Rocket.chat - SSO configuration
This documentation has been tested and approved by Kelvin Zero's team
This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for Rocket.chat using MPAS. SSO simplifies user authentication by allowing access to multiple applications with a single set of credentials. This integration enhances security and improves user experience across your organization.
To set up Multi-Pass withRocket.chat, ensure you meet the following requirements:
- Rocket.chat admin rights
- MPAS Admin rights
- Make sure that all users intended to use SSO in Rocket.chat are registered in your IdP and have the necessary permissions to access Rocket.chat.
Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment.
Rocket.chat - SSO configuration
Step 1 – Access Rocket.Chat SAML Settings
- From your Rocket.Chat dashboard, click the three vertical dots on the left sidebar and go to Workspace.
- In the left column, scroll down and click on Settings.
- Use the search bar or scroll to find the SAML section and click Open.
- Complete the following two fields:
- Custom Provider: multipass (example)
- Custom Issuer: https://<YOUR_ROCKETCHAT_DOMAIN>/_saml/metadata/<CUSTOM_PROVIDER_NAME>
Step 2 – Configure MPAS (Multi-Pass)
- Select the appropriate deployment, then click on Advanced Console.
- In the left menu, click Clients → Create Client.
- Fill in the following:
| Field | Value |
|---|---|
| Client Type | SAML |
| Client ID | https://<YOUR_ROCKETCHAT_DOMAIN>/_saml/metadata/<CUSTOM_PROVIDER_NAME> |
| Name | rocketchat |
| Description | test SSO |
| Always display in UI | ON |
- Click Next, then complete:
| Field | Value |
|---|---|
| Home URL | https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml/clients/<SSO_Name> |
| Valid Redirect URIs | https://<YOUR_ROCKETCHAT_DOMAIN>/_saml/validate/<CUSTOM_PROVIDER_NAME> |
| IDP-Initiated SSO URL Name | rocketchat |
- Click Save
Make sure the next fields are correctly completed :
- In the settings tab, SAML capabilities section :
| Field | Value |
|---|---|
| Name ID Format | |
| Force Name ID Format | ON |
- in the Signature and Encryption section
- Sign Assertions : ON
- Click Save, and go to the keys tab :
- Signing keys config: OFF
- Encryption keys config: OFF
- Now, go to the advanced tab:
- Assertion Consumer Service POST Binding URL: https://<YOUR_ROCKETCHAT_DOMAIN>/_saml/validate/<CUSTOM_PROVIDER_NAME> (Same than the one you add to Valid Redirect URIs)
- Click Save
Step 3 – Retrieve the Certificate
- On the left menu, click Realm Settings → Keys tab.
- Locate the line labeled RS256 and click Certificate.
- Copy the certificate and paste it into a .pem file, surrounded by:
-----BEGIN CERTIFICATE-----
(your cert)
-----END CERTIFICATE-----
Step 4 – Finalize Rocket.Chat Configuration
Back in Rocket.Chat, complete the fields:
- Custom Entry Point: https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml
- IDP SLO Redirect URL: https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml
- Public Cert Contents: Paste the .pem certificate from the previous step.
- Click Save changes at the bottom right of the page.
- Finally, enable SSO using the toggle at the top right corner of the page.
If you want to customize layout or user role mappings, explore the Premium and General tabs in Rocket.Chat settings.
Related Articles
SAML SSO Integration Guide
This guide provides an overview of how to configure SAML Single Sign-On (SSO) between Multi-Pass and a third-party Service Provider (SP). Multi-Pass acts as the Identity Provider (IdP) in this federation model. Multi-Pass is working on SCIM support ...ConnectWise - SSO configuration
This documentation has been tested and approved by Kelvin Zero's team This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for ConnectWise using MPAS. SSO simplifies user authentication by allowing access to multiple ...SuperOps - SSO configuration
This documentation has been tested and approved by Kelvin Zero's team This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for SuperOps using MPAS. SSO simplifies user authentication by allowing access to multiple ...Auvik - SSO configuration
This documentation has been tested and approved by Kelvin Zero's team This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for Auvik using MPAS. SSO simplifies user authentication by allowing access to multiple ...HaloPSA - SSO configuration
This documentation has been tested and approved by Kelvin Zero's team This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for HaloPSA using MPAS. SSO simplifies user authentication by allowing access to multiple ...