Skip to main content
server.camp Docs
server.camp Docs
server.camp Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  1. Documentation
  2. /
  3. Services
  4. /
  5. Zammad
  6. /
  7. Set up single sign-on (SSO)

Set up single sign-on (SSO)

Feedback on this page

You can configure your Zammad so that your agents sign in via single sign-on (SSO) against your identity provider. Zammad supports both OpenID Connect (OIDC) and SAML — so it works with Authentik, Keycloak, Zitadel, Microsoft Entra ID and other SSO-capable providers. This guide shows the procedure using Authentik with OpenID Connect as the example.

For new connections we recommend OpenID Connect: OIDC builds on OAuth 2.0, works with JSON instead of XML and is considerably easier to set up than SAML — with no exchange of XML metadata or signing certificates. If you need SAML instead (e.g. for Single Logout), Zammad supports that too; the basic steps on the Authentik side are comparable.

You do the setup directly in the Zammad admin area (Admin → Security → Third-party Applications).

Prerequisites

  • An active Zammad subscription at server.camp with administrator access
  • A reachable, SSO-capable identity provider instance (e.g. managed Authentik at server.camp)
  • Admin access to both systems
Have the redirect URI ready

Zammad uses a fixed callback URL for OpenID Connect. It is:

https://<your-zammad-domain>/auth/openid_connect/callback

Replace <your-zammad-domain> with the actual address of your Zammad instance. You’ll enter this URL in Authentik as the redirect URI shortly.

Step 1 – Create a provider in Authentik

  1. In Authentik, open Applications → Providers → “Create” → type: OAuth2/OpenID Connect
  2. Fill in the fields:
    • Name: Zammad
    • Client type: Public — Zammad authenticates via PKCE and needs no client secret
    • Redirect URIs: the callback URL of your Zammad instance (type: Strict): 
      https://<your-zammad-domain>/auth/openid_connect/callback
      Make sure the URI matches exactly — including https:// and the path.
    • Signing key: select the default key (already present)
  3. Save — Authentik now shows you the Client ID. You’ll need this value in Zammad shortly.

Step 2 – Create an application in Authentik

  1. Go to Applications → Applications → “Create”
  2. Fill in the fields:
    • Name: Zammad
    • Slug: zammad
    • Provider: select the Zammad provider you just created
  3. Optional: under UI settings, upload a Zammad logo and set the launch URL to https://<your-zammad-domain>
  4. Save
Restrict access to groups (recommended)
Open the application → Policy / Group / User Bindings tab → “Create” → Group → select the group that should have access to Zammad (e.g. support-team). That way only members of this group can sign in to Zammad via Authentik.

Step 3 – Note the values for Zammad

You’ll need two values from Authentik shortly:

  • the Client ID (from the provider in Step 1)
  • the issuer URL of your application:
https://<your-authentik>/application/o/zammad/

Replace <your-authentik> with your actual Authentik address and zammad with the slug you assigned in Step 2.

Check the issuer URL
At https://<your-authentik>/application/o/zammad/.well-known/openid-configuration you can check in your browser whether a JSON response appears — if so, the application is set up correctly and the discovery endpoint is reachable.

Step 4 – Configure OpenID Connect in Zammad

  1. Sign in to Zammad as an administrator
  2. Open Admin → Security → Third-party Applications
  3. Enable the “Authentication via OpenID Connect” toggle
  4. Enter the values:
Field Value
Display name Freely chosen, e.g. Authentik — appears on the login button
Identifier The Client ID from Authentik (Step 3)
Issuer The issuer URL from Step 3
PKCE method S256
Scopes openid, profile, email (default)
  1. Save
Accounts are linked automatically
Zammad matches the signing-in user against existing accounts by their email address and links them automatically. If someone signs in for whom no account exists yet, Zammad creates a new agent or customer account — depending on your security settings. Check the default role for newly created accounts under Admin → Security → Base.

Step 5 – Test the login

  1. Sign out of Zammad (or use a private browser window)
  2. On the login page there is now an additional button to sign in via your provider (with the display name you set in Step 4)
  3. Click it — you’ll be redirected to Authentik
  4. After authentication (and 2FA if applicable) you land back in Zammad and are signed in
Test first, switch over later
The classic login form remains alongside the SSO button. That way, if the configuration is faulty, you can still get in with your local admin account. Only disable the local login once signing in via SSO works reliably.

Roles and 2FA

  • Roles: Zammad assigns users created via SSO the default role (usually Agent or Customer). Automatically mapping Authentik groups to Zammad roles is not provided for via OpenID Connect — assign roles in Zammad under Admin → Users where needed. Instead, use the group binding in Authentik (Step 2) to control who is allowed to sign in at all.
  • Two-factor authentication: if you configure 2FA centrally in Authentik, it automatically applies to the Zammad login too — you then don’t need to enable 2FA additionally in Zammad.

Troubleshooting

  • “redirect_uri mismatch” at Authentik: check whether the redirect URI in Authentik matches https://<your-zammad-domain>/auth/openid_connect/callback exactly — including the protocol (https://) and the path.
  • No SSO button on the login page: is the “Authentication via OpenID Connect” toggle enabled and the configuration saved?
  • Login fails / user is rejected: check in Authentik whether the user is a member of the group bound to the Zammad application (Step 2).
  • Error retrieving the configuration: check that the issuer URL is correct and that the discovery endpoint (.well-known/openid-configuration) is reachable from Zammad.

Any questions?

If you run into problems with the SSO integration, we’re happy to help at support@server.camp or via server.camp/support.

Zammad – AI Features & LLM Integration