I was referred to this forum by support (Ticket #10684027) in order to get developer assistance. I'm looking for some advice around DNS changes on my site as I'm encountering a bad user login experience today due to recent changes made by Zendesk.
I have JWT based SSO setup for my end users in my Zendesk tenant and internal Zendesk auth set up for my agents. When I set this up several years ago, clicking on the sign-in link on my Guide site would take users to my external SSO IdP for authentication, which was my desired experience.
Starting back in August and continuing today, when anyone clicks on the sign-in link on my Guide site, they started being taken to the internal Zendesk authentication page, on which customers have to select "I'm a customer" to be able to sign in.
This has caused a great amount of confusion for my customers as they miss the "I'm a customer link" and attempt to log into Zendesk with internal auth credentials but fail.
I've been working with support for the past 4+ months attempting to determine what caused this, as we initially thought it may be related to deprecated API calls in use by my Guide theme.
This week, support has determined the most likely cause it that I have the word "admin" in the subdomain of my host mapped URL that customers are logging in from. Put another way, the page on my Guide site that has a sign in link is of the form "admin.mycompany.com".
Support informs me there is a regex in place that will automatically redirect any login attempts from host mapped URLs with the string "admin" in them to internal Zendesk auth and that this is a recent security feature.
I'm in the process of moving from a multi-brand site to a single brand site and will be setting up cnames for all 5 of my current brand host mapped URLs to point to the same FQDN that my "admin" brand currently uses (mycompany.zendesk.com). This should solve the issue for anyone who just goes to my support site via links links from our website or those just naturally browsing to support.mycompany.com, but I worry about users who still have admin.mycompany.com bookmarked as I expect they will continue to experience this odd login flow.
I don't want to break those bookmarks, but I'm not sure how I'd get them a good login experience if they follow one of those links. Any advice I can get will be greatly appreciated.
