> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-ai/use-harness-platform/authentication/single-sign-on-saml/okta-oin-app.md).

# Okta (OIN app)

Use the Harness app integration from the Okta Integration Network (OIN) to let your users log in to Harness with their Okta credentials.

Because the Harness integration is published in the OIN, you add it directly from the Okta app catalog instead of building a custom SAML app. The SAML endpoints, audience URI, and signing settings are pre-configured, so the only value you supply is the ACS URL from your Harness account.

Okta acts as a SAML identity provider (IdP) for Harness. When a user attempts to log in to Harness, Harness redirects them to Okta for authentication. After successful authentication, Okta sends a signed SAML assertion containing user attributes back to Harness, which validates it and grants access. Optionally, Okta includes group membership information in the SAML assertion through group attribute statements, so Harness assigns users to corresponding Harness user groups for role-based access control (RBAC).

{% hint style="info" %}
Looking for the custom SAML app setup instead? [Okta (custom SAML app)](/harness-ai/use-harness-platform/authentication/single-sign-on-saml/okta.md) explains how to create and configure a SAML 2.0 app integration manually. Keep whichever path matches how your Okta org adds the Harness app.
{% endhint %}

***

### What you will learn in this topic <a href="#what-you-will-learn-in-this-topic" id="what-you-will-learn-in-this-topic"></a>

By the end of this topic, you will be able to:

* [Copy the Harness ACS URL](#step-2-copy-the-saml-endpoint-acs-url-from-harness) that the Okta app needs.
* [Add the Harness OIN app integration in Okta](#step-3-add-the-harness-oin-app-in-okta) and enter the ACS URL.
* [Assign Okta users and groups](#step-4-assign-users-and-groups-to-the-app) to the Harness app.
* [Configure Harness to use Okta](#step-5-add-the-okta-saml-metadata-to-harness) as a SAML SSO provider.
* [Enable and test](#step-6-enable-and-test-sso-with-okta) Okta SSO login.
* Set up [SAML authorization](#step-7-saml-authorization-with-okta) using Okta groups.

***

### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

Before you configure the Harness OIN app as the SAML identity provider for Harness, ensure you have the following:

* **Harness account access**: A Harness account with Account Admin permissions.
* **Okta account access**: An Okta account with admin access.
* **Provisioned Okta users**: Users already provisioned in Okta, with the same email addresses they use in Harness.

{% hint style="info" %}
If you use [Harness Self-Managed Enterprise Edition](/self-managed-enterprise-edition/new-to-self-managed-enterprise-edition/smp-overview.md), your instance must be accessed through an HTTPS load balancer, otherwise SAML authentication fails over HTTP.

* Users are not created as part of the SAML SSO integration. Okta user accounts must exist before you exchange information between your Okta account and Harness.
* Users are invited to Harness using their email addresses. After they log into Harness, their email addresses are registered as Harness users.
  {% endhint %}

***

### Set up your workspace <a href="#set-up-your-workspace" id="set-up-your-workspace"></a>

Prepare both applications before you configure SAML so you can copy values between them without losing your place. Use two browser windows or tabs for this process: open Okta in one tab and Harness in the other.

***

### Step 1: Set up user accounts in Okta and Harness <a href="#step-1-set-up-user-accounts-in-okta-and-harness" id="step-1-set-up-user-accounts-in-okta-and-harness"></a>

To set up SAML support in the Harness OIN app, ensure that the app has corresponding users in Harness:

1. In Harness, add the users you want to set up for SAML SSO by inviting them to Harness using the same email addresses that they use in Okta.
2. In Okta, assign them to the Harness app integration. You do this in [Step 4](#step-4-assign-users-and-groups-to-the-app), after the app is added.

{% hint style="info" %}

* The only user property that must match between a Harness user and its corresponding Okta user account is its **email address**.
* Sometimes users have mixed case email addresses in Okta. In these situations, Harness converts the email address to lowercase when adding them to Harness.
  {% endhint %}

***

### Step 2: Copy the SAML endpoint (ACS) URL from Harness <a href="#step-2-copy-the-saml-endpoint-acs-url-from-harness" id="step-2-copy-the-saml-endpoint-acs-url-from-harness"></a>

The Harness SAML endpoint URL is the only value you enter manually in the OIN app, so copy it first.

The **Add SAML Provider** panel starts collapsed. It shows only a name field and the provider tiles until you select a provider, and then it expands to show the SAML endpoint URL, the metadata upload control, and the authorization options.

