Configuring SAML single sign-on for your enterprise account using Okta

About SAML with Okta

You can control access to your enterprise account in GitHub and other web applications from one central interface by configuring the enterprise account to use SAML SSO with Okta, an Identity Provider (IdP).

SAML SSO controls and secures access to enterprise account resources like organizations, repositories, issues, and pull requests. For more information, see "Enforcing SAML single sign-on for organizations in your enterprise account."

Prerequisites

You must use the "Classic UI" in Okta. For more information, see Organized Navigation on the Okta blog.

Adding the GitHub Enterprise Cloud application in Okta

1. In Okta, in the upper-right corner, click Admin.
2. In the Okta Dashboard, click Applications.
3. Click Add application.
4. In the search field, type "GitHub Enterprise Cloud".
5. Click "GitHub Enterprise Cloud - Enterprise Accounts".
6. Click Add.
7. Optionally, to the right of "Application label", type a descriptive name for the application.
8. To the right of "GitHub Enterprises", type the name of your enterprise account. For example, if your enterprise account's URL is https://github.com/enterprises/octo-corp, type octo-corp.
9. Click Done.

Enabling and testing SAML SSO

1. In Okta, in the upper-right corner, click Admin.
2. In the Okta Dashboard, click Applications.
3. Click the label for the application you created for your enterprise account.
4. Assign the application to your user in Okta. For more information, see Assign applications to users in the Okta documentation.
5. Under the name of the application, click Sign on.
6. To the right of Settings, click Edit.
7. Under "Configured SAML Attributes", to the right of "groups", use the drop-down menu and select Matches regex.
8. To the right of the drop-down menu, type .*.*.
9. Click Save.
10. Under "SIGN ON METHODS", click View Setup Instructions.
11. Enable SAML for your enterprise account using the information in the setup instructions. For more information, see "Enforcing SAML single sign-on for organizations in your enterprise account."

Creating groups in Okta

1. In Okta, create a group to match each organization owned by your enterprise account. The name of each group must match the account name of the organization (not the organization's display name). For example, if the URL of the organization is https://github.com/octo-org, name the group octo-org.
2. Assign the application you created for your enterprise account to each group. GitHub will receive all groups data for each user.
3. Add users to groups based on the organizations you'd like users to belong to.

Enabling SAML user provisioning

1. In the top-right corner of GitHub, click your profile photo, then click Your enterprises.

2. In the list of enterprises, click the enterprise you want to view.

3. In the enterprise account sidebar, click Settings.

4. In the left sidebar, click Security.

5. Under "SAML User Provisioning", select Enable SAML user provisioning.

6. Click Save.

7. Optionally, enable SAML user deprovisioning.

   • Select Enable SAML user deprovisioning, then click Save.
   • Read the warning, then click Enable SAML deprovisioning.