Configuring SAML single sign-on with Okta for Enterprise Managed Users

Learn how to configure SAML SSO for Enterprise Managed Users on Okta and GitHub Enterprise Cloud.

Who can use this feature?

Enterprise Managed Users is available for new enterprise accounts on GitHub Enterprise Cloud. See "About Enterprise Managed Users."

In this article

Warning

Enabling SAML affects all members of your enterprise.

Enterprise Managed Users doesn't provide a backup sign in URL where members of your enterprise can sign in using their regular username and password. If you are unable to sign in, contact GitHub Enterprise Support via the GitHub Support portal for assistance.

Supported features

The GitHub Enterprise Managed User application on Okta supports SP-initiated SSO and IdP-initiated SSO.

Configuring Okta

  1. Install the GitHub Enterprise Managed User application from Okta's integrations direction.

  2. In the GitHub Enterprise Managed User application on Okta, click the Assignments tab and assign the application to your Okta account.

  3. Click the Sign on tab.

  4. Next to "Enterprise Name," type the name of your enterprise with managed users.

    Note

    For example, if you sign in to https://github.com/enterprises/octo-enterprise, your enterprise name is octo-enterprise.

  5. On the "Sign on" tab, under "SAML 2.0," click More details.

  6. In order to configure your enterprise on GitHub Enterprise Cloud later, note down the following items:

    • "Sign on URL"
    • "Issuer"
    • "Signing certificate"

Configuring your enterprise

  1. Sign in to your enterprise with managed users.

  2. In the top-right corner of GitHub, click your profile photo, then click Your enterprises.

  3. In the list of enterprises, click the enterprise you want to view.

  4. In the enterprise account sidebar, click Settings.

  5. Under Settings, click Authentication security.

  6. Under "SAML single sign-on", select Require SAML authentication.

  7. Under Sign on URL, type the "Sign on URL" that you noted down from Okta.

  8. Under Issuer, type the "Issuer" that you noted down from Okta.

  9. Under Public Certificate, paste the certificate that you noted from Okta.

  10. Before enabling SAML SSO for your enterprise, to ensure that the information you've entered is correct, click Test SAML configuration. This test uses Service Provider initiated (SP-initiated) authentication and must be successful before you can save the SAML settings.

  11. Click Save.

    Note: After you require SAML SSO for your enterprise, the setup user will no longer have access to the enterprise but will remain signed in to GitHub. Only managed user accounts provisioned by your IdP will have access to the enterprise.

  12. To ensure you can still access your enterprise on GitHub.com if your IdP is unavailable in the future, click Download, Print, or Copy to save your recovery codes. For more information, see "Downloading your enterprise account's single sign-on recovery codes."

Enabling provisioning

After you enable SAML SSO, enable provisioning. For more information, see "Configuring SCIM provisioning with Okta."