Skip to main content
Harness is a software delivery platform for CI/CD. Connect your Harness account to Oleria to see every user and pending invitation, the user groups and role assignments that grant access at account, organization, and project scope, and the service accounts and tokens that can act on the account. Oleria connects with a Harness service account token. Oleria reads access to the account, its organizations, and its projects, and inventories the pipelines, connectors, and secrets under each of them.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Harness account:
  • Accounts - every user, with two-factor authentication status, sign-in methods (password, SSO, and allowed OAuth providers), SSO enforcement, administrator status, and whether the user is locked, disabled, or provisioned by SCIM. Pending invitations at any scope appear as disabled accounts, with the roles and user groups they would grant. An invitation shows a name only when Harness has one. Changes that Harness itself makes appear under a Harness System account.
  • Non-human identities - service accounts at account, organization, and project scope, service account tokens, and personal access tokens. Each token is paired with a credential that shows its status (active, expired, disabled, or revoked), creation date, expiry, and last rotation. Service account tokens are linked to their service account, and personal access tokens to the user who owns them. Where the audit trail records it, Oleria shows who created each service account and token.
  • Credentials - delegate tokens at every scope, the secrets Harness delegates register with, with their status and expiry.
  • Groups - user groups at account, organization, and project scope, and their members. Each group is marked as built-in, custom, or synced from SSO or SCIM.
  • Roles - every role assignment, as one role per combination of role, resource group, and scope, with the users, service accounts, and user groups that hold it. Custom roles are marked as custom.
  • Resources - the account, its organizations, and its projects, and who can reach each one through which role. When a resource group includes child scopes, the access extends to the organizations and projects below. Account, organization, and project administrators are shown as owners of their scope. Pipelines, connectors, and secrets appear under their project, organization, or account, with the roles that grant access to each kind of resource and the role assignments that reach each one. Oleria reads secret names only, never their values.
  • Activity - events from the Harness audit trail, including sign-ins and failed sign-ins, invitations and user removals, role assignment and group membership changes, token and secret changes, settings changes, and pipeline events, with the client IP address. Each event reads as a sentence and links to the pipeline, connector, secret, project, organization, or account it affected.
Oleria refreshes this data on its regular sync schedule.

​
Prerequisites

  • Permission in Harness to create a service account and assign it a role at account scope, such as the Account Admin role.
  • Your Harness account ID.
  • Admin access to the Oleria workspace.
Each Oleria integration covers one Harness account. If you have several accounts, add one integration for each.

​
Set up a service account in Harness

1

Create a service account

In Harness, go to Account Settings -> Access Control -> Service Accounts and create a service account for Oleria.
2

Assign a role

Assign the service account the Account Admin role on All Resources Including Child Scopes.On the Harness Enterprise plan, you can use a custom role instead, assigned on All Resources Including Child Scopes. Give it the Account Viewer permissions plus core_serviceaccount_manageapikey, and the write permissions below if you want remediation actions. Other Harness plans can’t create custom roles, so use Account Admin.
3

Create a token

On the service account, add an API key, then generate a token on it. Copy the token before you leave the page. It starts with sat..
4

Copy your account ID

Go to Account Settings -> Account Details and copy the Account ID. It’s also the part of your Harness URL after /account/.
Read permissions, for discovery: When you select Authenticate, Oleria checks every required permission and refuses the token if any are missing, naming them. If the service account lacks an optional permission, Oleria skips that data and syncs the rest. Write permissions, only if you want Oleria to take remediation actions:
The form also accepts a personal access token (pat.), but it acts as the user who owns it and stops working if that user leaves. Use a service account token so the connection doesn’t depend on a person.

​
Connect Harness to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations, then select the Harness tile.
2

Complete the connection form

3

Authenticate

Select Authenticate. Oleria checks that the token can read the account and holds the required permissions above, then saves the integration.
To connect a self-managed Harness installation, first contact Oleria support to allow its domain. The host must be reachable from the public internet over HTTPS.

​
Verify the integration

Confirm Harness appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered users, groups, roles, and tokens in your Oleria workspace. The integration’s Capabilities tab shows Read users, Read groups, and Read roles with the Harness permissions each one needs, and checks them against your token.
If you rotate the token in Harness, update it in Oleria by editing the integration. Editing the integration always asks for the token, so enter the current one if you don’t rotate it. Leave Harness base URL blank to keep the stored URL. You can’t change the account ID, and the token must belong to that account.

​
Remediation actions

Beyond discovery, Oleria can act on Harness access to remediate risk. Remediation needs the write permissions described above. Oleria checks the permissions with Harness before an action runs and reports any that are missing. Disable NHI supports service account tokens only:
  • Service accounts - not supported. Harness can’t disable a service account, only delete it with all its tokens. Revoke its tokens instead.
  • Personal access tokens - not supported. Their owners manage them in Harness, and the API offers no admin revoke.
  • Delegate tokens - not available as an action.
Oleria never revokes a token of the service account the connection uses, or the connection’s own role assignments. If you connect with a personal access token, Oleria won’t remove its owner from the account, a user group, or a role.

​
Known limitations

  • Dates come from the audit trail. Harness doesn’t expose when a user was created or last signed in. Oleria takes the last sign-in from the audit trail’s full retention, up to 2 years, and the date a user joined from the past 365 days. Users without an event in those windows show no date. This also needs core_audit_view.
  • No token last-used time. Harness doesn’t report when a token was last used.
  • No password change date. Harness doesn’t expose when a user last changed their password.
  • Public access isn’t modeled. Harness public access is a per-pipeline UI setting with no API. Oleria records whether public access is enabled on the account.
  • Role actions apply to users. Revoke resource permission also works on service accounts. To change a user group’s role assignments, use Harness.
  • Pending invitations can’t be changed. Oleria shows pending invitations as disabled accounts, but user actions on them fail. Withdraw an invitation in Harness.
  • Names may be email addresses. Harness keeps the invitation email as a user’s name until the user sets one, and Oleria shows the name Harness stores.
  • One account per integration. Add one integration for each Harness account.

​
Existing SCIM connections

If you connected Harness earlier with the SCIM setup, Oleria moves that connection to the Harness API, so you don’t need to add a new integration. A Harness SCIM token is a Harness API key, so Oleria now uses it with the Harness API and reads everything described on this page. Users and account-level user groups keep the IDs they had under SCIM. The SCIM setup only needed permission to manage users and user groups. Give the token’s service account the role described in Set up a service account in Harness so Oleria can collect roles, organizations, projects, API tokens, and audit activity. Until you do, syncs can fail or leave that data out. You can also edit the integration and enter a new service account token. To edit a SCIM connection, open the integration. Enter your Harness Account ID (the ID after /ng/api/scim/account/ in your SCIM URL) and a service account token in Service account token. Leave Harness base URL blank to keep the host from your SCIM URL, then select Update. After the update, the connection uses the fields described on this page. What changes for remediation:
  • Disable user account now removes the user from the Harness account. Reverting it adds the user back, and Harness may send an invitation they have to accept.
  • Enable user account now invites the user’s email back to the account.
  • Create user now invites the email to the account, and Create group creates an account user group.
  • Role assignment changes and service account token revocation are new.

​
Contact us

For questions about this integration, contact us at support@oleria.com.