> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/integrations/identity-provider/onelogin.md).

# OneLogin

Harmony supports OneLogin as a SAML 2.0 identity provider (IdP) for single sign-on (SSO). This integration lets your team authenticate into their Harmony workspace using their existing OneLogin credentials, giving you centralized access control and a consistent login experience across your organization.

This article walks you through connecting OneLogin to Harmony as your SAML IdP.

***

### Prerequisites

Before you begin, make sure you have:

* Administrator access to your OneLogin account
* Administrator access to your Harmony workspace
* SAML-based SSO enabled for your Harmony tenant

***

### Step 1: Create a SAML Application in OneLogin

1. Sign in to your OneLogin Admin portal.
2. Navigate to **Applications** and click **Add App**.
3. Search for **SAML Custom Connector (Advanced)** and select it.
4. Give the application a recognizable name, such as **Harmony SSO**, then click **Save**.

***

### Step 2: Configure the SAML Application Settings

With the new application open, go to the **Configuration** tab and fill in the following fields:

* **Audience (EntityID)** - Enter the Entity ID provided in your Harmony SSO settings.
* **Recipient** - Enter the Assertion Consumer Service (ACS) URL from your Harmony SSO settings.
* **ACS (Consumer) URL Validator** - Enter a regex or exact match for the ACS URL.
* **ACS (Consumer) URL** - Enter the same ACS URL used for the Recipient field.

Under the **Parameters** tab, map the following attributes so that Harmony can read user information correctly:

| OneLogin Field | SAML Attribute Name |
| -------------- | ------------------- |
| Email          | `email`             |
| First Name     | `firstName`         |
| Last Name      | `lastName`          |

Click **Save** when you are done.

***

### Step 3: Retrieve the OneLogin IdP Metadata

1. In your OneLogin application, open the **SSO** tab.
2. Copy the **SAML 2.0 Endpoint (HTTP)** - this is your IdP SSO URL.
3. Click **View Details** next to the X.509 certificate and copy the certificate content.
4. Alternatively, click **More Actions** and select **SAML Metadata** to download the full metadata XML file.

You will need either the metadata XML or the individual values (SSO URL, certificate) in the next step.

***

### Step 4: Configure OneLogin as Your IdP in Harmony

1. Sign in to your Harmony workspace as an administrator.
2. Navigate to **Settings** and open the **SSO / Identity Provider** section.
3. Select **OneLogin** as your identity provider.
4. Provide the IdP details:
   * Upload the metadata XML file downloaded from OneLogin, **or**
   * Manually enter the **IdP SSO URL** and paste the **X.509 Certificate**.
5. Save your configuration.

***

### Step 5: Assign Users in OneLogin

1. In your OneLogin Admin portal, open the Harmony SSO application.
2. Go to the **Users** tab and assign the users or groups who should have access.
3. Assigned users will now be able to sign in to Harmony using their OneLogin credentials.

***

### Testing the Integration

After completing the setup, test the connection by signing out of Harmony and using the SSO login flow. You should be redirected to OneLogin for authentication and then returned to your Harmony workspace upon successful login.

If authentication fails, double-check the following:

* The ACS URL and Entity ID in OneLogin match exactly what Harmony provides.
* The X.509 certificate has been copied in full, without extra whitespace.
* Users are assigned to the application in OneLogin.

***

### Troubleshooting

**Users are not redirected to OneLogin during login.** Confirm that SSO is fully enabled for your tenant and that OneLogin has been selected as the active identity provider in Harmony's SSO settings.

**Authentication fails with an attribute error.** Check that the SAML attribute names configured in OneLogin's Parameters tab match what Harmony expects, particularly the email attribute.

**The identity provider is not recognized.** Ensure you are using the correct metadata or IdP values from OneLogin. Harmony fully supports OneLogin as a recognized SAML identity provider - if recognition issues persist, contact Harmony support.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.harmony.io/integrations/identity-provider/onelogin.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.