Configuring SAML single sign-on and SCIM using Okta

About SAML and SCIM with Okta

You can control access to your GitHub organization and other web applications from one central interface by configuring the organization to use SAML SSO and SCIM with Okta, an Identity Provider (IdP).

SAML SSO controls and secures access to organization resources like repositories, issues, and pull requests. SCIM automatically adds, manages, and removes members' access to your GitHub organization when you make changes in Okta. For more information, see "About identity and access management with SAML single sign-on" and "About SCIM."

After you enable SCIM, the following provisioning features are available for any users that you assign your GitHub Enterprise Cloud application to in Okta.

Feature	Description
Push New Users	When you create a new user in Okta, the user will receive an email to join your GitHub organization.
Push User Deactivation	When you deactivate a user in Okta, Okta will remove the user from your GitHub organization.
Push Profile Updates	When you update a user's profile in Okta, Okta will update the metadata for the user's membership in your GitHub organization.
Reactivate Users	When you reactivate a user in Okta, Okta will send an email invitation for the user to rejoin your GitHub organization.

Prerequisites

You must use the "Classic UI" in Okta. For more information, see Organized Navigation on the Okta blog.

Adding the GitHub Enterprise Cloud application in Okta

1. In the Okta Dashboard, click Applications.

2. Click Add application.

3. In the search field, type "GitHub Enterprise Cloud".

4. To the right of "Github Enterprise Cloud - Organization", click Add.

5. In the GitHub Organization field, type the name of your GitHub organization. For example, if your organization's URL is https://github.com/octo-org, the organization name would be octo-org.

6. Click Done.

Enabling and testing SAML SSO

1. In the Okta Dashboard, click Applications.
2. In the list of applications, click the label for the application you created for the organization that uses GitHub Enterprise Cloud.
3. Assign the application to your user in Okta. For more information, see Assign applications to users in the Okta documentation.
4. Under the name of the application, click Sign on.
5. Under "SIGN ON METHODS", click View Setup Instructions.
6. Enable and test SAML SSO on GitHub using the sign on URL, issuer URL, and public certificates from the "How to Configure SAML 2.0" guide. For more information, see "Enabling and testing SAML single sign-on for your organization."

Configuring access provisioning with SCIM in Okta

1. In the Okta Dashboard, click Applications.

2. In the list of applications, click the label for the application you created for the organization that uses GitHub Enterprise Cloud.

3. Under the name of the application, click Provisioning.

4. Click Configure API Integration.

5. Select Enable API integration.

6. Click Authenticate with Github Enterprise Cloud - Organization.

7. To the right of your organization's name, click Grant.

   Note: If you don't see your organization in the list, go to https://github.com/orgs/ORGANIZATION-NAME/sso in your browser and authenticate with your organization via SAML SSO using your administrator account on the IdP. For example, if your organization's name is octo-org, the URL would be https://github.com/orgs/octo-org/sso. For more information, see "About authentication with SAML single sign-on."

8. Click Authorize OktaOAN.

9. Click Save.

10. To the right of "Provisioning to App", click Edit.

11. To the right of "Create Users", select Enable.

12. To the right of "Update User Attributes", select Enable.

13. To the right of "Deactivate Users", select Enable.

14. Click Save.

Further reading

• "Configuring SAML single sign-on for your enterprise account using Okta"
• "Managing team synchronization for your organization"
• Understanding SAML in the Okta documentation
• Understanding SCIM in the Okta documentation