Configuring SAML single sign-on and SCIM for your enterprise account using Okta

About SAML and SCIM with Okta

You can control access to your enterprise account in GitHub and other web applications from one central interface by configuring the enterprise account to use SAML SSO and SCIM with Okta, an Identity Provider (IdP).

SAML SSO controls and secures access to enterprise account resources like organizations, repositories, issues, and pull requests. SCIM automatically adds, manages, and removes members' access to organizations owned by your enterprise account when you make changes in Okta. For more information, see "Enforcing security settings in your enterprise account."

After you enable SCIM, the following provisioning features are available for any users that you assign your GitHub Enterprise Cloud application to in Okta.

Prerequisites

Debes utilizar la "IU Clásica" en Okta. Para obtener más información, consulta la sección Organized Navigation en el blog de Okta.

Adding the GitHub Enterprise Cloud application in Okta

1. En Okta, en la esquina superior derecha, da clic en Admin.
   
2. En el tablero de Okta, da clic en Aplicaciones.
   
3. Da clic en Agregar aplicación.
   
4. En el campo de búsqueda, teclea "GitHub Enterprise Cloud".
   
5. Click "GitHub Enterprise Cloud - Enterprise Accounts".
6. Click Add.
7. Optionally, to the right of "Application label", type a descriptive name for the application.
   
8. To the right of "GitHub Enterprises", type the name of your enterprise account. For example, if your enterprise account's URL is https://github.com/enterprises/octo-corp, type octo-corp.
   
9. Click Done.

Enabling and testing SAML SSO

1. En Okta, en la esquina superior derecha, da clic en Admin.
   
2. En el tablero de Okta, da clic en Aplicaciones.
   
3. Da clic en la etiqueta de la aplicación que creaste para tu cuenta empresarial.
4. Asigna la aplicación a tu usuario en Okta. Para obtener más información, consulta la sección Asignar aplicaciones a los usuarios en la documentación de Okta.
5. Debajo del nombre de la aplicación, da clic en Iniciar sesión.
   
6. To the right of Settings, click Edit.
7. Under "Configured SAML Attributes", to the right of "groups", use the drop-down menu and select Matches regex.
8. To the right of the drop-down menu, type .*.*.
9. Click Save.
10. Debajo de "MÉTODOS DE REGISTRO", da clic en **Ver las instrucciones de configuración".
    

Creating groups in Okta

1. In Okta, create a group to match each organization owned by your enterprise account. The name of each group must match the account name of the organization (not the organization's display name). For example, if the URL of the organization is https://github.com/octo-org, name the group octo-org.
2. Assign the application you created for your enterprise account to each group. GitHub will receive all groups data for each user.
3. Add users to groups based on the organizations you'd like users to belong to.

Configuring user provisioning with SCIM in Okta

Si estás participando en el beta privado para el aprovisionamiento de usuario para cuentas empresariales, cuando habilites SAML para tu cuenta empresarial, se habilitará predeterminadamente el aprovisionamiento y desaprovisionamiento de SCIM en GitHub. Puedes utilizar el aprovisionamiento para administrar la membrecía de la organización si configuras SCIM en tu IdP.

To configure user provisioning with SCIM in Okta, you must authorize an OAuth application to create a token that Okta can use to authenticate to GitHub on your behalf. The okta-oauth application is created by Okta in partnership with GitHub.

1. En Okta, en la esquina superior derecha, da clic en Admin.
   
2. En el tablero de Okta, da clic en Aplicaciones.
   
3. Da clic en la etiqueta de la aplicación que creaste para tu cuenta empresarial.
4. Debajo del nombre de la aplicación, da clic en Aprovisionamiento.
   
5. Da clic en Configurar la integraciòn de la API.
   
6. Selecciona Habilitar la Integraciòn de la API.
   
7. Click Authenticate with Github Enterprise Cloud - Enterprise Accounts.
   
8. To the right of your enterprise account's name, click Grant.
9. Click Authorize okta-oauth.
10. Haz clic en Save (Guardar).
    
11. A la derecha de "Aprovisionar a la App", da clic en Editar.
    
12. A la derecha de "Crear Usuarios", selecciona Habilitar.
    
13. A la derecha de "Actualizar Atributos de Usuario", selecciona Habilitar.
    
14. A la derecha de "Desactivar Usuarios", selecciona Habilitar.
    
15. Haz clic en Save (Guardar).
    
16. Under the name of the application, click Push Groups.
    
17. Use the Push Groups drop-down menu, and select Find groups by name.
    
18. Add a push group for each organization in your enterprise account that you want to enable user provisioning for.
    • Under "PUSH GROUPS BY NAME", search for a group that corresponds to an organization owned by your enterprise account, then click the group in the search results.
    • To the right of the group name, in the "Match results & push action" drop-down menu, verify that Create Group is selected.
      
    • Click Save.
    • Repeat for each organization.
19. Under the name of your application, click Assignments.
    
20. If you see Provision users, users who were a member of an Okta group before you added a push group for that group have not been provisioned. To send SCIM data to GitHub for these users, click Provision users.

Enabling SAML user provisioning

After you enable SCIM provisioning and deprovisioning, you can optionally enable SAML user provisioning and deprovisioning.

1. Visita la cuenta de tu empresa en https://github.com/enterprises/ENTERPRISE-NAME, reemplazando ENTERPRISE-NAME por el nombre de la cuenta de tu empresa.
2. En la barra lateral de la cuenta de empresa, haz clic en Settings (Configuraciones).
   
3. En la barra lateral izquierda, haz clic en Security (Seguridad).
   
4. Under "SAML User Provisioning", select Enable SAML user provisioning.
   
5. Click Save.
6. Optionally, enable SAML user deprovisioning.
   • Select Enable SAML user deprovisioning, then click Save.
     
   • Read the warning, then click Enable SAML deprovisioning.