This documentation has been tested and approved by Kelvin Zero's team

This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for Salesforce using MPAS. SSO simplifies user authentication by allowing access to multiple applications with a single set of credentials. This integration enhances security and improves user experience across your organization.

To set up Multi-Pass with  Salesforce, ensure you meet the following requirements:

-  Salesforce admin rights

- MPAS Admin rights

- Make sure that all users intended to use SSO in Salesforce are registered in your IdP and have the necessary permissions to access Salesforce.

Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment.

Salesforce - SSO configuration

This guide is based on the Salesforce Developer Environment. Your production dashboard layout may differ slightly, but the steps and configuration remain consistent.

Step 1 -  Enable SAML SSO in Salesforce

1. On your Salesforce dashboard, click the ⚙️ gear icon (top-right corner) and select Setup.
   

1. In the left navigation bar, scroll down to Settings
   
2. Click Identity, then click Single Sign-On Settings.
   

1. Under SAML Single Sign-On Settings, click New from Metadata File.
   

1. Upload the metadata file you’ll generate in MPAS (instructions below).
2. Click Create.
   

Setting	Status
Assertion contains the user's Salesforce username	Enabled
Identity is in the NameIdentifier element of the Subject statement	Enabled
HTTP POST	Enabled
Use Salesforce MFA for this SSO Provider	Enabled
Single Logout Enabled	Enabled
Use selected request signature method for Single Logout	Enabled
Single Logout Request Binding	HTTP POST

 Step 2 - Import the Metadata into Multi-Pass

1. Open Multi-Pass Dashboard
   
2. Select your tenant and go to the Advanced Console.
   

1. In the left sidebar, click Clients, then Import Client.
   

1. Upload the Salesforce metadata file.
   

1. Complete the following fields:
   

Field	Value
Name	Salesforce
Description	Your choice
Always Display in UI	ON

1. Now make sure that the next fields are completed
   

General Settings

Field	Value
Home URL	https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml/clients/<APP_NAME>
Valid Redirect URIs	Automatically filled or matches the Salesforce Login URL
Valid Post Logout URIs	Automatically filled or matches the Salesforce Logout URL
IDP-Initiated SSO URL Name	<APP_NAME>

Setting	Value
Sign Documents	ON
Sign Assertions	ON

1. Click Save, then go to the Keys tab and make sure:
   

Field	Value
Signing Keys Configuration	OFF
Encryption Keys Configuration	OFF

1. Switch to the Advanced tab and verify the following fields (automatically filled):
   

Field	Value
Assertion Consumer Service POST Binding URL	From metadata or login URL
Logout Service POST Binding URL	From metadata or logout URL
Logout Service Redirect Binding URL	From metadata or logout URL

1.  To obtain the SAML metadata from Multi-Pass:
   
1. In the Advanced Console, click Realm Settings (bottom-left).
   
2. Scroll down to SAML 2.0 Identity Provider Metadata.
   
3. A popup will open:
   
1. Either copy the metadata URL to paste in Salesforce.
   
2. Or right-click the page and save it as a .xml file.
   

Step 3 - Finalize SSO Setup in Salesforce

1. Go back to the Single Sign-On Settings in Salesforce.
   
2. Click Edit and toggle SAML Enabled → Save.
   

1. To assign SSO to your domain:
   
1. In the left menu, go to Settings → Company Settings → My Domain.
   

1. Scroll down to Authentication Configuration.
   
2. Click Edit.
   
3. Select the SSO you created (based on the name).
   
4. Customize the login button label (optional).
   
5. Click Save.