15Five - SSO configuration

15Five - SSO configuration

Alert
Please note that this application has not been formally tested by Kelvin Zero Inc. It is provided solely as a reference guide. If you encounter any issues, kindly submit a ticket directly through the support desk.
Quote
This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for 15Five using MPAS. SSO simplifies user authentication by allowing access to multiple applications with a single set of credentials. This integration enhances security and improves user experience across your organization.
Warning
To set up Multi-Pass with  15Five, ensure you meet the following requirements:
- 15Five admin rights
- 15Five Sub-Domain https://<COMPANY_NAME>.15five.com
- MPAS Admin rights
- Make sure that all users intended to use SSO in 15Five are registered in your IdP and have the necessary permissions to access 15Five.
Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment.




15Five - SSO configuration




Step 1 - Configure in 15Five

  1. Admin login
  2. Click on Company Settings
  3. Reach Single Sign-On
  4. and click on Getting Started
  5. Enter the subdomain → XML Setup: paste the IdP metadata (Multi-Pass, you will where to find it in the steps below)
  6. Detail Setup:
    1. IdP Identity ID = Entity ID (Multi-Pass) = https://ca.auth.kzero.com/realms/<TENANT_NAME>
    2. IdP SSO URL = SSO URL (Multi-Pass) = https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml
    3. Binding = HTTP-Redirect
    4. Metadata URL = https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml/descriptor
    5. User Attribute = NameID = email
  7. Click on Save
SP Values (to use in Multi-Pass)
FieldValue
Sign-on URL (Start URL)https://<COMPANY_NAME>.15five.com
ACS URLhttps://<COMPANY_NAME>.15five.com/saml2/acs (confirm with official docs)
Entity ID / Identifier (Audience URI)https://<COMPANY_NAME>.15five.com/saml2/metadata/
Metadata (SP)Provided by 15Five (if requested)
Notes
The values above follow Microsoft patterns. Replace <COMPANY_NAME> with your real subdomain. Confirm with 15Five support if in doubt.

Step 2 - Configure in Multi-Pass (Identity Provider)

  2. Select your tenant
  1. Click on Integrations and select Applications
  2. Reach the custom section and click on SAML
  1. Enter the following values from 15Five:
FieldValue
Client ID (= SP Entity ID)https://<COMPANY_NAME>.15five.com/saml2/metadata/
Name15Five
Description15Five SSO integration
Assertion Consumer Service (ACS) URLhttps://<COMPANY_NAME>.15five.com/saml2/acs
NameID Policy Formatemail
  1. Then download the Tenant XML Metadata
  1. Click on Add integration
  2. On the left side of your screen, click on "Advanced console"
  3. Click on Client and use the search bar to look for 15Five
  4. Make sure all the fields are well completed : 
General settings (MPAS)
FieldValue
Client IDhttps://<COMPANY_NAME>.15five.com/saml2/metadata/
Name15Five
Description15Five SSO integration
Always Display in UION

Access settings (MPAS)
FieldValue
Home URL (IdP-initiated)https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml/clients/15Five
Valid Redirect URIs (ACS)https://<COMPANY_NAME>.15five.com/saml2/acs
IDP-Initiated SSO URL Name15Five

SAML Capabilities (MPAS)
SettingValue
Force Name ID FormatON
Force POST BindingON
Include AuthnStatementON

Signature & Encryption (MPAS)
SettingValue
Sign DocumentsOFF
Sign AssertionsON
  1. Move to the tab "Keys" and make sure that both parameters are switched to OFF
  2. Go to the "advanced" tab
    1. Assertion Consumer Service POST Binding URL = Valid Redirect URIs (ACS) = https://<COMPANY_NAME>.15five.com/saml2/acs

Step 3 - Finalize & Test

  • Paste the Multi-Pass IdP metadata into the configuration.
  • Verify the IdP Entity ID, IdP SSO URL, and the certificate.
  • Enable SSO.
  • Save changes.
Info
No native SCIM is available — provisioning must be done manually.
  • In the 15Five Admin Console: Click on Manage Company
  • Then click on People and Add People.
  • Enter:
    • First Name, Last Name, Title, Email (must match the value in Entra/Multi-Pass).
  • The user will receive an activation email.

Test the Configuration
  • From Multi-Pass: create a test user with the same email address.

Run a login test:

  • Sign-on URL = https://<COMPANY_NAME>.15five.com
  • Confirm authentication flows through SAML (Multi-Pass).
  • Verify attributes sent:
    • Mandatory → email
    • Optional (if mapped) → first name, last name, title