You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/admin/identity-and-access-management/configuring-authentication-for-enterprise-managed-users/configuring-saml-single-sign-on-for-enterprise-managed-users.md
+106-38
Original file line number
Diff line number
Diff line change
@@ -18,61 +18,56 @@ topics:
18
18
- SSO
19
19
---
20
20
21
-
## About SAML single sign-on for {% data variables.product.prodname_emus %}
21
+
## About SAML SSO for {% data variables.product.prodname_emus %}
22
22
23
-
With {% data variables.product.prodname_emus %}, your enterprise uses your corporate identity provider to authenticate all members. Instead of signing in to {% data variables.product.prodname_dotcom %} with a {% data variables.product.prodname_dotcom %} username and password, members of your enterprise will sign in through your IdP.
23
+
With {% data variables.product.prodname_emus %}, access to your enterprise's resources on {% data variables.location.product_location %} must be authenticated through your identity provider (IdP). Instead of signing in to {% data variables.product.prodname_dotcom %} with a {% data variables.product.prodname_dotcom %} username and password, members of your enterprise will sign in through your IdP.
24
24
25
-
{% data variables.product.prodname_emus %} supports the following IdPs:
26
-
27
-
{% data reusables.enterprise-accounts.emu-supported-idps %}
28
-
29
-
After you configure SAML SSO, we recommend storing your recovery codes so you can recover access to your enterprise in the event that your identity provider is unavailable.
25
+
After you configure SAML SSO, we recommend storing your recovery codes so you can recover access to your enterprise in the event that your IdP is unavailable.
30
26
31
27
{% data reusables.enterprise_user_management.SAML-to-OIDC-migration-for-EMU %}
32
28
33
-
{% note %}
34
-
35
-
**Note:** When SAML SSO is enabled, the only setting you can update on {% data variables.product.prodname_dotcom %} for your existing SAML configuration is the SAML certificate. If you need to update the Sign on URL or Issuer, you must first disable SAML SSO and then reconfigure SAML SSO with the new settings.
36
-
37
-
{% endnote %}
38
-
39
-
## Configuring SAML single sign-on for {% data variables.product.prodname_emus %}
29
+
## Prerequisites
40
30
41
-
To configure SAML SSO for your {% data variables.enterprise.prodname_emu_enterprise %}, you must configure an application on your IdP and then configure your enterprise on GitHub.com. After you configure SAML SSO, you can configure userprovisioning.
31
+
- Ensure that you understand the integration requirements and level of support for your IdP. For more information, see "[AUTOTITLE](/admin/identity-and-access-management/understanding-iam-for-enterprises/about-enterprise-managed-users#about-authentication-and-user-provisioning)."
42
32
43
-
To install and configure the {% data variables.product.prodname_emu_idp_application %} application on your IdP, you must have a tenant and administrative access on a supported IdP.
33
+
- Your IdP must adhere to the SAML 2.0 specification. For more information, see the [SAML Wiki](https://wiki.oasis-open.org/security)on the OASIS website.
44
34
45
-
{% note %}
35
+
{% ifversion emu-public-scim-schema %}-{% endif %} To configure your IdP for SAML SSO with {% data variables.product.prodname_emus %}, you must have a tenant and administrative access on your IdP.
46
36
47
-
{% data reusables.enterprise-accounts.emu-password-reset-session %}
37
+
{%- ifversion emu-public-scim-schema %}
48
38
49
-
{% endnote %}
39
+
- {% data reusables.enterprise_user_management.authentication-or-provisioning-migration-not-supported %}
40
+
{%- endif %}
50
41
51
-
1.[Configuring your identity provider](#configuring-your-identity-provider)
52
-
1.[Configuring your enterprise](#configuring-your-enterprise)
53
-
1.[Enabling provisioning](#enabling-provisioning)
42
+
## Configuring SAML SSO for {% data variables.product.prodname_emus %}
54
43
55
-
### Configuring your identity provider
44
+
To configure SAML SSO for your {% data variables.enterprise.prodname_emu_enterprise %}, you must configure an application on your IdP, then configure your enterprise on {% data variables.location.product_location %}. After you configure SAML SSO, you can configure user provisioning.
56
45
57
-
To configure your IdP, follow the instructions they provide for configuring the {% data variables.product.prodname_emu_idp_application %} application on your IdP.
