OneLogin

Harmony supports OneLogin as a SAML 2.0 identity provider (IdP) for single sign-on (SSO). This integration lets your team authenticate into their Harmony workspace using their existing OneLogin credentials, giving you centralized access control and a consistent login experience across your organization.

This article walks you through connecting OneLogin to Harmony as your SAML IdP.

---

Prerequisites

Before you begin, make sure you have:

• Administrator access to your OneLogin account
• Administrator access to your Harmony workspace
• SAML-based SSO enabled for your Harmony tenant

---

Step 1: Create a SAML Application in OneLogin

1. Sign in to your OneLogin Admin portal.
2. Navigate to Applications and click Add App.
3. Search for SAML Custom Connector (Advanced) and select it.
4. Give the application a recognizable name, such as Harmony SSO, then click Save.

---

Step 2: Configure the SAML Application Settings

With the new application open, go to the Configuration tab and fill in the following fields:

• Audience (EntityID) - Enter the Entity ID provided in your Harmony SSO settings.
• Recipient - Enter the Assertion Consumer Service (ACS) URL from your Harmony SSO settings.
• ACS (Consumer) URL Validator - Enter a regex or exact match for the ACS URL.
• ACS (Consumer) URL - Enter the same ACS URL used for the Recipient field.

Under the Parameters tab, map the following attributes so that Harmony can read user information correctly:

OneLogin Field	SAML Attribute Name
Email	email
First Name	firstName
Last Name	lastName

Click Save when you are done.

---

Step 3: Retrieve the OneLogin IdP Metadata

1. In your OneLogin application, open the SSO tab.
2. Copy the SAML 2.0 Endpoint (HTTP) - this is your IdP SSO URL.
3. Click View Details next to the X.509 certificate and copy the certificate content.
4. Alternatively, click More Actions and select SAML Metadata to download the full metadata XML file.

You will need either the metadata XML or the individual values (SSO URL, certificate) in the next step.

---

Step 4: Configure OneLogin as Your IdP in Harmony

1. Sign in to your Harmony workspace as an administrator.
2. Navigate to Settings and open the SSO / Identity Provider section.
3. Select OneLogin as your identity provider.
4. Provide the IdP details:

   • Upload the metadata XML file downloaded from OneLogin, or
   • Manually enter the IdP SSO URL and paste the X.509 Certificate.
5. Save your configuration.

---

Step 5: Assign Users in OneLogin

1. In your OneLogin Admin portal, open the Harmony SSO application.
2. Go to the Users tab and assign the users or groups who should have access.
3. Assigned users will now be able to sign in to Harmony using their OneLogin credentials.

---

Testing the Integration

After completing the setup, test the connection by signing out of Harmony and using the SSO login flow. You should be redirected to OneLogin for authentication and then returned to your Harmony workspace upon successful login.

If authentication fails, double-check the following:

• The ACS URL and Entity ID in OneLogin match exactly what Harmony provides.
• The X.509 certificate has been copied in full, without extra whitespace.
• Users are assigned to the application in OneLogin.

---

Troubleshooting

Users are not redirected to OneLogin during login. Confirm that SSO is fully enabled for your tenant and that OneLogin has been selected as the active identity provider in Harmony's SSO settings.

Authentication fails with an attribute error. Check that the SAML attribute names configured in OneLogin's Parameters tab match what Harmony expects, particularly the email attribute.

The identity provider is not recognized. Ensure you are using the correct metadata or IdP values from OneLogin. Harmony fully supports OneLogin as a recognized SAML identity provider - if recognition issues persist, contact Harmony support.