►
From YouTube: Demo Days - Securing your organization
Description
Niels Pineda, Sarah Khalife and Senna Parsa, Solutions Engineers, explore security issues in your organization, and the balance of accessibility and controls. Enable SAML SSO in under a minute, and walk through steps to prevent unauthorized access without compromising your ability to collaborate.
Learn more about Security here: https://github.com/learn/security
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
Google+: http://google.com/+github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
Cool
welcome
everyone,
and
thanks
for
joining
us
good
morning,
good
afternoon,
if
it's
good
enough,
if
it's
good
evening,
thanks
especially
for
coming
on
a
friday
night,
that's
an
interesting
time
to
be
watching
github
stuff
but
yeah.
No,
so
I'm
excited
to
kind
of
talk
to
you
to
you
guys
more
about
just
general
github
security
stuff
and
how
you
could
best
secure
your
organization
or
enterprise
account.
A
You
know
I
would
love
to
kind
of
get
to
know
who's
joining
us
and
I
see
there's
some
good
chats
going
on
people
just
having
basic
introductions
so
yeah.
We
would
love
to
see
where
you
guys
are
calling
in
from
and
kind
of
just
twitching
in
from,
if
that's
the
thing
but
yeah.
Besides
that,
you
know,
we
feel
free
to
interrupt
us
at
any
time
with
questions
and-
and
we
have
some
good
people
here
today
to
kind
of
talk
through
things.
A
So
with
that
in
mind,
I
kind
of
wanted
to
just
start
off
with
some
introductions
on
our
end.
So
you
know
who
you
know
you're
ultimately
listening
to
for
the
next
45
minutes
to
an
hour
cool
awesome,
so
everyone
can
see
it.
I
hope
I
mean
yeah,
I'm
just
going
to
go
with
that
cool.
So
hey
everyone,
my
name
is
niels
pineda,
and
so
you
might
be
wondering
who
exactly?
A
A
You
know
kind
of
talking
more
about
the
analytics
that
the
statistics
kind
of
all
that
good
stuff
and
so
two
on
three
hoops
is
actually
a
blog
that
I'm
a
part
of
for
the
clippers
nation,
and
I
actually
designed
this
logo,
which
I'd
like
to
think
is
pretty
cool,
so
kind
of
in
line
with
that
passion.
One
thing
that
it
did
cause
a
problem
besides,
multiple
dislocated
knees,
unfortunately,
is
some-
would
call
it
an
addiction.
I
call
it
a
hobby
but
yeah.
A
I
got
really
into
the
sneaker
game,
I'm
a
bit
of
a
sneaker
head.
I
love
kind
of
just
getting
whatever,
I
think
looks
good,
but
you
know
I
got
this
nice
collection
and
then
one
of
kind
of
the
bigger
problems
that
came
about
after
I
got
this
nice
collection,
her
name's,
actually
kona,
and
so
I
adopted
I,
I
rescued
this
dog
she's
super
super
kind,
but
she's
also
kind
of
the
troublemaker
and
kind
of
a
problem,
and
so
I
thought
these
pictures
did
a
good
job.
A
You
know
what
your
passions
are.
Why
you're
joining
us,
you
know.
Are
you
very
interested
in
security?
Are
you
just
kind
of
obligated
to
because
you're
a
employee
of
github
trying
to
boost
the
numbers,
but
you
know
whatever
it
is?
I
would
love
to
kind
of
hear
it
in
the
chat
and
from
there
I
will
let
sarah
and
zen
introduce
themselves.
B
B
Obviously
not
the
bestest
twitch
right
here
anyway,
so
so,
to
give
you
a
little
bit
of
background
about
myself,
I'm
originally
from
cypress
in
lebanon,
so
you
can
see
a
couple
pictures
there
for
me
in
cyprus
and
lebanon.
That
middle
picture
is
me
of
the
is
my
favorite
spot
in
cyprus.
It's
this
place
called
cape
greco.
It
has
a
really
cool,
like
cool
cave,
that
you
can
go
climb
under
or
you
can
go
cliff
jumping
into
beautiful
blue
waters,
as
you
can
see.
B
Well,
so
what
have
I
been
doing
during
quarantine?
So
if
you
can
scroll
down
a
little
bit
niels,
I've
been
doing
a
lot
of
things.
I've
been
trying
to
keep
myself
busy,
have
really
tried
to
embrace
the
quarantine
life
of
making
bread.
As
you
can
see
in
that
middle
picture,
almost
everybody
and
their
cousins
have
made
bread
over
the
past
couple
of
months.
B
Every
time
I
try
to
go
to
a
safeway
or
to
somewhere
to
buy
some
flour,
it's
always
out.
So
I've
also
joined
the
train
of
making
bread
in
the
past
couple
days.
Actually,
the
past
week,
I've
done
a
couple
of
the
things
that
I
haven't
done
before.
Yesterday
we
had
an
awesome
cooking
class
and
I
made
ceviche
peruvian
ceviche
for
the
first
time
which
was
delicious
and
then
last
week
we
are
well
not
not
last
week,
but
in
the
next
month
we
will
be
presenting
a
kubecon
I'll
be
presenting
at
kubecon.
B
You
guys
should
check
it
out
august
19th,
kindly
validating
your
kubernetes
application,
so
check
it
out
on
kubecon,
and
that's
it
about
me
for
right
now,
but
I
wanted
to
share
some
awesome
news
that
I
just
found
out
pretty
much
this
last
week
that
github
sponsors-
I
don't
know
if
you
had
heard
of
github
sponsors.
Let
me
know
if
you
haven't,
we
can
give
a
quick
overview
and
I
can
send
some
awesome
links,
but
github
sponsors
is
now
sponsoring
people
in
malta
and
cypress
and
34
other
countries.
B
If
you
are
an
open
source
developer,
if
you
are
a
maintainer
of
an
open
source
project
and
have
been
contributing
to
the
open
source
world,
this
is
a
way
that
you
can
get
a
little
bit
of
help
to
maintain
that
open
source
project
that
you've
been
doing
so
check
it
out,
especially
if
you're
in
cyprus
or
malta
or
any
of
the
34
other
regions
that
we
cover.
Definitely
an
interesting
way
to
you
know,
get
a
little
help
on
the
side,
and
that's
it
from
me
so
I'll
pass
it
over
to
senna.
C
Thanks,
sarah,
hey
everyone:
I'm
senna,
I'm
also
a
solutions
engineer
here
at
github,
sarah
and
niels
and
I
kind
of
started
around
the
same
time.
So
it's
been
really
fun
hanging
out
with
them,
but
yeah
just
a
little
bit
about
me.
I
really
like
photography.
I
I
haven't
been
able
to
do
that
a
lot
so
far
since
I've
been
in
quarantine,
but
in
particular
I
have.
C
I
have
family
in
turkey,
so
I
really
like
going
there
and
photographing
like
street
cats
and
street
dogs,
and
this
is
just
a
kitten
that
my
grandmother
was
taking
care
of.
So
that's
one
of
my
favorite
cats,
I've
ever
kind
of
like
taken
care
of.
So
that's
one
of
my
photos
and
if
you
scroll
down
a
little
bit
neil's,
I
also
you
know.
Since
I've
been
spending
a
lot
of
time
at
home,
I've
I've
bought
a
few
calatheas.
C
C
So
a
lot
of
the
time
I
spend
is
yeah
taking
care
of
my
plants
talking
to
them
and
making
sure
they
grow
healthy,
and
the
other
thing
that
I
spend
a
lot
of
time
doing
is
riding
my
bike.
So
if
you
scroll
down
a
little
bit,
I'm
I'm
also
based
in
san
francisco,
and
this
is
a
really
popular
route
in
the
marid
headlands
right
across
the
golden
gate
bridge.
It's
called
hawk
hill,
so
yeah,
that's
really
something.
I've
been.
C
C
A
C
A
If
more
people
are
shuffling
in
or
you
know,
12
or
13
minutes
late,
which
is
fine,
is
actually
github
came
out
with
something
really
awesome
this
week
and
it's
actually
the
github
public
roadmap,
and
so
this
is
one
thing
where
you're
actually
able
to
really
see
kind
of
what
github
has
their
focus
on
and
what
they're
going
down
the
line
with,
and
so
here's
a
kind
of
read
me
outlining
how
you
could
kind
of
better
read
it.
I
think
it's
pretty
self-explanatory,
so
we
could
kind
of
just
jump
into
the
meat
of
things.
A
You're
going
to
be
able
to
see
all
the
different
things
that
we
have
in
the
roadmap,
whether
they're
going
to
be
beta,
alpha,
ga
kind
of
what
they're
touching
on,
and
so,
if
you're
interested
in
security
and
compliance
like
I'm,
I'm
guessing
you
are
for
being
in
this
talk,
you
could
click,
it
filter
it
out
and
see
the
general
ship
date
that
kind
of
we're
hoping
to
have
delivered
on,
and
obviously
it's
one
thing
to
be
able
to
kind
of
look
and
understand.
Okay,
these
sound
cool,
but
I
want
more
information.
A
Each
one
of
these
actually
has
its
own
issue.
That
kind
of
speaks
more
to
what
it's
going
to
look
like
what
the
intended
outcome
and
use
case
are,
and
just
a
general
summary,
and
so
I
think
this
is
all
really
exciting
stuff
that
you
know
we're
just
kind
of
sharing
what
we're
focusing
on,
and
so
I
highly
recommend
you
guys
go
kind
of
through
this.
Try
to
understand
if
there's
anything
that
excites
you
that
you
want
to
kind
of
reach
out
to
account
managers
or
just
people
like
myself,
santa
and
sarah
about.
B
A
Yep
cool,
and
so
I
guess
we
could
kind
of
start
going
a
little
bit
more
into
security.
What
I
assume
you
got,
what
everyone
came
for,
and
so
I'm
actually
gonna
start
this
kind
of
in
one
of
my
kind
of
sandbox
environments,
and
so
this
is
my
sandbox
enterprise
account,
and
you
know
one
of
the
ones
that
I
really
wanted
to
use.
This
is
a
use
case
for
to
try
to
make
it
seem
a
little
bit
more
exciting
and
relatable.
A
It's
actually
an
establishment
and
business
that
really
taught
me
about
sales
and
also
the
importance
of
securing
very
specific
secret
information,
and
that
is
actually
the
krusty
krab.
And
so
I
was
a
big
spongebob
fan
and
for
all
of
you
fans
out
there,
I
guess
non-fans
as
well.
So
it's
basically
a
restaurant,
that's
in
bikini
bottom
and
they
have
a
big
competition
with
the
rivalry,
and
so
the
rival
restaurant
is
always
trying
to
steal
their
secret
formula,
which
we
hosted
here.
We're
not
actually
gonna.
A
A
Sorry
if
I'm
being
cocky
but
obviously
bikini
bottom
is
also
taking
covered
seriously
where
masks
are
required,
but
you
could
also
order
things
with
scuba
eats
and
coast
mates.
You
have
a
little
bit
more
information
and
me
trying
to
better
understand.
You
know
how
you
can
bring
in
more
business
to
a
more
old-fashioned
restaurant,
I've
traveled
a
lot.
I've
been
to
a
lot
of
new
kind
of
cool,
eateries
and
stuff,
and
over
here
I
tried
to
add
it.
A
A
Let's
start
going
into
settings
and
just
going
into
kind
of
one
of
the
basic
things
that
is
going
to
be
necessary
and
it's
going
to
be
organization,
security
and
so
there's
more
or
less.
You
know
two
very
basic
things
that
you
could
set
up
the
first
one's
two-factor
authentication,
and
this
is
interesting
because
what
it
does
is
when
you
require
2fa
for
everyone
in
the
krusty
krab
org.
A
It's
gonna
ask
me
for
my
second
factor
authentication,
but
what
I
kind
of
wanted
to
focus
a
little
bit
more
today,
because
it's
probably
the
biggest
ask
that
we've
seen-
and
this
is
what
you
get
with
enterprise
security
is
saml
single
sign-on
and
so
for
the
most
part,
when
you're,
integrating
with
added
identity
providers
in
the
cloud
whether
it
be
octa
one
login.
You
just
want
this
next
level
of
authentication
to
ensure
that
the
person
who's
going
through
and
signing
onto
github
is
actually
a
member
of
that
organization.
A
Similarly,
if
you're
doing
an
on-prem
deployment
of
github,
it's
going
to
be
it's
going
to
be
with
most
likely
like
active
directory
and
ldap,
which
we
also
support-
and
you
know
that's
something
you
guys
are
interested
in
for
another
demo
day.
Please
shout
it
out
in
the
chat
and
we're
happy
to
kind
of
go
through
that
flow
as
well,
but
today
we'll
be
focusing
on
saml
authentication,
cool
santa
sarah
anything
you
think
I've
I've
missed
so
far
before
I
jump
into
it
a
little
bit
more.
A
Cool
so
let's
go
in
and
when
you
click
enable
saml
authentication,
it's
only
going
to
need
three
fields
that
you
have
to
fill
in,
and
so
I'm
going
to
go
ahead
and
go
to
my
dev
instance
of
octa.
Just
because
that's
what
I've
played
around
with
a
bit
more
but,
like
I
said
as
long
as
it's
a
sample
2.0
provider,
this
workflow
should
more
or
less
be
the
same
of
just
grabbing
a
sign
on
url,
an
issuer
or
and
your
public
certificate,
and
so
I'm
going
to
start
completely
from
scratch.
A
So
you
could
see
how
pretty
efficient
this
integration
is,
and
so
I'll
go
ahead
to
my
applications.
You
can
see
that
I
have
a
couple
of
ones
that
are
standing
up
already.
You
know
just
in
case
something
went
wrong
in
this
demo,
have
some
backup
plans,
and
so
I'm
going
to
go
ahead
and
add
an
application
and
what's
nice
is
github
actually
has
native
applications
that
are
already
in
with
that
are
already
in
the
octa
gallery.
A
And
so
you
could
see
kind
of
the
three
layers
that
you're
able
to
integrate
with
would
be
the
github
enterprise
cloud
organization
which
we're
doing
right
now.
The
enterprise
account,
which
was
the
first
page,
that
I
showed
you
and
I'll
be
able
to
kind
of
talk
through
that
a
little
bit
more
at
the
end
of
things
and
then
also
server,
and
so
I
mentioned
before
a
lot
of
times.
A
A
This
is
where
it's
actually
important
to
get
the
naming
convention
right.
You
want
to
make
sure
that
this
is
exactly
what
the
github
organization
is
called
and
spelled.
I
don't
believe
it's
case
sensitive,
but
realistically,
why
not
just
make
it
case
sensitive
or
make
it
appropriate
so
I'll
go
ahead
and
add
this
so
crestview
crab
sso
is
online.
Obviously,
there's
no
integration,
yet
nothing
was
stored
between
the
two
of
them,
and
so
I'm
gonna
go
ahead
and
add
that
integration
right
now,
where
I
view
the
setup
instructions
and
so
to
go
a
little
slower.
A
C
A
And
I
know
it's
not
best
practice
to
be
showing
my
certificates
and
whatnot
here
I
will
roll
these
later
so
I'll.
Add
these
in
and
I'll
want
to
test
it
and
I'm
not
sure
if
anyone
caught
it,
but
you
know
I'd
love
to
know
if
anyone
caught
and
could
say
what
did
I
mess
up
on,
and
why
is
this
going
to
fail?
