1) What is your original issue/pain point you want to solve? We have successfully federated our external Identity Provider (IdP) with Zammad via SAML. Currently, to log in, users must navigate to the standard Zammad login page and manually click the "External identity"button. We want to streamline this experience by providing a direct link that automatically triggers the SSO flow, entirely bypassing the Zammad login screen.
2) Which are one or two concrete situations where this problem hurts the most?
- Customer Onboarding: When we send a welcome email to our clients with a link to access the support portal, they land on the default Zammad login screen. Many users get confused and attempt to enter their credentials in the local username/password fields instead of clicking the “External identity” button, leading to failed logins and frustration.
- Centralized Dashboard integration: We use a central application portal for our clients. When they click the “Support” icon to reach Zammad, they expect a seamless authentication experience. Landing on an intermediate login page asking them to click another button breaks this seamless SSO journey.
3) Why is it not solvable with the Zammad standard? In the current Zammad SaaS environment, the SAML button triggers a POST request to /auth/saml that requires a specific CSRF token (authenticity_token). Therefore, we cannot simply provide a hyperlink to our users. Furthermore, directly sending a GET request to /auth/saml returns a 404 error, and traditional IdP-Initiated SSO is not supported on the hosted setup.
4) What is your expectation/what do you want to achieve? We would like to achieve one of the following solutions:
- Support for a URL query parameter (e.g., domain.zammad.com/login/?provider=saml) that automatically redirects the user to the IdP upon page load.
- Full support for IdP-Initiated SSO, allowing us to generate the login flow directly from our Identity Provider and land authenticated users straight into the Zammad dashboard.
Your Zammad environment:
- Average concurrent agent count: 3
- Average tickets a day: 10
- What roles/people are involved: End-users (Customers) and Support Agents.
Anything else which you think is useful to understand your use case: The Zammad support team confirmed via a recent ticket that this behavior is currently unsupported in the hosted setup and recommended opening this feature request (as a follow-up to a similar inquiry made last year). Implementing this would greatly enhance the user experience and reduce friction between URLs for organizations relying exclusively on external IdPs.