1. In Harness, navigate to **Account Settings**, and then select **Authentication**.
2. Select **SAML Provider**, and then select **Add SAML Provider**. The **Add SAML Provider** panel opens with a **Name** field and the **Select a SAML Provider** tiles.
3. Enter a **Name** for the SAML configuration, and then under **Select a SAML Provider** select **Okta**. The panel expands to show the rest of the configuration.

   <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2FnWVfAQM3JFXEI02TdG5h%2Fharness-add-saml-provider-collapsed.png?alt=media&#x26;token=4b035d47-eadc-480e-89c5-7826830f7cc9" alt="The collapsed Harness Add SAML Provider panel showing the Name field and the provider tiles"><figcaption><p>Click to view full size image</p></figcaption></figure>
4. Copy the endpoint URL from **Enter this SAML Endpoint URL as your Harness application's ACS URL**. Use the copy icon at the end of the field.
5. Leave the **Add SAML Provider** panel open, and do not click **Add** yet. You return to this panel in [Step 5](#step-5-add-the-okta-saml-metadata-to-harness) to upload the Okta metadata and submit the configuration.

{% hint style="info" %}
**Select a SAML Provider** offers **Azure**, **Okta**, **OneLogin**, and **Other**. Once you select a tile, it shows a checkmark and a **Change** link, so you can switch providers without starting over. The **Add** button at the bottom of the panel submits the whole configuration, so leave it until last.
{% endhint %}

***

### Step 3: Add the Harness OIN app in Okta <a href="#step-3-add-the-harness-oin-app-in-okta" id="step-3-add-the-harness-oin-app-in-okta"></a>

Add the Harness integration from the Okta app catalog, give it a label, and enter the ACS URL you copied in [Step 2](#step-2-copy-the-saml-endpoint-acs-url-from-harness).

1. Sign in to your Okta administrator account, and select **Applications and Resources** > **Applications**.
2. Click **Browse App Catalog**. The **Browse App Integration Catalog** page opens.

   <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2FV1m5oHAcnR1enmEZ7O9N%2Fsingle-sign-on-saml-53.png?alt=media&#x26;token=40b85311-26b9-4d28-919b-61d43cc40d37" alt="The Applications page in the Okta Admin Console with the Browse App Catalog button"><figcaption><p>Click to view full size image</p></figcaption></figure>
3. In the catalog search field, enter `harness`, and then select **Harness** from the results. The integration is tagged **SAML** and **SCIM**.
4. Click **Add Integration**.

   <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2FH6v2TAAt8xFaqO7ZRpTi%2FScreenshot%202026-09-17%20at%208.04.01%E2%80%AFPM.png?alt=media&#x26;token=c9615b8f-de6f-42e5-bf1b-566bd7bd2356" alt="The Harness entry in the Okta app catalog with the Add Integration button and the SAML and SCIM tags"><figcaption><p>Click to view full size image</p></figcaption></figure>
5. On the **General Settings** tab, specify the following:
   * **Application label**: Enter a name for the app, for example `Harness`. This label displays under the app on the Okta dashboard.
   * **ACS URL**: Paste the Harness SAML endpoint URL you copied in [Step 2](#step-2-copy-the-saml-endpoint-acs-url-from-harness).
   * **Application Visibility**: Optionally select **Do not display application icon to users**.
6. Click **Done**. Okta creates the Harness app instance in your org and opens the app, where the **General**, **Sign On**, **Provisioning**, **Import**, **Assignments**, and **Push Groups** tabs are available.

<figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2FjB54EbrA576vfBjpUYKB%2Fokta-oin-advanced-sign-on-acs-url.png?alt=media&#x26;token=a9dc751f-d83c-484d-ad0c-4d1a7cf61715" alt="The Add Harness General Settings step in Okta showing the Application label, ACS URL, and Application Visibility fields"><figcaption><p>Click to view full size image</p></figcaption></figure>

{% hint style="info" %}
Because the Harness integration comes from the OIN, the SAML endpoints, **Audience URI (SP Entity ID)** (`app.harness.io`), **Name ID format** (`Unspecified`), and signing settings are pre-configured. The ACS URL is the only SAML value you enter.
{% endhint %}

{% hint style="info" %}
The Harness integration also supports SCIM provisioning, which you configure on the **Provisioning** tab of the app. SCIM provisioning is separate from SAML SSO and is not covered on this page.
{% endhint %}

***

### Step 4: Assign users and groups to the app <a href="#step-4-assign-users-and-groups-to-the-app" id="step-4-assign-users-and-groups-to-the-app"></a>

Only assigned users and groups can authenticate to Harness through the app.

