This application has not been formally tested by Kelvin Zero Inc. It is provided solely as a reference guide. If you encounter any issues, kindly submit a ticket directly through the support desk.

This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for Pendo using Multi-Pass. SSO simplifies user authentication by allowing access to multiple applications with a single set of credentials. This integration enhances security and improves user experience across your organization.

To set up Multi-Pass with Pendo, ensure you meet the following requirements:
- Pendo admin rights
- MPAS Admin rights
- Make sure that all users intended to use SSO in Pendo are registered in your IdP and have the necessary permissions to access Pendo.
Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment.

Pendo - SSO configuration

Step 1 — Configure Pendo (Service Provider)

• Log into Pendo as an Administrator
• Go to Settings > Organization Settings
• Select the Domain Verification tab
• Select Add Domain and a new window will open
• Enter the domain and select Add Domain
• Copy the TXT record
• Log into the Domain Manager for the applicable domain (e.g., GoDaddy, Cloudflare, Microsoft)
• Add a TXT Record:
  • Host/Name: @
  • Value: Select “Copy Record” in Pendo to obtain your unique value
  • TTL: Leave as default (e.g., 3600 seconds)
• Save the TXT Record
• After the domain has been verified by Pendo you will be able to configure SSO
• Navigate to Settings > Organization Settings
• Select the SSO tab
• Select Add New Configuration
• Select your verified domain in the Domain dropdown menu
• Under Metadata URL insert:
  
• https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml/

• Select Sign AuthNRequest
• Enter your MSP Support Email Address under Technical Contact
• Select Save Configuration
  
  

Step 2 — Configure Multi-Pass (Identity Provider)

• Open Multi-Pass Dashboard
• Select the correct tenant and go to Integrations, click on Applications
• Select SAML in the custom integration section
  

• Browse to https://cdn.pendo.io/saml/pingone-metadata-sp.xml and save the file locally
• Select Upload File and upload the Pendo Metadata
  

• Complete the fields based on the table below
  

Field	Value
Client ID (=SP Entity ID)	PendoConnectUS
Name	pendo
Description	Pendo SSO integration
Assertion Consumer Service URL	https://sso.connect.pingidentity.com/sso/sp/ACS.saml2
NameID Policy Format	email

• Click Add Integration
• Click Advanced Console
  

• Click Clients and search for Pendo

• Complete/Confirm the fields based on the tables below

General settings (Multi-Pass)

Field	Value
Client ID	PendoConnectUS
Name	pendo
Description	Pendo SSO integration
Always display in UI	ON

Access settings (Multi-Pass)

Field	Value
Home URL (IdP-initiated)	https://ca.auth.kzero.com/<TENANT_NAME>/protocol/saml/clients/<APP_NAME>
Valid Redirect URIs (ACS)	https://sso.connect.pingidentity.com/sso/sp/ACS.saml2
IDP-Initiated SSO URL Name	<APP_NAME>

SAML Capabilities

Setting	Value
Name ID Format	email
Force Name ID Format	ON
Force POST Binding	ON
Include AuthnStatement	ON

Signature & Encryption

Setting	Value
Sign Documents	OFF
Sign Assertions	ON

• Move to the tab Keys and ensure that both parameters are set to OFF
  

• Go to the Advanced tab:
  • Set Assertion Consumer Service POST Binding URL = https://sso.connect.pingidentity.com/sso/sp/ACS.saml2