This document has been tested and approved by Kelvin Zero Inc

This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for Mendix using Multi-Pass. SSO simplifies user authentication by allowing access to multiple applications with a single set of credentials. This integration enhances security and improves user experience across your organization.

To set up Multi-Pass with Mendix, ensure you meet the following requirements:
- Mendix admin rights
- MPAS Admin rights
- Make sure that all users intended to use SSO in Mendix are registered in your IdP and have the necessary permissions to access Mendix
Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment.

Mendix - SSO Configuration

Step 1 — Configure Multi-Pass as the Identity Provider (IdP)

• Open Multi-Pass Dashboard
• Select the correct tenant and go to Integrations, click on Applications
• Select in the custom integration section OIDC
  

1. Select Add Integration
2. Go to the advanced console by clicking on the right side of your screen
   

• Click on Client and search for Mendix
• Verify that the fields are populated as follows:
  

• Browse to the Credentials Tab and copy the Secret Key (to be used in Step 2)
  

• Browse to the Client Scopes Tab and click on the first scope in the list
  

• Click Add Predefined Mapper and add the following mappers:
  • given name
  • username
  • family name
    

Step 2 — Configure Mendix as the Service Provider (SP)

• Log into Mendix as an Administrator
• Navigate to the Mendix Control Center
• Browse to Security > Settings > Single Sign-On
• Select Configure Single Sign-On
  

• Select Add Configuration
  

• Continue on the prompt About enabling Single Sign-On (BYO-IDP)
  
• Populate the fields based on the table below

• Ensure OpenID, Email, and Profile scopes are enabled
  

• Click Next
• Click Test Settings (a new window will confirm success)
  

1. Complete the Map Claims screen based on the table below
   

• Click Next
• Click Activate