IdP-Initiated Authentication with Zitadel

Hello. Trying to use SentinelOne as a connected SAML app in Zitadel. SentinelOne has a limitation where it only supports a single domain when SP-initiated. This works as expected with the one domain but not when attempting to login with any other domain. However, when IdP-initiated (with Duo or Okta for example), SentinelOne will accept any domain. Is there a way for Zitadel to perform an IdP-Initiated login?

Ask Inkeep•12/10/25, 6:49 PM

Hi @Pam Pozzi, I'm an AI assistant for ZITADEL. While a team member reviews this question, I'll see if I can find relevant sources for your question.

Ask Inkeep•12/10/25, 6:50 PM

Answer

ZITADEL currently does not support IdP-initiated SAML authentication. (1) questions-help-bugsIDP initiated SAML login

When ZITADEL acts as a SAML Identity Provider, it only supports the SP-initiated flow, where the user starts at the Service Provider, which then sends a SAML request to ZITADEL. (1)

Workaround suggestion from the community:

You can configure a default redirect target in ZITADEL's login settings. If someone lands on the ZITADEL login without context, ZITADEL will redirect them to this default target after authentication. The idea is that your application (SentinelOne) would then initiate a proper SP-initiated flow. However, this may not fully solve your multi-domain requirement since it still relies on SP-initiated authentication. questions-help-bugsIDP initiated SAML login

The default redirect setting can be configured at the organization level under /ui/console/org-settings?id=login/ui/console/org-settings?id=login.

If this is a critical requirement, you may want to consider creating a feature request on GitHub to extend SAML IdP-initiated support.

Ask Inkeep•12/10/25, 6:50 PM

To learn more, see the sources I considered:

[1] Authenticate users with SAML
questions-help-bugsIDP initiated SAML login

Ask Inkeep•12/10/25, 6:50 PM

Feel free to tag @Ask Inkeep with additional questions.