Infos:
- Used Zammad version: 7.1.1-cdd01e91.docker
- Used Zammad installation type: docker-compose
- Operating system: AlmaLinux 9.8
Expected behavior:
We are trying to use our Shibboleth IdP 5.2 for authentication instead of direct LDAP binds. However, whatever we try, it doesn’t seem to work. For a start it seems to expect non-standard attribute names like “first_name” and “last_name”. We have added those, but still it’s annoying that it’s not using the standard X509 URNs.
Worse is the expectation of the NameID format which we cannot get to work at all. The LDAP login is with the uid. The uid attribute it the attribute which uniquely identifies the user. Somewhere in the zammad docs it says that zammad requires the email address (which wouldn’t be a unique identifies in our ldap directory).
When I set nameid format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress we get an InvalidNameIDPolicy error
E, [2026-07-03T18:41:33.010956#1-1053736] ERROR -- : (saml) Authentication failure! invalid_ticket: OneLogin::RubySaml::ValidationError, The status code of the Response was not Success, was Requester => InvalidNameIDPolicy -> An error occurred.
because that is not supported by our IdP. We haven’t even found a way how to enable that and none of the SPs served by our IdP ever required that.
If we use a format we support, e.g. urn:oasis:names:tc:SAML:2.0:nameid-format:transient and set the “UID Attribute Name” to “uid” we get the error
E, [2026-07-03T17:18:49.453438#1-987168] ERROR -- : (saml) Authentication failure! invalid_ticket: OmniAuth::Strategies::SAML::ValidationError, SAML response missing 'uid' attribute
although we have verified in the IdP as well as during the consent screen shown that the attribute uid is actually sent to zammad. I don’t understand why it thinks it’s missing.
The zammad website says
Simply configure Shibboleth for the Zammad IdP and initiate the authentication. There is no documentation for this yet, so just let us know if you need help!
How do we get the latest Shibboleth IdP authenticate zammad logins? Which attribute resolvers and encodings and filters are necessary to get it to work?
We are really puzzled. I haven’t seen a SP so peculiar that we could get to talk to our IdP…