1. In Okta, open the Harness app and select the **Assignments** tab.
2. Click **Assign**, and then select **Assign to People** or **Assign to Groups**.
3. Find the user or group that needs access to Harness, and then click **Assign**.
   * For a group, no further fields appear. The group is assigned as soon as you click **Assign**.
   * For a person, confirm the **Username**. It defaults to the user's Okta email address, which must match the email address of the corresponding Harness user. Click **Save and Go Back**.
4. Repeat for each user or group you want to assign. The **Assign** action changes to **Assigned** for each one.
5. Click **Done**.

<figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2FRtb9cu98JkdnH4pXPlhE%2Fokta-oin-assign-done.png?alt=media&#x26;token=02269573-00e1-4329-8d93-4b16ff6c3bf3" alt="The Assign Harness to People dialog in Okta with a user shown as Assigned"><figcaption><p>Click to view full size image</p></figcaption></figure>

{% hint style="info" %}
When you assign people, if the **Username** does not match the email address the user is registered with in Harness, SSO succeeds in Okta but the user is not matched to their Harness account.
{% endhint %}

***

### Step 5: Add the Okta SAML metadata to Harness <a href="#step-5-add-the-okta-saml-metadata-to-harness" id="step-5-add-the-okta-saml-metadata-to-harness"></a>

Download the **Identity Provider metadata** XML from the Harness app in Okta and upload it into the expanded **Add SAML Provider** panel to complete the trust exchange.

1. In the Harness app in Okta, navigate to the **Sign On** tab and locate the SAML signing certificate and metadata details.
2. Copy the Identity Provider metadata into a file, and save it with an `.xml` extension.
3. In Harness, on the **Add SAML Provider** panel, in **Upload the Identity Provider metadata XML downloaded from your app**, click **Choose a file** or **Upload**, and select the metadata file.

   <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fs2F9Noc6KFATNNS7DD0u%2Fharness-add-saml-provider-expanded.png?alt=media&#x26;token=cae60ed4-c0f7-44ce-8bf8-fc6d2919ef0f" alt="The Harness upload control for the identity provider metadata XML file"><figcaption><p>Click to view full size image</p></figcaption></figure>
4. Optionally, enter a **Logout URL**.
5. Leave **Enable Authorization** cleared. It is cleared by default, and selecting it reveals a **Group Attribute Name** field beneath the checkbox. Authorization depends on the group attribute statement and on a Harness user group linked to an Okta group, so you enable it in [Step 7](#step-7-saml-authorization-with-okta) once SSO is working.
6. The default entity ID is `app.harness.io`. To use a different one, select **Add Entity Id** and enter your custom entity ID.
7. To have Harness create a user account automatically the first time someone signs in through Okta, select **Enable JIT Provisioning**. For more information, go to [Just-in-time (JIT) provisioning](#just-in-time-jit-provisioning).
8. Click **Add** to save the SAML provider configuration.

{% hint style="info" %}
**Enable Authorization**, **Add Entity Id**, and **Enable JIT Provisioning** are grouped together in a box at the bottom of the panel, below **Logout URL**, and all three are cleared by default. If you have already configured the group attribute statement and linked a Harness user group, you can select **Enable Authorization** and enter the **Group Attribute Name** here instead of returning in [Step 7](#step-7-saml-authorization-with-okta). This page enables it later so that you confirm SSO works before authorization is in play.
{% endhint %}

{% hint style="info" %}
The **Add SAML Provider** panel also offers **Encryption Certificate for SAML assertions - Download**. Download this certificate if you want Okta to encrypt the SAML assertions it sends to Harness.
{% endhint %}

Your Okta configuration appears under **Login via SAML**.

<figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-3afefa9654b509b6eb240c206eac8f4e30c3a5a4%2Fadd-provider.png?alt=media" alt="The saved Okta configuration listed under Login via SAML in Harness authentication settings"><figcaption><p>Click to view full size image</p></figcaption></figure>

***

### Step 6: Enable and test SSO with Okta <a href="#step-6-enable-and-test-sso-with-okta" id="step-6-enable-and-test-sso-with-okta"></a>

Now that the Harness OIN app is set up in Harness as a SAML SSO provider, enable and test it.

1. In Harness, navigate to **Account Settings**, and then select **Authentication**.
2. Select **Login via SAML**.
3. On the **Enable SAML Provider** confirmation window, click **Test** to verify the connection. A new browser tab opens where you log in to Okta. If the connection test succeeds, Harness displays a **SAML test successful** banner.

