This documentation has been tested and approved by Kelvin Zero's team

This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for ConnectWise using MPAS. SSO simplifies user authentication by allowing access to multiple applications with a single set of credentials. This integration enhances security and improves user experience across your organization.

To set up Multi-Pass with ConnectWise, ensure you meet the following requirements:

- ConnectWise admin rights

- MPAS Admin rights

- Make sure that all users intended to use SSO in ConnectWise are registered in your IdP and have the necessary permissions to access ConnectWise.

Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment.

ConnectWise - SSO configuration

Step 1 - Prepare ConnectWise SSO

1. Log into your ConnectWise dashboard.
   
2. On the bottom-left, click on System.
   
3. Select Set Up Table.
   

1. In the Table search bar, type SSO.
   

1. Click on SSO Configuration, then click on + to add a new SSO entry.
2. Complete the following fields:
   

Field	Value
Description	Multi-Pass
SSO Type	SAML
Locations	Choose based on user location for SSO

1. Leave the window open and open a new one for Multi-Pass.
   

Step 2 - Access Multi-Pass and Client Configuration

1. Open Multi-Pass Dashboard
   

1. Select the right deployment, then open the Advanced Console.
   

1. In the left menu, go to Clients, and choose one of the following:
   
1. Import client (if you already have the ConnectWise metadata file), or Create client manually
   

1. You can download the metadata file from ConnectWise here: https://<SITE_NAME>/v4_6_release/auth/<COMPANY_ID>/metadata
   

1. Complete the different fields: Basic Client Info
   

Field	Value
Name	ConnectWise
Description	SSO Integration
Always display in UI	ON
Client Type	SAML
Encrypt Assertions	OFF
Client Signature Required	OFF

1. Please verify the next fields to be well completed :
   
2. Settings Tab 
   

Field	Value
Valid Redirect URIs	https://<SITE_NAME>/v4_6_release/auth/<COMPANY_ID>/Acs
Name ID Format	email
Force Name ID Format	ON
Force POST Binding	ON
Include AuthnStatement	ON
Sign Assertions	ON

1. Keys tab
   
1. Both elements  need to be switched off 
   
2. Advanced Tab
   
1. Make sure Assertion Consumer Service POST Binding URL  as been completed by the metada file and is the same than Valid redirect URIs
   
3. Click on Save
   
4. Get x.509 Certificate, go to Realm Settings.
5. Click on the Keys tab.
6. On the line RS256, click Certificate.
7. Copy the content and save it as a .pem file.
   

​

Step 3 - Complete ConnectWise Configuration

1. Fill in the remaining fields in ConnectWise:
   

Field	Value
Login URL	https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml
Identity Provider ID	https://ca.auth.kzero.com/realms/<TENANT_NAME>
Certificate	Upload the .pem file created from MPAS

1. Click Save
   

1. Go to System > Members.
   

1. Select a user from an SSO-enabled location.
2. Scroll down to the Authentication section.
3. Confirm that SAML SSO is enabled.