Enabling and testing SAML single sign-on for your organization

About SAML single sign-on

You can enable SAML SSO in your organization without requiring all members to use it. Enabling but not enforcing SAML SSO in your organization can help smooth your organization's SAML SSO adoption. Once a majority of your organization's members use SAML SSO, you can enforce it within your organization.

If you enable but don't enforce SAML SSO, organization members who choose not to use SAML SSO can still be members of the organization. For more information on enforcing SAML SSO, see "Enforcing SAML single sign-on for your organization."

Quando o SSO do SAML está desabilitado, todas a identidades externas vinculadas são removidas de GitHub Enterprise Cloud.

Depois de habilitar o SSO do SAML, as autorizações de OAuth App e GitHub App poderão precisar ser revogadas e reautorizadas para acessar a organização. Para obter mais informações, confira "Autorização do OAuth Apps".

Enabling and testing SAML single sign-on for your organization

Before your enforce SAML SSO in your organization, ensure that you've prepared the organization. For more information, see "Preparing to enforce SAML single sign-on in your organization."

For more information about the identity providers (IdPs) that GitHub supports for SAML SSO, see "Connecting your identity provider to your organization."

1. No canto superior direito do GitHub.com, clique na foto do seu perfil e clique em Suas organizações.

2. Ao lado da organização, clique em Configurações.

3. In the "Security" section of the sidebar, click Authentication security.

4. Under "SAML single sign-on", select Enable SAML authentication.

   Note: After enabling SAML SSO, you can download your single sign-on recovery codes so that you can access your organization even if your IdP is unavailable. For more information, see "Downloading your organization's SAML single sign-on recovery codes."

5. In the "Sign on URL" field, type the HTTPS endpoint of your IdP for single sign-on requests. This value is available in your IdP configuration.

6. Optionally, in the "Issuer" field, type your SAML issuer's name. This verifies the authenticity of sent messages.

7. Under "Public Certificate," paste a certificate to verify SAML responses.

8. Click and then in the Signature Method and Digest Method drop-downs, choose the hashing algorithm used by your SAML issuer to verify the integrity of the requests.

9. Before enabling SAML SSO for your organization, click Test SAML configuration to ensure that the information you've entered is correct.

   Tip: Ao configurar o SSO do SAML na sua organização, teste sua implementação sem afetar os membros da organização mantendo a opção Exigir a autenticação SSO do SAML para todos os membros da organização nome da organização desmarcada.

10. To enforce SAML SSO and remove all organization members who haven't authenticated via your IdP, select Require SAML SSO authentication for all members of the organization name organization. For more information on enforcing SAML SSO, see "Enforcing SAML single sign-on for your organization."

11. Click Save.

Further reading

• "About identity and access management with SAML single sign-on"
• "SAML configuration reference"