In this article, you will learn to set up various authentication methods for Harvestr, including SAML-based Identity Providers (Google Workspace, Microsoft Azure, Okta, etc.), as well as standard Google and Microsoft SSO. Additionally, you’ll find instructions for managing and turning authentication methods on or off to suit your workspace needs.
Prerequisites
All you need is the following:
a Harvestr subscription (Elite for SAML SSO only)
an Editor account
access to your Identify Provider configuration
Managing Authentication Methods
Harvestr provides flexibility in choosing the authentication methods that best suit your team’s needs. You can enable, disable, or prioritize methods as follows:
Access the Organization Settings section in Harvestr.
View the list of available authentication methods: Email/Password, Google SSO, Microsoft SSO, SAML SSO.
Use the toggle next to each method to turn it on or off (see below for SAML SSO)
Authorizing Multiple Domains for Google and Microsoft SSO
By default, when using standard Google and Microsoft logins, only the domain of the email address used to create your Harvestr workspace is authorized for SSO. To enable access for additional domains, contact our support team.
Setting up SSO with Okta, Google, Azure AD
Here are articles explaining how to set up SAML for specific Identity Providers:
General SAML SSO setup (for any IdP)
To configure SAML-based SSO for Harvestr with any other Identity Provider:
In your IdP admin console, create a new SAML 2.0 application (often “Custom SAML” or “SAML 2.0 Connector”).
In your SAML app settings, set the SP (Service Provider) parameters as per Harvestr’s SAML-SSO settings — including ACS URL (Assertion Consumer Service URL) and SP Entity ID.
Define the NameID (typically user email) to match what Harvestr expects.
Export the IdP metadata (XML) or copy the metadata URL, then upload it into Harvestr’s SSO configuration.
Assign the SAML app to user groups or users in your IdP so only authorized users can log in.
Once complete, your users will be able to authenticate into Harvestr using your corporate identity provider.
About the HTTP-Redirect binding
Harvestr sends its SAML AuthnRequest using the HTTP-Redirect binding. Your Identity Provider must therefore expose a SingleSignOnService endpoint that supports this binding in its metadata.
When you export your IdP metadata, make sure it contains an entry similar to:
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://your-idp.com/sso/redirect-endpoint" />
If this line is not present, you may need to enable or declare the Redirect binding in your IdP’s SAML application settings. After updating the configuration, re-export the metadata and upload it to Harvestr so the SSO flow completes successfully.
If you need help with the setup, please contact our support team.