Let's
go
ahead
and
test
it
and
you're
going
to
see
that
I
don't
actually
have
access
to
crust
crab
sso
because
I'm
not
assigned
this
application.
A
So
I've
done
this
hundreds
of
times
when
I've
just
been
messing
around
with
this
and
trying
to
play
around
with
things.
Unfortunately,
it's
not
cached,
but
let's
go
back
quick
step
and
you
could
actually
see
an
assignment.
All
I
have
to
do
is
assign
it
to
my
account
that
I'm
logged
into
which
my
account
is
this
neospinata
f1.
A
In
hope
that
this
time,
when
I
test
it,
it
doesn't
fail
and
cool
there
we
go,
and
so
in
this
case,
once
I
save
this,
we
have
single
sign-on
enabled
and
that
honestly
took
what
like
45
seconds.
Assuming
I
didn't
make
the
mistake
at
the
beginning,
and
so
it's
pretty
easy.
That
being
said,
it's
not
everything.
A
Right
now
and
you
might
be
asking-
why
is
that
the
case
and
the
reason
that
that's
the
case
is
because
if
I
actually
let
me
go
ahead
and
authenticate
with
it
and
actually
explicitly
tie
in
my
single
sign-on
identity,
if
I
want
to
require
it
you're
going
to
see
that
it's
actually
gonna
kick
members
out
of
the
organization,
which
is
obviously
not
ideal.
If
you
start
out
with
that
and
then
just
kick
everyone
out,
and
so
typically
what
we
see
is
you
know
the
admin
is
going
to
ultimately
add
in
the
enablement
of
single
sign-on.
A
Let
his
employees
and
let
his
co-workers
know
that
it's
going
to
eventually
kick
them
out
and
then,
if
it
goes
poorly,
then
they
will
have
to
just
basically
go
through
that
offload,
but
if
they
enable
it
and
they
link
their
saml
identity,
then
there's
not
going
to
be
any
problem
here
and
so
sarah,
I
know
I'm
about
to
pass
it
to
you.
Are
you
good
to
go
with
me
with
me?
Kicking
you
out
of
the
idp.
B
A
Yeah
yeah,
it's
the
exact
same
thing.
It
was
the
same
issue
that
I
hit
initially,
which
would
be
to
assign
the
specific
person,
and
so
in
this
case
you
know
sarah's
already
in
in
it,
and
so
I'm
going
to
add
it
to
her
so
that
she
could
so
that
she
could
authenticate
her
account
with
the
idp.
And
so
again
it's
pretty
simple,
especially
if
you
already
have
user
groups
that
exist
within
octa.
It
just
becomes
easier
where
you
could
assign
based
on
group.
A
One
of
the
other
nice
things
for
sign
on
as
well
is
that
you
could
leverage
whatever
additional
sign-on
methodologies
and
requirements
and
policies
that
your
idp
uses,
and
so
in
this
case,
like
with
octa
and
again,
I
think
most
idps.
You
could
have
ip
zones
you
could
have
based
on
geography
and
so,
if
you're,
within
a
certain
location
that
has
to
allow
you
to
authenticate
and
so
you're
able
to
kind
of
complement
both
systems
by
by
adding
the
two
on,
and
so
with
that
in
mind,
sir,
are
you
good?
Have
you
authenticated
everything.
B
B
Awesome
oops,
let
me
pull
it
up
all
right,
so
I'll
wait!
A
second
till
my
screen,
loads,
sweet,
so
niels.
I
think
you
forgot
something.
I
think
you
didn't
realize
that
the
sample
session
is
24
hours,
so
I
still
have
access
because
you
didn't
remove
me
from
my
enterprise
org.
So
thanks
so
much
for
removing
me
from
github
from
removing
me
from
your
sso,
but
I
think
I'm
gonna
take
my
code
with
me.
So
let
me
see
what
I
can
do
now
that
I
still
have
access,
because
my
sample
session
still
didn't
expire
sweet.