   <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-4d95d51bbfb16effacfb1594cd073c6346376e52%2Fsingle-sign-on-saml-63.png?alt=media" alt="The Enable SAML Provider confirmation window with the Test button"><figcaption><p>Click to view full size image</p></figcaption></figure>
4. Click **Confirm** to enable Okta SAML SSO in Harness.

{% hint style="info" %}
Keep at least two accounts available while you set this up: a Harness Administrator account to configure and, if needed, roll back SSO, and an ordinary Harness user account to test with. That way a failed test never locks you out.
{% endhint %}

#### Test SSO configuration <a href="#test-sso-configuration" id="test-sso-configuration"></a>

To test the SSO configuration, log into Harness through a different user account. Do this in a separate private browsing (Incognito) window so you can disable SSO in your Harness Administrator account if there are any errors.

If you get locked out of Harness due to an SSO issue, you can log into Harness through [local login](/harness-ai/use-harness-platform/authentication/single-sign-on-saml/advanced-saml-configuration.md#harness-local-login).

1. In a private browsing window, navigate to Harness.
2. Log in using a Harness user account that has a corresponding email address registered in Okta. If successful, Harness redirects you to the Okta login page.
3. On the Okta login page, enter the email address associated with the Harness user account. The Harness account and Okta account can have different passwords. If successful, you are returned to Harness.

If you belong to multiple accounts, confirm the default account is set before attempting to use Harness Local Login.

***

### Step 7: SAML authorization with Okta <a href="#step-7-saml-authorization-with-okta" id="step-7-saml-authorization-with-okta"></a>

Once you have enabled Harness SSO with the Harness OIN app, set up and enable Okta SAML authorization in Harness.

To set up SAML authorization in Harness, link a Harness user group to an Okta user group. When an Okta user in that Okta user group logs in to Harness, Harness adds them automatically to the associated Harness user group, and the user inherits all permissions and access assigned to that group. For more information on permissions, go to [RBAC in Harness](/harness-platform/3.0/harness-platform-resources/platform-access-control/rbac-in-harness.md).

1. In Okta, create a user group and add users to the group, if you do not already have one.
   1. Sign in to Okta using an admin account.
   2. Under **Directory**, select **Groups**, and then click **Add Group**.

      <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-f0f75f4ba28e02682b1e368786a97444dbb01f75%2Fadd-group.png?alt=media" alt="The Groups page in the Okta Directory with the Add Group button"><figcaption><p>Click to view full size image</p></figcaption></figure>
   3. Enter a **Name** and group description. Click **Save**.

      <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-e1c81f7dde25914914f806fc9cd6c71c78cd1316%2Fsingle-sign-on-saml-65.png?alt=media" alt="The Okta Add Group dialog with the group name and description fields"><figcaption><p>Click to view full size image</p></figcaption></figure>
   4. Search for the group you created, and then select it.
   5. Click **Assign People**. Find and add members to your group. Click **Done**.

      <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-f9d61e9db7f507a6d0506d411736a1152bb17700%2Fsingle-sign-on-saml-66.png?alt=media" alt="The Assign People view used to add members to an Okta group"><figcaption><p>Click to view full size image</p></figcaption></figure>
2. Make a note of the Okta group name. You need it later to link the Okta group to a Harness user group.
3. Make sure the Okta user group is assigned to the Harness app.
   1. In Okta, under **Directory**, select **Groups**. Find and select your Okta user group.
   2. Click **Assign applications**. Find the Harness app and click **Assign**. Click **Done**.
   3. Under **Applications and Resources**, select **Applications**. Find and select the Harness app. On the **Assignments** tab, select **Groups**, and make sure your Okta user group is listed there.
4. In the Harness app, on the **Sign On** tab, click **Edit** in the **Settings** card, expand **Attributes (Optional)**, and confirm that the **Group Attribute Statements (optional)** **Filter** is set to `Matches regex` with the `.*` value. Make a note of the group attribute **Name**, for example `groups`. This is the **Group Attribute Name** you enter in Harness.
5. In Harness, navigate to **Account Settings**, and select **Authentication**.
6. Select the arrow to expand the **Login via SAML** section.

   <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-85683f6de8e64305910523f3b53959e5d1f05039%2Fsingle-sign-on-saml-73.png?alt=media" alt="The expanded Login via SAML section in Harness authentication settings"><figcaption><p>Click to view full size image</p></figcaption></figure>
7. Select **More options** (⋮) next to your Okta provider configuration, and then select **Edit**.

