zendesk. The name will be displayed during Rublon 2FA.
Entity ID	https://example.zendesk.com Note: Replace example with the name of your organization.
Assertion Consumer Service	https://example.zendesk.com/access/saml/ Note: Replace example with the name of your organization.
Single Logout Service	https://zendesk.com
NameID format	urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
NameID attribute	mail
Send Attributes	NameID
Signature algorithm	sha-256
Validate Authn Request	Uncheck.
Sign response	Check.
Certificate for signing	Select the certificate you have downloaded from Applications → Information for configuring applications with Rublon Access Gateway → DOWNLOAD CERTIFICATE.

3. Your configuration is now complete. You can log in to Zendesk with Rublon 2FA.

Log in to Zendesk with Rublon 2FA

1. Initiate Zendesk login. If your subdomain is example, go to: https://example.zendesk.com/.

2. You will be redirected to Rublon Access Gateway login page.

3. Provide your username and password. Click SIGN IN. A window will appear with a selection of various 2FA options from Rublon. Let’s choose Mobile Push.