B
B
So
I
think
I'm
going
to
take
the
code
with
me.
What
do
you
think
I
I
deserve
to
work
on?
I
deserve
to
take
the
code
with
me
because
I
deserved.
I
worked
on
it
so
much
and
it's
all
the
stuff
that
I've
worked
on.
So
why
should
nils
and
krusty
krab
corporation
own?
It.
That's
not
fair.
So,
let's
change
this
visibility,
make
it
private
and
then
rename
and
then
once
I
make
it
private,
I
think
I
can
transfer
it
over
to
a
new
super
secret
repository.
B
I
mean
super
secret
organization.
Oh,
if
I
could
type
my
password
correctly,
then
I
can
steal
the
code,
all
right,
oh
sweet,
so
I
changed
the
repository
visibility.
I'm
able
now
to
transfer
the
ownership
and
I'm
able
to
archive
it
and
even
delete
the
repository.
Well,
what
niels
didn't
realize
is
that
I,
the
saml
session's
active-
and
I
was
an
admin
before
and
I
had
all
these
capabilities
beforehand.
B
So,
since
the
admin
since
the
saml
session
was
still
active,
I
can't
I
can
still
do
a
lot
of
the
things
that
I
could
do,
even
though
he
removed
me
from
the
sso,
because
I
didn't
have
to
go
through
the
sso
flow
again.
I
didn't
have
to
re-authenticate,
so
github
still
doesn't
know
because
there's
no
communication
between
after
you
go
through
that
sso
original
communication.
B
B
B
No,
they
will
they're,
just
gonna
have
better
ones.
So
what
did
meals
do?
What
did
nils
forget?
Can
anybody,
let
us
know
in
the
chat
in
the
meantime,
let's
rewind,
I'm
gonna
give
this
back
to
neil.
So
then
he
can
figure
out
how
he
can
actually
fix
his
organization
to
make
it
more
secure
but
still
allow
for
collaboration.
B
A
Cool
so
yeah,
I
have
it
back
now.
Thankfully
I
made
a
quick
commit,
so
I
hope
that
it's
back
up
and
running
because
yeah
there
you
go
so
it's
back
up
and
running
things,
look
good
and
so
yeah.
The
question
goes:
you
know
what
what
was
the
problem?
What
could
I
have
done?
Better?
I'm
not
trying
to
say
get
them.
Securing
the
organization
isn't
great
up
front.
A
But
the
provisioning
piece
is
so
that
that
workflow,
that
you
have
when
you
remove
someone
from
the
organization
or
you
remove
them
from
workday
or
whatever
it
is
also
takes
them
out
of
their
specific
service
provider
application,
and
so
you
could
see
you
know
with
sarah.
One
of
the
problems
was
that
she
did
have
her
sam
linked
identity
and
she
did
have
an
active
session
as
well,
and
so
that's
something
that's
actually
determined
by
a
token
from
the
identity
provider
is
how
long
this
session's
gonna
last
some
of
them.
A
Let
you
edit
it
some
of
them
won't,
and
so
it's
completely
up
to
that.
Octas
is
by
default
24
hours
and
they
don't
actually
let
you
change
that.
So
one
of
the
things
I
could
have
done,
but
if
I
was,
if
I
was
knowledgeable
enough
to
do
this,
I
could
have
done
something
even
better.
I
could
have
gone
ahead
and
revoked
her
saml
session
and
that
would
have
basically
said:
okay,
she's
now
not
able
to
authenticate,
and
so
even
if
she
was
still
lingering
in
the
org,
but
I
had
required
single
sign-on.
A
A
Sometimes
this
could
be
a
little
bit
flimsy
if
I
do
it
as
many
times
as
I
have,
which
I've
probably
made
this
integration
hundreds
of
times
looks
like
it
was
perfect
this
time
I
take
back
what
I
said:
it's
an
absolutely
perfect
integration,
don't
question
it,
and
so
I'll
go
ahead
and
save
it
and
from
there
it's
gonna.