   <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-9a8da72acdd67de2dc9e22e61493a2c14d7117a9%2Fsingle-sign-on-saml-111.png?alt=media" alt="The More options menu for a Harness SAML provider with the Edit action"><figcaption><p>Click to view full size image</p></figcaption></figure>
8. On the **Edit SAML Provider** page, select **Enable Authorization**. A **Group Attribute Name** field appears beneath the checkbox.
9. Enter the **Group Attribute Name** you noted in step 4.

   <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-acf30e21df76aaf000ceff920ff807f87a95ed63%2Fsingle-sign-on-saml-74.png?alt=media" alt="The Group Attribute Name field on the Harness Edit SAML Provider page"><figcaption><p>Click to view full size image</p></figcaption></figure>
10. Click **Add**. Your Okta configuration now uses the Group Attribute Name for authorization.
11. Link your Okta user group to a corresponding Harness user group. You can create a user group or use an existing group if your Harness user account is a member and your user account is registered under the same email address as in Okta.
    1. In Harness, navigate to **Account Settings**, and select **Access Control**.
    2. Select **User Groups** in the header, and locate the user group that you want to connect to your Okta user group.
    3. Select **Link to SSO Provider Group**.

       <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-bf0e843b00e4b1ce09bc9ed5c96ec051682f76b5%2Fsingle-sign-on-saml-75.png?alt=media" alt="The Link to SSO Provider Group action on a Harness user group"><figcaption><p>Click to view full size image</p></figcaption></figure>
    4. In **Search SSO Settings**, select your Okta SAML SSO configuration. Enter the Okta **Group Name**, and click **Save**.

       <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-10358437e610b117d5fdcc076cf7e4281ef9311a%2Fsingle-sign-on-saml-76.png?alt=media" alt="The Link to SSO Provider Group dialog with the Okta SSO setting and group name entered"><figcaption><p>Click to view full size image</p></figcaption></figure>
    5. Repeat these steps if you need to connect more user groups.

{% hint style="info" %}
The **Group Attribute Name** is different from an **Okta Group Name**. Your company might have many groups set up in Okta, and the Group Attribute Name filters the groups that you want to authenticate to Harness.
{% endhint %}

#### Test SAML authorization <a href="#test-saml-authorization" id="test-saml-authorization"></a>

To test the SAML authorization configuration, log into Harness through a different user account.

1. Follow the steps mentioned in [test SSO configuration](#test-sso-configuration).
2. In your other browser window (where you are logged in to your admin account), make sure the user appears in the Harness user group. Navigate to **Account Settings**, select **Access Control**, select **User Groups** in the header, select the user group you linked to Okta, and make sure the user you just logged in with is listed as a member.

By being a member of this user group, the user receives the permissions and access granted to that group.

***

### OIN app field reference <a href="#oin-app-field-reference" id="oin-app-field-reference"></a>

The following table lists the values you set or see when you add the Harness app from the Okta catalog.

| Field                            | Value                                                      | Where you set it                                                                                                                                                   |
| -------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Application label**            | Any name, for example `Harness`                            | **General Settings** tab when you add the integration. Display name on the Okta dashboard.                                                                         |
| **Application Visibility**       | Optional                                                   | **General Settings** tab. Select to hide the app icon from end users.                                                                                              |
| **ACS URL**                      | The Harness SAML endpoint URL                              | **General Settings** tab when you add the integration ([Step 3](#step-3-add-the-harness-oin-app-in-okta)). Copied from the **Add SAML Provider** panel in Harness. |
| **Group Attribute Statements**   | For example `groups`, **Filter** `Matches regex` with `.*` | **Sign On** tab > **Edit** > **Attributes (Optional)**. The name you enter here is the **Group Attribute Name** in Harness.                                        |
| **Disable Force Authentication** | Selected by default                                        | **Sign On** tab > **Edit**, below the attribute statements. Clear it to make Okta prompt users to re-authenticate.                                                 |
| **Username**                     | The user's Okta email address                              | **Assignments** tab, per person when you use **Assign to People**. Must match the user's Harness email address. Group assignments have no such field.              |
| **Audience URI (SP Entity ID)**  | `app.harness.io`                                           | Pre-configured by the OIN integration. No action needed.                                                                                                           |
| **Name ID format**               | `Unspecified`                                              | Pre-configured by the OIN integration. No action needed.                                                                                                           |

***

### Just-in-time (JIT) provisioning <a href="#just-in-time-jit-provisioning" id="just-in-time-jit-provisioning"></a>

Harness supports SAML configuration [with or without JIT user provisioning](/harness-ai/use-harness-platform/authentication/single-sign-on-saml.md#just-in-time-jit-provisioning). To turn it on, select **Enable JIT Provisioning** on the **Add SAML Provider** panel in [Step 5](#step-5-add-the-okta-saml-metadata-to-harness). For more information on how Harness creates users on first SAML login when JIT is enabled, go to [Just-in-Time (JIT) user provisioning](/harness-platform/3.0/harness-platform-resources/platform-access-control/provision-use-jit.md).

