How to Configure SAML 2.0 for Expensify

Contents

• Supported Features
• Configuration Steps
• Notes

---

Supported Features

The Okta/Expensify SAML integration currently supports the following features:

• SP-initiated SSO
• IdP-initiated SSO
• SP-initiated Single Logout

For more information on the listed features, visit the Okta Glossary.

---

Configuration Steps

1. Log on to your Expensify instance as domain administrator.

2. Navigate to Settings > Domain Control.

3. Click on the required domain.



4. Select the SAML menu item.

5. Switch SAML Login option to ENABLED.

6. [OPTIONAL] Enable the Required for login option.

   Note: After choosing this options, users can only sign in with SSO and cannot use an Expensify password. Please make sure the SAML configuration works properly before enabling this option.

7. Scroll down to Service Provider MetaData and copy the Service Provider MetaData value:



8. Paste the Service Provider MetaData into the text editor and copy the X509Certificate value:



9. Create a file in a text editor in the following format:

   -----BEGIN CERTIFICATE-----
   [your X509Certificate value] (step 8)
   -----END CERTIFICATE-----



10. Save the text file as expensify_slo.cert.

11. In Okta, select the Sign Ontab for the Expensify app, then click Edit.

    • Check the Enable Single Logout box.

    • Signature Certificate: Click Browse to locate and upload the expensify_slo.cert certificate file you saved earlier (step 10).

    • Click Save.

    

12. Important: Close this instruction page, click View Setup Instructions again and proceed from step 13.



13. Go back to the Expensify SAML configuration page.

14. Enter the following Identity Provider MetaData value into the corresponding field:

    Sign into the Okta Admin Dashboard to generate this variable.

15. Done!

---

Notes

Make sure that you entered the correct value in the Company Domain field under the General tab in Okta. Using the wrong value will prevent you from authenticating via SAML to Expensify.

SP-initiated SSO

1. Open the following URL in your browser: https://www.expensify.com/authentication/saml/login.

2. Enter your email address. then click Go: