Managing team memberships with identity provider groups

本文内容

You can manage team and organization membership on GitHub Enterprise Cloud through your identity provider (IdP) by connecting IdP groups with teams within your 具有托管用户的企业.

若要使用标识提供者管理企业中的用户，企业必须启用 Enterprise Managed Users，它适用于 GitHub Enterprise Cloud。 有关详细信息，请参阅“关于 Enterprise Managed Users”。

About team management with Enterprise Managed Users

使用 Enterprise Managed Users，可以将 GitHub 团队与 IdP 组连接起来，通过 IdP 管理企业内的团队和组织成员身份。 When you connect a team in one of your enterprise's organizations to an IdP group, changes to membership from the IdP group are reflected in your enterprise automatically, reducing the need for manual updates and custom scripts.

When a change to an IdP group or a new team connection results in a 托管用户帐户 joining a team in an organization they were not already a member of, the 托管用户帐户 will automatically be added to the organization. When you disconnect a group from a team, users who became members of the organization via team membership are removed from the organization if they are not assigned membership in the organization by any other means.

Note: Organization owners can also add 托管用户帐户 to organizations manually, as long as the accounts have already been provisioned via SCIM.

When group membership changes on your IdP, your IdP sends a SCIM request with the changes to GitHub.com according to the schedule determined by your IdP, so change may not be immediate. Any requests that change team or organization membership will register in the audit log as changes made by the account used to configure user provisioning.

GitHub also runs a reconciliation job once per day, which synchronizes team membership with IdP group membership that is stored on GitHub, based on information previously sent from the IdP via SCIM. If this job finds that a user is a member of an IdP group in the enterprise, but they are not a member of the mapped team or its organization, the job will attempt to add the user to the organization and team.

Teams connected to IdP groups cannot be parents of other teams nor a child of another team. If the team you want to connect to an IdP group is a parent or child team, we recommend creating a new team or removing the nested relationships that make your team a parent team.

To manage repository access for any team in your enterprise, including teams connected to an IdP group, you must make changes on GitHub.com. For more information, see "管理团队对组织仓库的访问".

Requirements for connecting IdP groups with teams

Before you can connect an IdP group with a team on GitHub, you must assign the group to the GitHub Enterprise Managed User application in your IdP. For more information, see "为 Enterprise Managed User 配置 SCIM 预配."

You can connect a team in your enterprise to one IdP group. You can assign the same IdP group to multiple teams in your enterprise.

If you are connecting an existing team to an IdP group, you must first remove any members that were added manually. After you connect a team in your enterprise to an IdP group, your IdP administrator must make team membership changes through the identity provider. You cannot manage team membership on GitHub.com.

If you use Azure AD as your IdP, you can only connect a team to a security group. Nested group memberships and Microsoft 365 groups are not supported.

Creating a new team connected to an IdP group

Any member of an organization can create a new team and connect the team to an IdP group.

  1. 在 GitHub.com 的右上角，选择个人资料照片，然后单击 “你的组织”****。

    @octocat 的个人资料图片下的下拉菜单的屏幕截图。 “你的组织”以深橙色标出。

  2. 单击您的组织名称。

  3. 在组织名称下，单击 “团队”。

    组织的水平导航栏的屏幕截图。 标有人员图标和“团队”的选项卡以深橙色框出。

  4. 在页面顶部，单击“新建团队”。

  5. 在“Create new team（创建新团队）”下，输入新团队的名称。

  6. （可选）在“Description（描述）”字段中输入团队的描述。

  7. To connect a team, under "Identity Provider Groups", select the Select Groups dropdown menu and click the team you want to connect.

  8. 在“团队可见性”下，选择团队的可见性。

  9. 单击“创建团队”。

Managing the connection between an existing team and an IdP group

Organization owners can manage the existing connection between an IdP group and a team. If your enterprise does not use 托管用户帐户, team maintainers can also manage the connection.

Note: Before you connect an existing team on GitHub.com to an IdP group for the first time, all members of the team on GitHub.com must first be removed. For more information, see "从团队中删除组织成员."

  1. 在 GitHub.com 的右上角，单击你的头像照片，然后单击“你的个人资料”。

    @octocat 的个人资料图片下的下拉菜单的屏幕截图。 “你的个人资料”用深橙色框出。

  2. 在 GitHub.com 的右上角，单击你的头像照片，然后单击“你的个人资料”。

  3. 在 GitHub.com 的右上角，选择个人资料照片，然后单击 “你的组织”****。

    @octocat 的个人资料图片下的下拉菜单的屏幕截图。 “你的组织”以深橙色标出。

  4. 在组织名称下，单击 “团队”。

    组织的水平导航栏的屏幕截图。 标有人员图标和“团队”的选项卡以深橙色框出。

  5. 单击团队的名称。

  6. 在团队页面顶部，单击 “设置”。

    团队页标题的屏幕截图。 标有齿轮图标和“设置”的选项卡用深橙色标出。

  7. Optionally, under "Identity Provider Group", to the right of the IdP group you want to disconnect, click . Unselect a connected IdP group from the GitHub team.

  8. To connect an IdP group, under "Identity Provider Group", select the drop-down menu, and click an identity provider group from the list. Drop-down menu to choose identity provider group.

  9. Click Save changes.

Viewing IdP groups, group membership, and connected teams

Enterprise owners can review a list of IdP groups, each group's memberships, and any teams connected to each group. The IdP groups and memberships listed in this view are based on information sent from the IdP to GitHub via SCIM. You must edit the membership for a group on your IdP.

  1. 在 GitHub.com 的右上角，单击你的个人资料照片，然后单击“你的企业”。

  2. 在企业列表中，单击您想要查看的企业。

  3. 若要查看 IdP 组列表，请在左侧边栏中单击 “标识提供者”。

  4. To see the members and teams connected to an IdP group, click the group's name.

  5. To view the teams connected to the IdP group, click Teams.

If a team cannot sync with the group on your IdP, the team will display an error. For more information, see "Troubleshooting team membership with identity provider groups."