Bring Your Own Identity Provider to Harness MCP | Harness Blog

Harness has introduced OAuth proxy mode for self-hosted Model Context Protocol (MCP) servers, allowing enterprises to authenticate developers and AI coding agents through their own identity providers while avoiding long-lived personal access tokens or shared service credentials. The approach addresses challenges faced by regulated organizations whose internal MCP registries trust only company-managed identity systems, while Harness APIs require HarnessID authentication. During sign-in, the MCP server brokers authentication between the enterprise identity provider and HarnessID, securely storing each user’s encrypted HarnessID tokens server-side; developer tools retain only enterprise-issued and broker-issued tokens. For subsequent requests, the server validates the company token, refreshes Harness credentials as needed, and calls Harness under the individual user’s identity, enabling user-specific RBAC enforcement and audit records. The system includes PKCE, restricted redirects, strict identity linking, AES-256-GCM encrypted token storage, and Redis-based shared storage for multi-pod deployments, with access revocation taking effect through either the enterprise identity provider or Harness.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.