Ask
you
what
what
do
you
want
to
allow
in
this
provisioning
aspect
of
it
because
ultimately,
what's
happening?
Is
leveraging
github
apis
to
be
able
to
create
a
user
update,
their
attributes
or
deactivate
them?
A
And
so
in
this
case
I
could
go
ahead
and
save
it
and
what's
going
to
happen,
is
if
I
go
to
assignments
and
now
you'll
see
over
here.
Let's
just
make
sure
you
know,
I'm
not
cheating
you
or
anything.
You
could
go
ahead,
see
that
there's
no
pending
invites.
I
will
now
assign
it
to
sarah
again
and
you
will
see
hopefully.
A
That
there
is
a
pending
invite
now
to
askcliffe
github.com,
and
so
one
thing
I
want,
I
also
want
to
establish,
is
kind
of
what
is
being
stored
and,
what's
being
understood
on
both
sides,
and
so
on
the
sso
side.
On
the
identity
provider
side
there
is
no
concept
of
a
github
handle
or
an
account,
it's
just
the
name
id,
and
so,
when
you
send
an
invite,
it's
either
gonna
go
to
the
name
id
or
depending
on
your
settings.
A
A
This
is
her
account
and
we're
storing
her
name
id
with
her
get
up
handle,
and
so,
if
I
go
to
manage,
I
will
be
able
to
see
her
sam
linked
identity
as
well
as
her
scheme
identity,
and
so
you
could
see
this
is
the
name
id
I
can
revoke
it.
If
I
want
like
I
did
before,
as
well
as
the
different
information
that
I
have
on
her,
and
so
this
is
actually
something
really
important.
A
This
is
something
that
we
view
as
enterprise
or
organization
level
information,
because
it
is
tied
to
your
enterprise,
owned
identity
provider
and
so
from
there
you're
able
to
actually
pull
the
username
along
with
what
their
saml
name
id
and
scheme
identity
are,
which
are
almost
always
email
addresses
and
they're,
usually
the
ones
that
you're
going
to
hold
within
the
enterprise
account,
and
so
that's
something.
That's
super
easy
to
do.
There's
actually
a
really
cool
open
source,
gist
that
kind
of
goes
over.
A
B
Yeah,
I
wanted
to
say
that
this
is
awesome,
because
it
automatically
allows
you
to
manage
this,
manage
your
user
base
so
automatically
provisioning
automatic
provisioning.
If
you
they're
part
of
the
sso
and
you
have
the
skim
automation
already
configured,
that's
not
only
with
octa,
that's
with
other
idps
as
well.
It
just
makes
your
life
easier
as
an
admin
or
as
an
operations
lead
and
as
well
as
from
the
security
side.
Because
then
you
know,
whoever
has
access
to
org
is
part
of
your
sso.
A
B
A
A
A
I
will
say
that
natively
skim
is
available,
for,
I
believe,
octa
one
login
and
azure
ad,
but
at
the
same
time
we
understand
how
important
this
is,
and
so
we
actually
have
a
skim
api
that
you
could
then
build
additional
integrations
if
you're
using
ping
or
some
other
open
source
identity
provider
and,
of
course,
on
on
all
of
this.
You
know
I
did
mention
before
the
only
reason
sarah
was
able
to
do.
A
This
was
because
there
were
very
specific
policies
that
were
actually
not
default
in
place
that
I
had
allowed
for
her
to
happen,
and
it
just
kind
of
shows
the
importance
of
those,
and
so
I
do
want
to
go
over
a
couple
of
policies,
but
before
I
wrap
up
kind
of
the
conversation
on
enterprise,
org
level
scheme
and
sso
santa,
were
there
any
questions
or
sarah
was
there
anything?
You
think
I
missed.
C
C
A
A
A
And
you
need
to
be
able
to
log
in
where
it's
going
to
be
protected,
essentially,
is
actually
at
the
enterprise
account
or
enterprise
org
level,
and
so
you're
still
going
to
sign
on
as
normal.
