SAP Concur - SSO Configuration
This application has not been formally tested by Kelvin Zero Inc. It is provided solely as a reference guide.
If you encounter any issues, kindly submit a ticket directly through the support desk.
This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for SAP Concur using Multi-Pass.
SSO simplifies user authentication by allowing access to multiple applications with a single set of credentials. This integration enhances security and improves user experience across your organization.
To set up Multi-Pass with SAP Concur, ensure you meet the following requirements:- SAP Concur admin rights
- MPAS Admin rights
- Make sure that all users intended to use SSO in SAP Concur are registered in your IdP and have the necessary permissions to access SAP Concur.
Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment.
SAP Concur - SSO Configuration
Step 1 - Obtain Tenant XML Metadata from Multi-Pass (IdP)
- Open Multi-Pass Dashboard
- Select the correct tenant and go to Integrations, click on Applications
- Select SAML in the custom integration section
- Select Download under Tenant XML data and save the file locally
Step 2 - Configure SAP Concur as the Service Provider (SP)
- Log into SAP Concur as an Administrator
- Navigate to Home > Administration > Company > Authentication Admin
- Select SSO Required beside SSO Setting
- Select Download SAP Concur Metadata and save the file locally
- Beside SSO Configurations select Add
- Under Custom IdP Name enter
Multi-Pass - Select Upload XML File and upload the Tenant XML Metadata file from Step 1
- Select Add Metadata
Step 3 - Configure Multi-Pass as the Identity Provider (IdP)
- Open Multi-Pass Dashboard
- Select the correct tenant and go to Integrations, click on Applications
- Select SAML in the custom integration section
- Select Upload File and upload your SAP Concur Metadata
- Confirm/Complete the remaining fields based on the table below:
| Field | Value |
|---|---|
| Client ID (=SP Entity ID) | https://us.api.concursolutions.com/saml2 |
| Name | sapconcur |
| Description | SAP Concur SSO integration |
| Assertion Consumer Service URL | https://www-us.api.concursolutions.com/sso/saml2/V1/acs/ |
| NameID Policy Format | Email |
- Go to the Advanced Console by clicking on the right side of your screen
- Complete the fields based on the tables below:
General settings (Multi-Pass)
| Field | Value |
|---|---|
| Client ID | https://us.api.concursolutions.com/saml2 |
| Name | sapconcur |
| Description | SAP Concur SSO Integration |
| Always display in UI | ON |
Access settings (Multi-Pass)
| Field | Value |
|---|---|
| Home URL (IdP-initiated) | https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml/clients/<APP_NAME> |
| Valid Redirect URIs (ACS) | https://www-us.api.concursolutions.com/sso/saml2/V1/acs/ |
| IDP-Initiated SSO URL Name | <APP_NAME> |
SAML Capabilities
| Setting | Value |
|---|---|
| Name ID Format | email |
| Force Name ID Format | OFF |
| Force POST Binding | ON |
| Include AuthnStatement | ON |
Signature & Encryption
| Setting | Value |
|---|---|
| Sign Documents | OFF |
| Sign Assertions | ON |
- Move to the tab Keys and ensure that both parameters are set to OFF.
- Go to the Advanced tab and set Assertion Consumer Service POST Binding URL to:
https://www-us.api.concursolutions.com/sso/saml2/V1/acs/