Advanced SAML configuration
This document explains advanced SAML configuration.
Once SAML SSO is in place, additional configuration may be required to meet security requirements. For example, an identity provider (IdP) outage can lock users out of Harness, unencrypted SAML assertions may not adhere to your organization's compliance policies, and teams with different workflows may need to land on different parts of the product after login.
This page covers advanced SAML configuration options in Harness, including local login fallback, encrypted SAML assertions, and setting the default UI experience for your users.
What you will learn in this topic
By the end of this topic, you will be able to:
Use Harness local login as a fallback when your IdP is unavailable.
Enable encrypted SAML assertions to meet compliance requirements for assertions in transit.
Rotate your IdP signing certificate without a login gap.
Configure the default landing page so teams land on relevant product after login.
Before you begin
Before you begin, ensure you have:
A Harness account with Account Admin permissions to modify authentication settings.
An active SAML SSO provider already configured in Harness (such as Okta, Microsoft Entra ID).
Harness Local Login
Use encrypted SAML
To use encrypted SAML with Harness, you download the encryption certificate from the Harness UI and upload it to your identity provider (IdP) settings to support the encrypted SAML flow.
To download your encryption certificate and upload it to your IdP settings, do the following:
In your Harness account, go to Account Settings, and then select Authentication.
Assuming you have a SAML provider set up, select your provider. Under Enable Authorization, click the Download button.
This downloads the Harness encryption certificate required for SAML assertions. 3. Sign in to your IdP (identity providers, such as Okta, Microsoft Entra ID). 4. To edit your SAML integration in the IdP:
Enable assertion encryption.
Select your encryption algorithm.
Upload the encrypted certificate file you downloaded from the Harness UI in step 2 above.
When you sign in to Harness via SAML, the operation is completed using encrypted assertions.
Rotate your IdP signing certificate
Harness reads your IdP's signing certificate from the metadata XML file you upload when you set up your SAML provider. When your IdP rotates its signing certificate, re-upload the current metadata XML to Harness to pick up the new certificate.
To avoid a login gap during rotation, Harness supports uploading metadata that lists more than one signing certificate: it validates a SAML response against any signing certificate present in the metadata. If your IdP's metadata carries both the current and next certificate during an overlap window, you can upload that metadata to Harness ahead of the cutover so logins keep working through the rotation.
Set the default experience
When you log in through SAML, Harness redirects you to a default landing page. If your organization has teams that work in different modules (for example, developers in CI and operations in CD), account administrators or environment administrators (that is, users who have all the permissions required to work with environments) can set the default landing experience so each user lands on the relevant part of the product after login.
The following diagram shows the permissions required for environment administrator access.
To set the default landing page, follow the steps below:
In your Harness account, go to Account Settings and select Account Details.
Under Default Experience, select the experience you want users to see when they log in (First generation or next generation).
Click Save. For more information on account-level settings, go to Account details.
Related articles
Single sign-on with LDAP - Set up LDAP server with Harness.
Single sign-on with OAuth - Set up OAuth 2.0 identity provider with Harness.
Single sign-on with OIDC - Set up custom OIDC (OpenID Connect) provider with Harness.
Last updated
Was this helpful?