***

### Delink groups <a href="#delink-groups" id="delink-groups"></a>

If you no longer want a Harness user group to be connected with an Okta user group, delink the groups without losing group members.

Delinking groups is required to remove a SAML SSO provider configuration from Harness. You cannot delete the SAML SSO provider from Harness until you have delinked all associated Harness user groups.

1. In Harness, navigate to **Account Settings**, and select **Access Control**.
2. Select **User Groups** in the header, and locate the user group that you want to delink.
3. Select **Delink Group**.

   <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-f588be47c5c91b1d702cd65d6472c5ad9ac7a52d%2Fsingle-sign-on-saml-77.png?alt=media" alt="The Delink Group action on a Harness user group linked to an Okta group"><figcaption><p>Click to view full size image</p></figcaption></figure>
4. On the **Delink Group** window, select **Retain all members in the user group** to keep the users (as local Harness user accounts) in the Harness user group. If unselected, the groups are delinked and the group members who were authenticated through Okta are removed from the Harness user group.

   <figure><img src="https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-219057ac738a2dcb84708b726a9b05cd459cebb8%2Fsingle-sign-on-saml-78.png?alt=media" alt="The Delink Group window with the option to retain all members in the user group"><figcaption><p>Click to view full size image</p></figcaption></figure>
5. Click **Save**.

***

### Troubleshooting <a href="#troubleshooting" id="troubleshooting"></a>

<details>

<summary>SAML assertion validation failed when signing in to Harness with Okta</summary>

Ensure the SAML endpoint URL from Harness is entered in the ACS URL field of the Harness OIN app in Okta. You set the ACS URL on the General Settings tab when you add the integration. Verify the Audience URI (SP Entity ID) is app.harness.io. Confirm users or groups are assigned to the Harness app on the Assignments tab.

</details>

<details>

<summary>The user signs in to Okta but is not recognized as a Harness user</summary>

On the Assignments tab of the Harness app, check the Username set for that user. It must match the email address the user is registered with in Harness. Harness converts mixed case email addresses to lowercase when adding users.

</details>

<details>

<summary>Users sign in but are not added to their Harness user groups</summary>

On the Sign On tab of the Harness app, click Edit and expand Attributes (Optional). The Group Attribute Statements section is collapsed by default and is easy to miss, so confirm a group attribute statement exists, that its Filter is set to Matches regex rather than the default Starts with, and that the name matches the Group Attribute Name entered in Harness. Then confirm Enable Authorization is selected on the Edit SAML Provider page in Harness, because it is cleared by default, and that the Group Attribute Name field beneath it is filled in.

</details>

***

### Related articles <a href="#related-articles" id="related-articles"></a>

For related SAML provider setups, go to the following topics:

* [Okta (custom SAML app)](/harness-ai/use-harness-platform/authentication/single-sign-on-saml/okta.md): Create a SAML 2.0 app integration in Okta manually instead of using the OIN app.
* [SAML SSO with Microsoft Entra ID](/harness-ai/use-harness-platform/authentication/single-sign-on-saml/microsoft-entra-id.md): Configure Microsoft Entra ID as a SAML SSO provider in Harness.
* [SAML SSO with OneLogin](/harness-ai/use-harness-platform/authentication/single-sign-on-saml/onelogin.md): Configure OneLogin as a SAML SSO provider in Harness.
* [SAML SSO with Keycloak](/harness-ai/use-harness-platform/authentication/single-sign-on-saml/keycloak.md): Configure Harness to use Keycloak SAML client as an SSO provider.
* [Advanced SAML configuration](/harness-ai/use-harness-platform/authentication/single-sign-on-saml/advanced-saml-configuration.md): Configure advanced SAML options in Harness.

{% @harness-feedback/feedback module="harness-ai" pagePath="harness-ai/use-harness-platform/authentication/single-sign-on-saml/okta-oin-app" %}