46
+
1.[Configure your IdP](#configuring-your-idp)
47
+
1.[Configure your enterprise](#configuring-your-enterprise)
48
+
1.[Enable provisioning](#enabling-provisioning)
58
49
59
-
1. To install the {% data variables.product.prodname_emu_idp_application %} application, click the link for your IdP below:
50
+
### Configuring your IdP
60
51
61
-
-[{% data variables.product.prodname_emu_idp_application %} application on Azure Active Directory](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/aad.githubenterprisemanageduser?tab=Overview)
62
-
-[{% data variables.product.prodname_emu_idp_application %} application on Okta](https://www.okta.com/integrations/github-enterprise-managed-user)
63
-
-[{% data variables.product.prodname_emu_idp_application %} connector on PingFederate](https://www.pingidentity.com/en/resources/downloads/pingfederate.html)
52
+
1. {% ifversion emu-public-scim-schema %}If you use a partner IdP, to install the {% data variables.product.prodname_emu_idp_application %} application, click one of the following links.{% else %}To install the GitHub Enterprise Managed User application, click the link for your IdP below:{% endif %}
64
53
65
-
To download the PingFederate connector, navigate to the **Add-ons** tab and select **GitHub EMU Connector 1.0**.
54
+
-[Azure AD application](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/aad.githubenterprisemanageduser?tab=Overview) in Azure Marketplace
55
+
-[Okta application](https://www.okta.com/integrations/github-enterprise-managed-user) in Okta's integrations directory
1. To configure the {% data variables.product.prodname_emu_idp_application %} application and your IdP, click the link below and follow the instructions provided by your IdP:
58
+
- To download the PingFederate connector, navigate to the **Add-ons** tab and select **GitHub EMU Connector 1.0**.
68
59
69
-
-[Azure Active Directory tutorial for {% data variables.product.prodname_emus %}](https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/github-enterprise-managed-user-tutorial)
70
-
-[Okta documentation for {% data variables.product.prodname_emus %}](https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-GitHub-Enterprise-Managed-User.html)
71
-
-[PingFederate documentation for {% data variables.product.prodname_emus %}](https://docs.pingidentity.com/r/en-us/pingfederate-github-emu-connector/pingfederate_github_emu_connector)
60
+
1. To configure SAML SSO for {% data variables.product.prodname_emus %} on your IdP, read the following documentation. {% ifversion emu-public-scim-schema %}If you don't use a partner IdP, you can use the SAML configuration reference for {% data variables.product.product_name %} to create and configure a generic SAML 2.0 application on your IdP.{% endif %}
72
61
73
-
1. So you can test and configure your enterprise, assign yourself or the user that will be configuring SAML SSO on {% data variables.product.prodname_dotcom %} to the {% data variables.product.prodname_emu_idp_application %} application on your IdP.
62
+
-[Azure AD instructions](https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/github-enterprise-managed-user-tutorial) in the Azure AD documentation
63
+
-[Okta instructions](https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-GitHub-Enterprise-Managed-User.html) in the Okta documentation
64
+
-[PingFederate instructions](https://docs.pingidentity.com/r/en-us/pingfederate-github-emu-connector/pingfederate_github_emu_connector) in the PingIdentity documentation
1. To test and configure your enterprise, assign yourself or the user that will configure SAML SSO for your enterprise on {% data variables.location.product_location %} to the application you configured for {% data variables.product.prodname_emus %} on your IdP.
74
69
75
-
1. To enable you to continue configuring your enterprise on {% data variables.product.prodname_dotcom %}, locate and note the following information from the application you installed on your IdP.
70
+
1. To continue configuring your enterprise on {% data variables.location.product_location %}, locate and note the following information from the application you installed on your IdP.
76
71
77
72
| Value | Other names | Description |
78
73
| :- | :- | :- |
@@ -82,15 +77,23 @@ To configure your IdP, follow the instructions they provide for configuring the
82
77
83
78
### Configuring your enterprise
84
79
85
-
After you install and configure the {% data variables.product.prodname_emu_idp_application %} application on your identity provider, you can configure your enterprise.
80
+
After you configure SAML SSO for {% data variables.product.prodname_emus %} on your IdP, you can configure your enterprise on {% data variables.location.product_location %}.
81
+
82
+
After the initial configuration of SAML SSO, the only setting you can update on {% data variables.location.product_location %} for your existing SAML configuration is the SAML certificate. If you need to update the sign-on URL or issuer URL, you must first disable SAML SSO, then reconfigure SAML SSO with the new settings. For more information, see "[AUTOTITLE](/admin/identity-and-access-management/configuring-authentication-for-enterprise-managed-users/disabling-authentication-for-enterprise-managed-users)."
