Expensify - SSO configuration

Expensify - SSO configuration

Alert
Please note that this application has not been formally tested by Kelvin Zero Inc. It is provided solely as a reference guide. If you encounter any issues, kindly submit a ticket directly through the support desk.
Quote
This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for Expensify using MPAS. SSO simplifies user authentication by allowing access to multiple applications with a single set of credentials. This integration enhances security and improves user experience across your organization
Warning
To set up Multi-Pass with  Expensify, ensure you meet the following requirements:
-  Expensify admin rights
- MPAS Admin rights
- Make sure that all users intended to use SSO in Expensify are registered in your IdP and have the necessary permissions to access Expensify.
Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment.

 

Expensify - SSO configuration



Step 1 - Enable SAML in Expensify

  1. Open an Incognito browser window, go to https://www.expensify.com/signin, and log in with your Expensify administrator account.
  2. Go to Settings > Domain Control, and select your domain.
  3. Click Verify, choose Add a DNS record, and follow instructions to verify your domain.
  4. Once verified, under Domain Control > SAML, toggle SAML Login to Enabled.
  5. From this page:
    1. Download the SP metadata file or note the following values:
      1. Entity ID / Identifier: https://www.expensify.com
      2. ACS / Reply URL: https://www.expensify.com/authentication/saml/loginCallback?domain=<yourdomain>
Notes
Contact Expensify support to confirm the correct ACS URL for your domain.


Step 2 - Access the Multi-Pass Console

  1. Open Multi-Pass Dashboard
  1. On the left side, click on integration and on application
  1. Locate the section called "Custom Integration" and click on SAML to do it custom or locate the box (if it is existing) to reach a predefined parameters set up.

  1. Complete the form : 
FieldValue
Client TypeSAML
Client IDhttps://www.expensify.com
NameExpensify
DescriptionSSO Integration
Assertion Consumer Service URL
https://www.expensify.com/saml/acs (or loginCallback pattern)
  NameID Policy Format
  Email


  1. Now we need to confirm the different fields, reach the advanced console 

  1. Click on Clients, and look for the application you juste created by using the search tab, when the line is highlighted click on it, 

  1. Make sure the fields are completed as below, start from the settings tab, general settings : 
FieldValue
Client TypeSAML
Client IDhttps://www.expensify.com
NameExpensify
DescriptionSSO Integration
Always Display in UION
  1. Scroll to the Access settings : 
FieldValue
Home URLhttps://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml/clients/expensify
Valid Redirect URIshttps://www.expensify.com/saml/acs (or loginCallback pattern)
IDP-Initiated SSO URL Nameexpensify
  1. Scroll to SAML capabilities : 
SettingValue
Name ID Formatemail
Force Name ID FormatOFF
Force POST BindingON
Include AuthnStatementON
  1. Keep going to the Signature and Encryption
SettingValue
Sign DocumentsOFF
Sign AssertionsON
  1. Click Save and reach the tab called Keys
  2. Make sure that both fields are switch to OFF
  3. Move to the advanced tab 
    1. Assertion Consumer Service POST Binding URL = From Expensify SP config (e.g. ACS or loginCallback)

SAML Attribute Mapping

  1. Add the following mappers under Client Scope, click on the line expensify

  1. Click on "Configure a new mapper" and select User attribute, you will need to repeat this steps for each attribute we need to configure

  1. Complete the fields for Email
FieldValue
Mapper TypeUser Attribute
Nameemail
User Attributeemail
Friendly Nameemail
SAML Attribute Nameemail
  1. First Name
Field
Value
Mapper TypeUser Attribute
Namegivenname
User Attributefirstname
Friendly Namegivenname
SAML Attribute Namegivenname
  1. Last Name
FieldValue
Mapper TypeUser Attribute
Namesurname
User AttributelastName
Friendly Namesurname
SAML Attribute Namesurname


Step 3 - Finalize the configuration in Expensify

  1. Upload the Multi-Pass metadata into Expensify if prompted. You can find it at:
    1. https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml/descriptor
  2. Save your configuration in both MPAS and Expensify.
  3. Test login via Expensify SSO with your domain.
  4. Enforce login via SAML for users if needed.

    • Related Articles

    • SAML SSO Integration Guide

      This guide provides an overview of how to configure SAML Single Sign-On (SSO) between Multi-Pass and a third-party Service Provider (SP). Multi-Pass acts as the Identity Provider (IdP) in this federation model. Multi-Pass is working on SCIM support ...

    • D2L Brightspace - SSO Integration

      This application has not been formally tested by Kelvin Zero Inc. It is provided solely as a reference guide. If you encounter any issues, kindly submit a ticket directly through the support desk. This documentation provides a step-by-step guide to ...

    • Mulesoft - SSO Integration

      This application has been formally tested by Kelvin Zero Inc. This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for Mulesoft using Multi-Pass. SSO simplifies user authentication by allowing access to multiple ...

    • Rocket.chat - SSO configuration

      This documentation has been tested and approved by Kelvin Zero's team This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for Rocket.chat using MPAS. SSO simplifies user authentication by allowing access to multiple ...

    • Wrike - SSO configuration

      This documentation has been tested and approved by Kelvin Zero's team This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for Wrike using MPAS. SSO simplifies user authentication by allowing access to multiple ...