Skip to main content
Publicamos atualizações frequentes em nossa documentação, e a tradução desta página ainda pode estar em andamento. Para acessar as informações mais atualizadas, visite a Documentação em inglês.
� 

� 

Esta versão do GitHub Enterprise foi descontinuada em 2022-10-12. Nenhum lançamento de patch será feito, mesmo para questões críticas de segurança. Para obter melhor desempenho, segurança aprimorada e novos recursos, atualize para a última versão do GitHub Enterprise. Para obter ajuda com a atualização, entre em contato com o suporte do GitHub Enterprise.

Troubleshooting SAML authentication

Neste artigo

If you use SAML single sign-on (SSO) and people are unable to authenticate to access your GitHub Enterprise Server instance, you can troubleshoot the problem.

About problems with SAML authentication

GitHub Enterprise Server logs error messages for failed SAML authentication in the authentication log at /var/log/github/auth.log. You can review responses in this log file, and you can also configure more verbose logging.

For more information about SAML response requirements, see "SAML configuration reference."

Configuring SAML debugging

You can configure GitHub Enterprise Server to write verbose debug logs to /var/log/github/auth.log for every SAML authentication attempt. You may be able to troubleshoot failed authentication attempts with this extra output.

Warnings:

  • Only enable SAML debugging temporarily, and disable debugging immediately after you finish troubleshooting. If you leave debugging enabled, the size of your log may increase much faster than usual, which can negatively impact the performance of GitHub Enterprise Server.
  • Test new authentication settings for your GitHub Enterprise Server instance in a staging environment before you apply the settings in your production environment. For more information, see "Setting up a staging instance."

  1. No canto superior �  direita de GitHub Enterprise Server, clique na foto do perfil e clique em Configurações da empresa. "Configurações da empresa" no menu suspenso da foto do perfil em GitHub Enterprise Server

  2. Na barra lateral da empresa, clique em Políticas. Guia Políticas na barra lateral da conta corporativa

  3. Em Políticas, clique em Opções. Guia Opções na barra lateral das configurações da conta corporativa

  4. Under "SAML debugging", select the drop-down and click Enabled.

    Screenshot of drop-down to enable SAML debugging

  5. Attempt to sign into your GitHub Enterprise Server instance through your SAML IdP.

  6. Review the debug output in /var/log/github/auth.log on your GitHub Enterprise Server instance.

  7. When you're done troubleshooting, select the drop-down and click Disabled.

    Screenshot of drop-down to disable SAML debugging

Decoding responses in auth.log

Some output in auth.log may be Base64-encoded. You can access the administrative shell and use the base64 utility on your GitHub Enterprise Server instance to decode these responses. For more information, see "Accessing the administrative shell (SSH)."

$ base64 --decode ENCODED_OUTPUT

Error: "Another user already owns the account"

When a user signs into your GitHub Enterprise Server instance for the first time with SAML authentication, GitHub Enterprise Server creates a user account on the instance and maps the SAML NameID to the account.

When the user signs in again, GitHub Enterprise Server compares the account's NameID mapping to the IdP's response. If the NameID in the IdP's response no longer matches the NameID that GitHub Enterprise Server expects for the user, the sign-in will fail. The user will see the following message.

Another user already owns the account. Please have your administrator check the authentication log.

The message typically indicates that the person's username or email address has changed on the IdP. Ensure that the NameID mapping for the user account on GitHub Enterprise Server matches the user's NameID on your IdP. For more information, see "Updating a user's SAML NameID."

Error: Recipient in SAML response was blank or not valid

If the Recipient does not match the ACS URL for your GitHub Enterprise Server instance, one of the following two error messages will appear in the authentication log when a user attempts to authenticate.

Recipient in the SAML response must not be blank.

Recipient in the SAML response was not valid.

Ensure that you set the value for Recipient on your IdP to the full ACS URL for your GitHub Enterprise Server instance. For example, https://ghe.corp.example.com/saml/consume.

Error: "SAML Response is not signed or has been modified"

If your IdP does not sign the SAML response, or the signature does not match the contents, the following error message will appear in the authentication log.

SAML Response is not signed or has been modified.

Ensure that you configure signed assertions for the GitHub Enterprise Server application on your IdP.

Error: "Audience is invalid" or "No assertion found"

If the IdP's response has a missing or incorrect value for Audience, the following error message will appear in the authentication log.

Audience is invalid. Audience attribute does not match https://<em>YOUR-INSTANCE-URL</em>

Ensure that you set the value for Audience on your IdP to the EntityId for your GitHub Enterprise Server instance, which is the full URL to your instance. For example, https://ghe.corp.example.com.

Erro: "A hora atual é anterior �  condição NotBefore"

Esse erro pode ocorrer quando há uma diferença de tempo muito grande entre o IdP e o GitHub Enterprise Server, o que geralmente ocorre com IdPs auto-hospedados.

Para evitar esse problema, recomendamos apontar o dispositivo para a mesma origem do protocolo NTP que o IdP, se possível. Se você encontrar esse erro, verifique se a hora no dispositivo está sincronizada corretamente com o servidor NTP.

Se você usa o ADFS como o IdP, defina também NotBeforeSkew no ADFS como 1 minuto para o GitHub. Se NotBeforeSkew for definido como 0, mesmo diferenças de tempo muito pequenas, incluindo milissegundos, poderão causar problemas de autenticação.