Integrating SailPoint with Zendesk SaaS

SailPoint's Zendesk SaaS connector is used to manage Zendesk user accounts. This guide is designed to provide the information required to configure a working instance. After it is successfully configured, your organization will be able to aggregate and provision accounts for Zendesk user accounts.

Supported Features

The Zendesk SaaS connector supports the following features:

• Aggregate Zendesk users and groups
• Provision Zendesk users
• *Certification
• *Password Management
• Delete Account

For more information on features, refer to Source Features.

The Zendesk SaaS connector supports multiple group objects.

The details of the features are:

Group Entitlements

Group Entitlements are the entitlement types for which SailPoint provides the ability to aggregate additional details (of these entitlement types) from the managed system. These objects have a separate schema defining list of attributes. The aggregation task fetches the attributes as additional details when aggregation is run for that group entitlement type.

Activity Insights

Activity Insights supports activity from Zendesk and its associated accounts. This allows you to gather account information and activity data from Zendesk.

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

• The password policy defined in SailPoint applies to accounts on this source.
• If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Supported Managed Systems

The Zendesk SaaS connector supports the Zendesk Cloud application as configured. Ensure that an appropriate plan is activated in the Zendesk instance.

Prerequisites

You must set up a service account that has the administrator role to perform all the operations. If you want to use the Zendesk SaaS for read only operations, assign the agent role to the source service account with appropriate permission in the role for End-user profile access and View user profile lists on the Zendesk system.

For Basic Authentication

• Set the Password Access or Token Access as Enabled in the Zendesk API admin configuration.

For OAuth 2.0 Authentication

• Set the Password Access as Enabled in the Zendesk API admin configuration.
• Create a new OAuth client by providing the Client Name in the Zendesk API admin configuration.
• Use the same Client Name for the Client ID and generated Client Secret on your Zendesk application.
• The Client Secret is visible in the Zendesk managed system only during the creation of the OAuth client.

For the most up-to-date information about performing tasks in Zendesk, refer to the Zendesk documentation.

Enable Password or Token Access

Follow the following steps to enable password or token access:

1. In Zendesk Support, select Admin > Channels > API.
2. In the Settings tab, enable Password Access or Token Access.

Create OAuth Client

Follow the following steps to create OAuth client:

1. In Zendesk Support, select Admin > Channels > API, and then select the OAuth clients tab.
2. Select the plus icon (+) located beside the client list.

3. Complete the following fields to create a client:

   • Client Name: Enter a name for your app. This is the name that users will see when asked to grant access to your application, and when they check the list of third-party apps that have access to their Zendesk.

   • Description: Optional. This is a short description of your app that users will see when asked to grant access to it.

   • Company: Optional. This is the company name that users will see when asked to grant access to your application. The information can help them understand who they're granting access to.

   • Logo: Optional. This is the logo that users will see when asked to grant access to your application. The image can be a JPG, GIF, or PNG. For best results, upload a square image. It will be resized for the authorization page.

   • Unique Identifier: The field is auto-populated with a reformatted version of the name you entered for your app. You can change it if you want.

   • Redirect URLs: Enter the URL or URLs that Zendesk should use to send the user's decision to grant access to your application. The URLs must be absolute and not relative, https (unless localhost or 127.0.0.1), and newline-separated.

4. Select Save.

   After the page refreshes, a new pre-populated Secret field appears on the lower side. This is the client_secret value specified in the OAuth2 spec.

5. Copy the Secret value to your clipboard and save it somewhere safe.

   Note

   The characters may extend past the width of the text box, so make sure to select everything before copying.

   Important

   For security reasons, your secret is displayed fully only once. After selecting Save, you'll only have access to the first nine characters.

6. Select Save. Use the unique identifier and the secret value in the source configuration.

Required Permissions

• The service account must have the administrator role to perform all the operations.

  Note

  If the connector is used for read only operations, then the service account can be limited to an agent role with the appropriate permission in the role for End-user profile access and View user profile lists.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.