Please note that this application has not been formally tested by Kelvin Zero Inc. It is provided solely as a reference guide. If you encounter any issues, kindly submit a ticket directly through the support desk.

This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for Expensify using MPAS. SSO simplifies user authentication by allowing access to multiple applications with a single set of credentials. This integration enhances security and improves user experience across your organization

To set up Multi-Pass with  Expensify, ensure you meet the following requirements:

-  Expensify admin rights

- MPAS Admin rights

- Make sure that all users intended to use SSO in Expensify are registered in your IdP and have the necessary permissions to access Expensify.

Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment.

Expensify - SSO configuration

Step 1 - Enable SAML in Expensify

1. Open an Incognito browser window, go to https://www.expensify.com/signin, and log in with your Expensify administrator account.
   
2. Go to Settings > Domain Control, and select your domain.
   
3. Click Verify, choose Add a DNS record, and follow instructions to verify your domain.
   
4. Once verified, under Domain Control > SAML, toggle SAML Login to Enabled.
   
5. From this page:
   
1. Download the SP metadata file or note the following values:
   
1. Entity ID / Identifier: https://www.expensify.com
   
2. ACS / Reply URL: https://www.expensify.com/authentication/saml/loginCallback?domain=<yourdomain>
   

Contact Expensify support to confirm the correct ACS URL for your domain.

Step 2 - Access the Multi-Pass Console

1. Open Multi-Pass Dashboard
   

1. On the left side, click on integration and on application
   

1. Locate the section called "Custom Integration" and click on SAML to do it custom or locate the box (if it is existing) to reach a predefined parameters set up.
   

1. Complete the form : 
   

Field	Value
Client Type	SAML
Client ID	https://www.expensify.com
Name	Expensify
Description	SSO Integration
Assertion Consumer Service URL	https://www.expensify.com/saml/acs (or loginCallback pattern)
NameID Policy Format	Email

1. Now we need to confirm the different fields, reach the advanced console 
   

1. Click on Clients, and look for the application you juste created by using the search tab, when the line is highlighted click on it, 
   

1. Make sure the fields are completed as below, start from the settings tab, general settings : 
   

Field	Value
Client Type	SAML
Client ID	https://www.expensify.com
Name	Expensify
Description	SSO Integration
Always Display in UI	ON

1. Scroll to the Access settings : 
   

Field	Value
Home URL	https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml/clients/expensify
Valid Redirect URIs	https://www.expensify.com/saml/acs (or loginCallback pattern)
IDP-Initiated SSO URL Name	expensify

1. Scroll to SAML capabilities : 
   

Setting	Value
Name ID Format	email
Force Name ID Format	OFF
Force POST Binding	ON
Include AuthnStatement	ON

1. Keep going to the Signature and Encryption
   

Setting	Value
Sign Documents	OFF
Sign Assertions	ON

1. Click Save and reach the tab called Keys
   
2. Make sure that both fields are switch to OFF
   
3. Move to the advanced tab 
   
1. Assertion Consumer Service POST Binding URL = From Expensify SP config (e.g. ACS or loginCallback)
   

SAML Attribute Mapping

1. Add the following mappers under Client Scope, click on the line expensify
   

1. Click on "Configure a new mapper" and select User attribute, you will need to repeat this steps for each attribute we need to configure
   

1. Complete the fields for Email

Field	Value
Mapper Type	User Attribute
Name	email
User Attribute	email
Friendly Name	email
SAML Attribute Name	email

1. First Name

1. Last Name