> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/3.0/harness-platform-resources/authentication/single-sign-on-saml.md).

# Single sign-on with SAML

Harness supports Single Sign-On (SSO) with SAML by integrating with your SAML SSO provider to enable you to log your users into Harness as part of your SSO infrastructure. This section explains how to set up SAML authentication.

{% hint style="info" %}
**NOTE**

If you use [Harness Self-Managed Enterprise Edition](/self-managed-enterprise-edition/new-to-self-managed-enterprise-edition/smp-overview.md), your instance must be accessed via an HTTPS load balancer. SAML authentication will fail over HTTP.
{% endhint %}

***

### What you will learn in this topic <a href="#what-you-will-learn-in-this-topic" id="what-you-will-learn-in-this-topic"></a>

By the end of this topic, you will be able to understand:

* How Harness supports SAML-based single sign-on and how to enable it as the default authentication method.
* XML SAML file format requirements used with Harness.
* How to use the System for Cross-domain Identity Management (SCIM) protocol with Harness to keep user group memberships continuously up to date.
* Key integration components required to integrate SAML SSO.

***

### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

Before you begin working with SAML-based single sign-on (SSO) in Harness, ensure you have the following:

* **A Harness account with admin permissions:** Required to manage Authentication Settings. Go to [Authentication overview](/harness-ai/use-harness-platform/authentication.md) for details.
* **A SAML identity provider (IdP):** Such as Okta, Microsoft Entra ID, OneLogin, or Keycloak, with admin access to configure a new application integration.
* **Matching user accounts:** Users must exist in both Harness and the SAML provider with the same email address before SSO can be enabled.
* **At least two user accounts for testing:** One Harness Administrator account to configure SSO and one regular user account to test the login flow.

***

### Supported formats <a href="#supported-formats" id="supported-formats"></a>

The XML SAML file used with Harness must use UTF-8.

UTF-8 BOM is not supported. Some text editors like Notepad++ save in UTF-8 BOM by default.

{% hint style="info" %}
**NOTE**

When integrating users through any SAML provider, users added to an external SAML provider are not automatically synchronized with Harness user groups. Synchronization occurs upon the first login by the user belonging to a specific provider's user group into Harness. Only at this point will the newly added user, having logged in through SAML, inherit all permissions and access rights associated with the Harness group linked to the SAML-provider's user group.
{% endhint %}

***

### Use System for Cross-domain Identity Management (SCIM) protocol <a href="#use-system-for-cross-domain-identity-management-scim-protocol" id="use-system-for-cross-domain-identity-management-scim-protocol"></a>

To ensure continuous and real-time synchronization of user group bindings and access controls, Harness recommends that you utilize the System for Cross-domain Identity Management (SCIM) protocol. SCIM enables real-time syncing of user additions with Harness user groups, ensuring that user permissions and access rights are consistently applied and maintained.

For implementation details on provisioning users with SCIM, go to [Okta SCIM](/harness-ai/use-harness-platform/platform-access-control/provision-users-with-okta-scim.md), [Microsoft Entra SCIM](/harness-ai/use-harness-platform/platform-access-control/provision-users-and-groups-using-azure-ad-scim.md), or [OneLogin SCIM](/harness-ai/use-harness-platform/platform-access-control/provision-users-and-groups-with-one-login-scim.md) based on your SAML provider.

#### SCIM API integration settings <a href="#scim-api-integration-settings" id="scim-api-integration-settings"></a>

If you provision users and groups via SCIM API, use the following settings for your SAML integration.

* **SCIM connector base URL:** `https://app.harness.io/gateway/ng/api/scim/account/[YOUR_ACCOUNT_ID]`. enter the appropriate URL for your cluster:
* **Unique identifier:** `userName`
* **Authentication Mode:** HTTP Header
* **Authorization:** `<YOUR_SERVICE_ACCOUNT_TOKEN>`

You must also do the following:

* Enable provisioning to Harness.
* Assign your user groups.
* Push your groups to Harness.

***

### SAML SSO with Harness <a href="#saml-sso-with-harness" id="saml-sso-with-harness"></a>

To set up SAML SSO with Harness, you add a SAML SSO provider to your Harness account and enable it as the default authentication method.

The following elements are required to successfully connect Harness to your SAML provider:

* **Harness User email addresses:** Users are invited to Harness using their email addresses. Once they log into Harness, their email addresses are registered with Harness as Harness Users. To use SAML SSO, Harness Users must use the same email addresses to register in Harness and the SAML provider.

{% hint style="info" %}
**NOTE**

Ensure that you have at least two corresponding user accounts when setting up and testing SAML SSO in Harness. This allows you to set up the account with a Harness Administrator account and test it with a Harness user account.
{% endhint %}

* **SAML provider user email addresses:** To use the SAML provider to verify Harness Users, the email addresses used in the SAML provider must match the email addresses for the registered Harness Users you want to verify.
* **Harness SAML Endpoint URL:** This URL is where the SAML provider will post the SAML authentication response to your Harness account. This URL is provided by Harness in the **Single Sign-On (SSO) Provider** dialog. You enter this URL in your SAML SSO provider app to integrate it with Harness.
* **SAML metadata file:** This file is provided by your SAML provider app. You upload this file into the Harness **Single Sign-On (SSO) Provider** dialog to integrate the app with Harness.

***

### Just-In-Time (JIT) provisioning <a href="#just-in-time-jit-provisioning" id="just-in-time-jit-provisioning"></a>

Harness supports SAML configuration with or without JIT user provisioning. JIT provisioning automatically creates user accounts in Harness on first successful SAML login, eliminating the need to manually invite users before they can log in.

Go to [Just-In-Time (JIT) provisioning](/harness-platform/3.0/harness-platform-resources/platform-access-control/provision-use-jit.md) to understand how Harness creates users on first SAML login when JIT is enabled.

**Without JIT**, follow the steps below to add new users:

1. In Harness, add the users you want to set up for SAML SSO by inviting them to Harness using the same email addresses that they use in your SAML provider.
2. In the SAML provider (such as Okta, Microsoft Entra ID, OneLogin, and so on), add the users and make sure they are in scope for the client you create in the configuration steps below.

**With JIT**, when you add users to different SAML providers (such as Okta, Microsoft Entra ID, OneLogin, and so on), they are automatically added to Harness on first successful SAML login.

***

### Next steps <a href="#next-steps" id="next-steps"></a>

* [SAML SSO with Microsoft Entra ID](https://github.com/harness/harness-developer-hub/tree/main/docs/platform/authentication/single-sign-on-saml/ms-entra-id/README.md) - Configure Microsoft Entra ID as a SAML SSO provider in Harness.
* [SAML SSO with Okta](/harness-ai/use-harness-platform/authentication/single-sign-on-saml/okta.md) - Create an SAML integration in Okta for Harness.
* [SAML SSO with Keycloak](/harness-ai/use-harness-platform/authentication/single-sign-on-saml/keycloak.md) - Configure Harness to use Keycloak SAML client as an SSO provider.
* [SAML SSO with OneLogin](https://github.com/harness/harness-developer-hub/tree/main/docs/platform/authentication/single-sign-on-saml/saml-sso-with-onelogin/README.md) - Configure OneLogin as a SAML SSO provider in Harness.