Configuring OIDC for Enterprise Managed Users

注意：对 Enterprise Managed Users 的 OpenID Connect (OIDC) 和条件访问策略 (CAP) 支持仅适用于 Azure AD。

About OIDC for Enterprise Managed Users

With Enterprise Managed Users, your enterprise uses your identity provider (IdP) to authenticate all members. You can use OpenID Connect (OIDC) to manage authentication for your 具有托管用户的企业. Enabling OIDC SSO is a one-click setup process with certificates managed by GitHub and your IdP.

企业使用 OIDC SSO 时，GitHub 将自动使用 IdP 的条件访问策略 (CAP) IP 条件来验证用户与 GitHub 的交互，当成员更改 IP 地址时，每次使用 personal access token 或 SSH 密钥时都会验证。 For more information, see "About support for your IdP's Conditional Access Policy."

You can adjust the lifetime of a session, and how often a 托管用户帐户 needs to reauthenticate with your IdP, by changing the lifetime policy property of the ID tokens issued for GitHub from your IdP. The default lifetime is one hour. For more information, see "Configure token lifetime policies" in the Azure AD documentation.

Note: If you need assistance configuring the OIDC session lifetime, contact Microsoft Support.

如果目前使用 SAML SSO 进行身份验证，并且更希望使用 OIDC 并受益于 CAP 支持，则可以遵循迁移路径。有关详细信息，请参阅“从 SAML 迁移到 OIDC”。

警告：如果使用 GitHub Enterprise Importer 从你的 GitHub Enterprise Server 实例迁移组织，请确保使用一个豁免于 Azure AD CAP 的服务帐户，否则迁移可能会被阻止。

Identity provider support

Support for OIDC is available for customers using Azure Active Directory (Azure AD).

Each Azure AD tenant can support only one OIDC integration with Enterprise Managed Users. If you want to connect Azure AD to more than one enterprise on GitHub, use SAML instead. For more information, see "为企业托管用户配置 SAML 单一登录."

OIDC does not support IdP-initiated authentication.