86
83
87
84
{% data reusables.emus.sign-in-as-setup-user %}
85
+
86
+
{% note %}
87
+
88
+
**Note**: {% data reusables.enterprise-accounts.emu-password-reset-session %}
89
+
90
+
{% endnote %}
88
91
{% data reusables.enterprise-accounts.access-enterprise %}
89
92
{% data reusables.enterprise-accounts.settings-tab %}
90
93
{% data reusables.enterprise-accounts.security-tab %}
91
94
92
95
1. Under "SAML single sign-on", select **Require SAML authentication**.
93
-
1. Under **Sign on URL**, type the HTTPS endpoint of your IdP for single sign-on requests that you noted while configuring your IdP.
96
+
1. Under **Sign on URL**, type the HTTPS endpoint of your IdP for SSO requests that you noted while configuring your IdP.
94
97
1. Under **Issuer**, type your SAML issuer URL that you noted while configuring your IdP, to verify the authenticity of sent messages.
95
98
1. Under **Public Certificate**, paste the certificate that you noted while configuring your IdP, to verify SAML responses.
96
99
{% data reusables.saml.edit-signature-and-digest-methods %}
@@ -99,7 +102,7 @@ After you install and configure the {% data variables.product.prodname_emu_idp_a
99
102
100
103
{% note %}
101
104
102
-
**Note:**When you require SAML SSO for your enterprise, the setup user will no longer have access to the enterprise but will remain signed in to GitHub. Only {% data variables.enterprise.prodname_managed_users %} provisioned by your IdP will have access to the enterprise.
105
+
**Note:**After you require SAML SSO for your enterprise, the setup user will no longer have access to the enterprise but will remain signed in to GitHub. Only {% data variables.enterprise.prodname_managed_users %} provisioned by your IdP will have access to the enterprise.
103
106
104
107
{% endnote %}
105
108
@@ -108,3 +111,68 @@ After you install and configure the {% data variables.product.prodname_emu_idp_a
108
111
### Enabling provisioning
109
112
110
113
After you enable SAML SSO, enable provisioning. For more information, see "[AUTOTITLE](/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-scim-provisioning-for-enterprise-managed-users)."
114
+
115
+
### Enabling guest collaborators
116
+
117
+
If your enterprise uses {% data variables.product.prodname_emus %}, you can use the role of guest collaborator to grant limited access to vendors and contractors. Guest collaborators are provisioned by your IdP, and only have access to the specific repositories or organizations you add them to. Guest collaborators only have access to internal repositories within organizations where they are a member and private repositories they are expressly authorized to access. Guest collaborators will never see internal repositories in an organization they are not a member of. For more information, see "[AUTOTITLE](/admin/enterprise-cloud@latest/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise#guest-collaborators)."
118
+
119
+
If you use Azure AD or Okta for SAML authentication, you may need to update your IdP application to use guest collaborators.
120
+
121
+
#### Enabling guest collaborators if you use Azure AD
122
+
123
+
1. Sign into the Azure Portal.
124
+
1. Click **Identity**.
125
+
1. Click **Applications**.
126
+
1. Click **Enterprise applications**.
127
+
1. Click **All applications**.
128
+
1. View the details for your {% data variables.product.prodname_emus %} application
129
+
1. In the left sidebar, click **Users and Groups**.
130
+
1. View the application registration.
131
+
132
+
- If the application registration displays the "Restricted User" or "Guest Collaborator" roles, you're ready to invite guest collaborators to your enterprise.
133
+
- If the application registration does not display the roles, proceed to the next step.
134
+
1. In the Azure Portal, click **App registrations**.
135
+
1. Click **All applications**, then use the search bar to find your application for {% data variables.product.prodname_emus %}.
