We switched from OIDC to SAML for now because we can’t insert a client secret in the application, but it seems that ZAMMAD is not following the official name convention for Shibboleth/SAML.
Attributes Shibboleth → Attributes ZAMMAD
mail → email
givenName → first_name
sn → last_name
displayName → name
In other applications, normally this isn’t a problem because we can map these attributes in the application itselfs.
Zammad don’t offers this option in the application !!! so we need to do the mappings at our IdP site, which is NOT preferrable.