Skip to main content
我们经常发布文档更新，此页面的翻译可能仍在进行中。有关最新信息，请访问英语文档。
 

 

Configuring SAML single sign-on for your enterprise

本文内容

You can control and secure access to resources like repositories, issues, and pull requests within your enterprise's organizations by enforcing SAML single sign-on (SSO) through your identity provider (IdP).

Who can use this feature

Enterprise owners can configure SAML SSO for an enterprise on GitHub Enterprise Cloud.

注意：如果企业使用 Enterprise Managed Users，则必须遵循不同的过程来配置 SAML 单一登录。 有关详细信息，请参阅“为 Enterprise 托管用户配置 SAML 单一登录”。

About SAML SSO

SAML 单一登录 (SSO) 为使用 GitHub Enterprise Cloud 的组织所有者和企业所有者提供了一种控制安全访问存储库、问题和拉取请求等组织资源的方法。

如果配置了 SAML SSO，组织成员将继续在 GitHub.com 上登录到其个人帐户。 当成员访问组织内的大部分资源时，GitHub 会将成员重定向到你的 IdP 以进行身份验证。 身份验证成功后，IdP 将该成员重定向回 GitHub。 有关详细信息，请参阅“关于通过 SAML 单一登录进行身份验证”。

注意： SAML SSO 不会取代 GitHub 的正常登录过程。 除非使用 Enterprise Managed Users，否则成员将继续在 GitHub.com 上登录到其个人帐户，并且每个个人帐户都将链接到 IdP 中的外部标识。

For more information, see "About identity and access management with SAML single sign-on."

企业所有者可以通过 SAML IdP 跨企业帐户拥有的所有组织启用 SAML SSO 和集中式身份验证。 为企业帐户启用 SAML SSO 后，默认情况下会为您的企业帐户拥有的所有组织实施 SAML SSO。 所有成员都需要使用 SAML SSO 进行身份验证才能访问其所属的组织，并且企业所有者在访问企业帐户时需要使用 SAML SSO 进行身份验证。

To access each organization's resources on GitHub Enterprise Cloud, the member must have an active SAML session in their browser. To access each organization's protected resources using the API and Git, the member must use a personal access token or SSH key that the member has authorized for use with the organization. Enterprise owners can view and revoke a member's linked identity, active sessions, or authorized credentials at any time. For more information, see "Viewing and managing a user's SAML access to your enterprise account."

禁用 SAML SSO 后，所有关联的外部标识将从 GitHub Enterprise Cloud 中删除。

You cannot use this implementation of SCIM with an enterprise account or with an organization with managed users. If your enterprise is enabled for Enterprise Managed Users, you must use a different implementation of SCIM. Otherwise, SCIM is not available at the enterprise level. For more information, see "Configuring SCIM provisioning for Enterprise Managed Users."

Supported identity providers

GitHub Enterprise Cloud 支持 SAML SSO 与采用 SAML 2.0 标准的 IdP 一起使用。 有关详细信息，请参阅 OASIS 网站上的 SAML Wiki。

GitHub 官方支持和内部测试以下 IdP。

  • Active Directory 联合身份验证服务 (AD FS)
  • Azure Active Directory (Azure AD)
  • Okta
  • OneLogin
  • PingOne
  • Shibboleth

Username considerations with SAML

If you use Enterprise Managed Users, GitHub Enterprise Cloud normalizes a value from your IdP to determine the username for each new personal account in your enterprise on GitHub.com. For more information, see "Username considerations for external authentication."

Enforcing SAML single-sign on for organizations in your enterprise account

Notes:

  • When you enforce SAML SSO for your enterprise, the enterprise configuration will override any existing organization-level SAML configurations. 如果企业帐户拥有的任何组织已配置为使用 SAML SSO，则为企业帐户启用 SAML SSO 时，有一些特殊注意事项。 For more information, see "Switching your SAML configuration from an organization to an enterprise account."
  • When you enforce SAML SSO for an organization, GitHub removes any members of the organization that have not authenticated successfully with your SAML IdP. When you require SAML SSO for your enterprise, GitHub does not remove members of the enterprise that have not authenticated successfully with your SAML IdP. The next time a member accesses the enterprise's resources, the member must authenticate with your SAML IdP.

For more detailed information about how to enable SAML using Okta, see "Configuring SAML single sign-on for your enterprise account using Okta."

  1. 在 GitHub.com 的右上角，单击你的个人资料照片，然后单击“你的企业”。 GitHub Enterprise Cloud 上个人资料照片下拉菜单中的“你的企业”

  2. 在企业列表中，单击您想要查看的企业。 企业列表中的企业名称

  3. 在企业帐户侧边栏中，单击 “设置”。 企业帐户侧边栏中的“设置”选项卡

  4. In the left sidebar, click Authentication security. Security tab in the enterprise account settings sidebar

  5. （可选）若要在更改设置之前查看企业帐户中所有组织的当前配置，请单击 查看组织的当前配置。 查看企业中组织的当前策略配置的链接

  6. Under "SAML single sign-on", select Require SAML authentication. Checkbox for enabling SAML SSO

  7. In the Sign on URL field, type the HTTPS endpoint of your IdP for single sign-on requests. This value is available in your IdP configuration. Field for the URL that members will be forwarded to when signing in

  8. Optionally, in the Issuer field, type your SAML issuer URL to verify the authenticity of sent messages. Field for the SAML issuer's name

  9. Under Public Certificate, paste a certificate to verify SAML responses. Field for the public certificate from your identity provider

  10. To verify the integrity of the requests from your SAML issuer, click . Then in the "Signature Method" and "Digest Method" drop-downs, choose the hashing algorithm used by your SAML issuer. Drop-downs for the Signature Method and Digest method hashing algorithms used by your SAML issuer

  11. Before enabling SAML SSO for your enterprise, click Test SAML configuration to ensure that the information you've entered is correct. Button to test SAML configuration before enforcing

  12. Click Save.

  13. 要确保在标识提供者将来不可用时仍可访问企业，请单击“下载”、“打印”或“复制”以保存恢复代码 。 有关详细信息，请参阅“下载企业帐户的单一登录恢复代码”。

    下载、打印或复制恢复代码的按钮的屏幕截图

Further reading