136
+
1. Click your SAML application.
137
+
1. In the left sidebar, click **Manifest**.
138
+
1. Under "appRoles", add the following:
139
+
140
+
```json
141
+
{
142
+
"allowedMemberTypes": [
143
+
"User"
144
+
],
145
+
"description": "Guest Collaborator",
146
+
"displayName": "Guest Collaborator",
147
+
"id": "1ebc4a02-e56c-43a6-92a5-02ee09b90824",
148
+
"isEnabled": true,
149
+
"lang": null,
150
+
"origin": "Application",
151
+
"value": "null"
152
+
},
153
+
```
154
+
155
+
{% note %}
156
+
157
+
**Note:** The `id` value is critical. If another `id` value is present, the update will fail.
158
+
159
+
{% endnote %}
160
+
1. Click **Save**.
161
+
162
+
#### Enabling guest collaborators for your enterprise with Okta
163
+
164
+
To add the guest collaborator role to your Okta application:
165
+
166
+
1. Navigate to your application for {% data variables.product.prodname_emus %} on Okta.
167
+
1. Click **Provisioning**.
168
+
1. Click **Go to Profile Editor**.
169
+
1. Find "Roles" at the bottom of the profile editor and click the edit icon.
170
+
1. Add a new role.
171
+
172
+
- For "Display name", type `Guest Collaborator`.
173
+
- For "Value", type `guest_collaborator`.
174
+
1. Click **Save**.
175
+
176
+
#### Adding guest collaborators to your enterprise
177
+
178
+
After you enable guest collaborators for your enterprise, you can add guest collaborators to your enterprise. For more information, see "[AUTOTITLE](/admin/identity-and-access-management/provisioning-user-accounts-for-enterprise-managed-users/configuring-scim-provisioning-for-enterprise-managed-users#assigning-users-and-groups)."
Copy file name to clipboardExpand all lines: content/admin/identity-and-access-management/configuring-authentication-for-enterprise-managed-users/index.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
title: Configuring authentication for Enterprise Managed Users
3
3
shortTitle: Authentication for managed users
4
4
product: '{% data reusables.gated-features.emus %}'
5
-
intro: 'You can decide whether people use SAML or OIDC to authenticate, learn about support for conditional access policy, see username considerations, or disable authentication for your {% data variables.enterprise.prodname_emu_enterprise %} on {% data variables.product.prodname_dotcom_the_website %}.'
5
+
intro: 'You can decide whether people use SAML or OIDC to authenticate, learn about support for conditional access policy, or disable authentication for your {% data variables.enterprise.prodname_emu_enterprise %} on {% data variables.product.prodname_dotcom_the_website %}.'
Copy file name to clipboardExpand all lines: content/admin/identity-and-access-management/iam-configuration-reference/saml-configuration-reference.md
+4-2
Original file line number
Diff line number
Diff line change
@@ -19,9 +19,11 @@ redirect_from:
19
19
20
20
## About SAML configuration
21
21
22
-
To use SAML single sign-on (SSO) for authentication to {% data variables.product.product_name %}, you must configure both your external SAML identity provider (IdP) and {% ifversion ghes %}{% data variables.location.product_location %}{% elsif ghec %}your enterprise or organization on {% data variables.location.product_location %}{% elsif ghae %}your enterprise on {% data variables.product.product_name %}{% endif %}. In a SAML configuration, {% data variables.product.product_name %} functions as a SAML service provider (SP). For more information, see "[AUTOTITLE](/admin/identity-and-access-management/managing-iam-for-your-enterprise/about-saml-for-enterprise-iam)."
22
+
To use SAML single sign-on (SSO) for authentication to {% data variables.product.product_name %}, you must configure both your external SAML identity provider (IdP) and {% ifversion ghes %}{% data variables.location.product_location %}{% elsif ghec %}your enterprise or organization on {% data variables.location.product_location %}{% elsif ghae %}your enterprise on {% data variables.product.product_name %}{% endif %}. In a SAML configuration, {% data variables.product.product_name %} functions as a SAML service provider (SP). For more information about authentication for your enterprise, see "[AUTOTITLE](/admin/identity-and-access-management/understanding-iam-for-enterprises/about-identity-and-access-management#authentication-methods)."
23
23
24
-
You must enter unique values from your SAML IdP when configuring SAML SSO for {% data variables.product.product_name %}, and you must also enter unique values from {% data variables.product.product_name %} on your IdP. For more information about the configuration of SAML SSO for {% data variables.product.product_name %}, see "[AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/configuring-saml-single-sign-on-for-your-enterprise){% ifversion ghes or ghae %}{% elsif ghec %}" or "[AUTOTITLE](/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization){% endif %}."
24
+
{% data variables.product.product_name %} provides integration according to the SAML 2.0 specification. For more information, see the [SAML Wiki](https://wiki.oasis-open.org/security) on the OASIS website.
25
+
26
+
You must enter unique values from your SAML IdP when configuring SAML SSO for {% data variables.product.product_name %}, and you must also enter unique values from {% data variables.product.product_name %} on your IdP. For more information about authentication for
0 commit comments