This documentation has been tested and approved by Kelvin Zero's team

This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for HubSpot using MPAS. SSO simplifies user authentication by allowing access to multiple applications with a single set of credentials. This integration enhances security and improves user experience across your organization.

In order to set up Multi-Pass with HubSpot, you need to be sure that you meet the requirements below:

- Enterprise plan on HubSpot

- HubSpot admin rights

- MPAS Admin rights and SSO metadata

Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment.

Configuring HubSpot

1. From your HubSpot dashboard, click the gear icon in the top right corner.

• Click “Security.”

• Locate the line “Get single sign-on (SSO) for your account” and click “Manage.”

• A new window will open on the right—this is where you need to enter information from MPAS.

Copy the Audience URI (Service provider Entity ID) and Sign on URL, ACS, Recipient or Redirect you will need it

1. Open Multi-Pass Dashboard
   
2. Select your deployment, and click on advanced console
3. Go to “Client”, and click “Create.”
   
4. Fill in the required fields.
   

Client type : SAML 

Client ID :  Audience URI (Service provider Entity ID) from Hubspot

Name : HubSpot

Description : 

Always display UI : ON

1. Click “Next” and complete the following fields with the information provided below.
   

Identity Provider issuer URL: https://ca.auth.kzero.com/realms/<REALM>


Single - Sign on url should be: https://ca.auth.kzero.com/realms/<realm>/protocol/saml

Sign out url: https://ca.auth.kzero.com/realms/<REALM>/protocol/openid-connect/logout 

You will need to paste this links into HubSpot and do not forget to change the <REALM> to your realm's name

• In MPAS, go to the left column and click “Realm Settings” to access the RS256 information required for the X.509 certificate.

Copy the certificate, and do not forget to add -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- (Without space before the first character and the last one) 

• Go back to HubSpot and complete the required fields.