Skip to main content

Configuring OIDC for Enterprise Managed Users

You can automatically manage access to your enterprise account on GitHub by configuring OpenID Connect (OIDC) single sign-on (SSO) and enable support for your IdP's Conditional Access Policy (CAP).

若要使用标识提供者管理企业中的用户,企业必须启用 Enterprise Managed Users,它适用于 GitHub Enterprise Cloud。 有关详细信息,请参阅“关于 Enterprise Managed Users”。

注意:对 Enterprise Managed Users 的 OpenID Connect (OIDC) 和条件访问策略 (CAP) 支持仅适用于 Azure AD。

About OIDC for Enterprise Managed Users

With Enterprise Managed Users, your enterprise uses your identity provider (IdP) to authenticate all members. You can use OpenID Connect (OIDC) to manage authentication for your enterprise with managed users. Enabling OIDC SSO is a one-click setup process with certificates managed by GitHub and your IdP.

When your enterprise uses OIDC SSO, GitHub will automatically use your IdP's conditional access policy (CAP) IP conditions to validate user interactions with GitHub, when members change IP addresses, and each time a personal access token or SSH key is used. For more information, see "About support for your IdP's Conditional Access Policy."

You can adjust the lifetime of a session, and how often a managed user account needs to reauthenticate with your IdP, by changing the lifetime policy property of the ID tokens issued for GitHub from your IdP. The default lifetime is one hour. For more information, see "Configurable token lifetimes in the Microsoft identity platform" in the Azure AD documentation.

如果目前使用 SAML SSO 进行身份验证,并且更希望使用 OIDC 并受益于 CAP 支持,则可以遵循迁移路径。 有关详细信息,请参阅“从 SAML 迁移到 OIDC”。

Warning: If you use GitHub Enterprise Importer to migrate an organization from your GitHub Enterprise Server instance, make sure to use a service account that is exempt from Azure AD's CAP otherwise your migration may be blocked.

Identity provider support

Support for OIDC is available for customers using Azure Active Directory (Azure AD).

Each Azure AD tenant can support only one OIDC integration with Enterprise Managed Users. If you want to connect Azure AD to more than one enterprise on GitHub, use SAML instead. For more information, see "Configuring SAML single sign-on for Enterprise Managed Users."

Configuring OIDC for Enterprise Managed Users

  1. Sign into GitHub.com as the setup user for your new enterprise with the username @SHORT-CODE_admin.

  2. 在 GitHub.com 的右上角,单击你的个人资料照片,然后单击“你的企业”。 GitHub Enterprise Cloud 上个人资料照片下拉菜单中的“你的企业”

  3. 在企业列表中,单击您想要查看的企业。 企业列表中的企业名称

  4. 在企业帐户侧边栏中,单击 “设置”。 企业帐户侧边栏中的“设置”选项卡

  5. In the left sidebar, click Authentication security. Security tab in the enterprise account settings sidebar

  6. Select Require OIDC single sign-on.
    Screenshot showing the "Require OIDC single sign-on" checkbox

  7. To continue setup and be redirected to Azure AD, click Save.

  8. 在 GitHub Enterprise Cloud 将你重定向到 IdP 后,登录,然后按照说明授予同意并安装 GitHub Enterprise Managed User (OIDC) 应用程序。 在 Azure AD 通过 OIDC 请求 GitHub Enterprise Managed Users 的权限后,启用“代表组织同意”,然后单击“接受” 。

    警告:必须以具有全局管理员权限的用户身份登录到 Azure AD,才能同意安装 GitHub Enterprise Managed User (OIDC) 应用程序。

  9. 要确保在标识提供者将来不可用时仍可访问企业,请单击“下载”、“打印”或“复制”以保存恢复代码 。 有关详细信息,请参阅“下载企业帐户的单一登录恢复代码”。

    下载、打印或复制恢复代码的按钮的屏幕截图

Enabling provisioning

After you enable OIDC SSO, enable provisioning. For more information, see "Configuring SCIM provisioning for enterprise managed users."