This documentation has been tested and approved by Kelvin Zero's team

This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for Addigy using MPAS. SSO simplifies user authentication by allowing access to multiple applications with a single set of credentials. This integration enhances security and improves user experience across your organization.

To set up Multi-Pass with Addigy, ensure you meet the following requirements:

- Addigy admin rights

- MPAS Admin rights

- Make sure that all users intended to use SSO in Addigy are registered in your IdP and have the necessary permissions to access Addigy.

Important: Custom elements in URLs (like tenant names) are case sensitive. Make sure to match the exact casing from your environment.

Addigy - SSO configuration

Step 1 - Start Configuration in Addigy

1. Log in to your Addigy dashboard.
   
2. In the left-hand navigation bar, click Account, then select Integration.
   
3. Scroll down to the Log In Options section.
   
4. Click on New SAML App.
   

1. A configuration window will appear with several fields to complete. Keep this page open.
   

Step 2 - Configure the Client in Multi-Pass (MPAS)

1. Open Multi-Pass Dashboard
   
2. Select your deployment, then click Advanced Console on the left.
   

1. In the new console, go to Clients > Create Client.
   

If Addigy provides a metadata file, you can also click Import Client to simplify the setup.

Manual Client Configuration

1. Click Next to proceed.
   

1. Click Save.
   

1. Review Settings in Each Tab
   

1. Make sure both parameters are switch to OFF
   

1. make sure Assertion Consumer Service POST Binding URL = Valid Redirect URIs
   
2. Addigy requires the following attributes:
   
1. given_name → user's first name
   
2. family_name → user's last name
   
3. email → user's email
   
3. To configure them:
   
1. Click on the Client Scopes tab.
   
2. Select the assigned client scope (same as your Client ID).
   

1. Click Add Mapper > By Configuration > User Property.
   

1. Create mappers one by one:
   

Field	Value
Name	given_name / family_name
Property	firstName / lastName
Friendly Name	given_name / family_name
SAML Attribute Name	given_name / family_name
SAML Attribute Name Format	Basic

Repeat the process for email if not already included by default.

1. In the left menu, click on Realm Settings.
   
2. Go to the Keys tab.
   
3. On the RS256 line, click Certificate.
   
4. A window will open — copy the certificate and paste it into a Notepad file for use in Addigy.
   

Step 3 - Finalize Setup in Addigy

1. Back in the SAML App configuration page in Addigy:
   

Field	Value
App Name	Multi-Pass (or any label)
SSO URL	https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml
Certificate	Upload X.509 certificate from MPAS
Allow Automatic User Provisioning	ON
Allow IdP-Initiated SSO	ON

1. Click Update, then switch the toggle to Enabled in the top-right corner.
   

You're Done!

Multi-Pass is now fully integrated as a SAML Identity Provider for Addigy.

Your users can now authenticate passwordlessly using their Multi-Pass account.