So
you
could
contribute
to
whatever
open
source
documents
that
you
want
or
open
source
projects
that
you
want.
A
I
should
say,
but
if
you
now
want
to
go
into
the
krusty
krab,
if
you
want
to
go
to
your
overall
enterprise
protected
resources,
that's
when
you're
going
to
have
to
do
single
sign-on,
and
so
it's
protecting
the
enterprise
without
stopping
you
or
getting
in
your
way
or
adding
additional
steps.
If
you're
looking
to
sign
on
to
github,
just
to
start
contributing
to
open
source
projects,.
A
Yeah
going
from
there,
the
next
thing
that
I
did
want
to
go
over
were
those
policies
that
I
I
put
in
place
to
allow
sarah
to
do
that,
and
so
you
know
it
might
not
seem
like
a
big
deal
to
go
over
when
you
first
started.
But
this
is
honestly
where
I
personally
recommend
everyone
who's.
You
know,
starting
up
an
enterprise
or
enterprise
account
to
look
at
they're,
only
a
handful
of
ones,
but
they're
all
super
important,
and
so
it
starts
with
base
permissions.
A
So
what
are
the
base
permissions
for
people
who
enter
the
organization
to
see
what
repository
visibility
they
have?
The
next
one
is
going
to
be
repository
creation,
and
so
this
is
actually
a
really
interesting
one,
because
I
would
say
this
is
where
you
know
accidents
happen
for
the
most
part,
is
you
know
you
might
be
an
open
source
developer,
like
I
mentioned
before,
and
also
working
for
an
enterprise,
and
maybe
you
make
a
repository
and
you
accidentally
make
it
public
instead
of
private,
when
you
shouldn't
have,
and
so,
if
I
go
start
here.
A
If
I
go
to,
let's
go
to
github
and
start
a
and
make
a
new
repository,
you'll
actually
see
now
the
default's
private
and
that's
actually
gonna
be
different
for
a
lot
of
people
potentially
on
this
call
or
on
this
twitch
stream,
I
should
say,
is
github
actually
just
shipped
this
really
cool
feature.
I
mean
it
may
seem
subtle,
but
I
think
it's
really
important
if
you
have
a
saml
single
sign-on,
linked
identity
and
an
active
saml
session
on
what
it's
going
to
do,
is
it's
going
to
change
your
default
repository
to
private?
A
So
in
that
case,
in
the
event
that
you
know
you
are
making
something
sensitive
for
your
organization
and
you
kind
of
just
forget,
and
it's
default
public.
It's
now
going
to
be
private,
and
so
it
just
gives
that
added
layer
of
kind
of
like
data
protection
that
you
don't
make
those
make
those
mistakes
going
down
and
kind
of
focusing
on
other
ones.
These
are
all
ones
that
I
highly
considered
just
to
think
about
again.
B
A
This
is
going
to
make
a
global
setting
that
goes
downstream
to
all
of
the
organizations
that
you
could
find
within
your
enterprise
account
in
this
case
by
18,
including
the
crusted
crab.
So
now,
if
you
go
to
member
privileges,
it's
going
to
set
them
and
say
that
you
are
not
allowed
to
actually
change
these
permissions
at
a
lower
at
this
level,
because
they're
determined
at
the
ea,
and
so
that's
where
I
think
a
lot
of
the
discussion
could
go.
Is
you
know
what
settings
do
you
want
at?
A
You
could
actually
do
sso
at
the
enterprise
account
level
as
well,
where
you
enable
saml
authentication,
I
mean
we
have
16
minutes,
and
so
let
me
just
do
that
really
quick,
because
it's
pretty
straightforward
in
this
case,
I
already
have
my
enterprise
cloud
account
set
up
again.
It's
just
choosing
the
different
tile
and
when
you
go
to
sign
on
it's
literally
the
same.
A
A
A
And
from
there
yeah
now
it's
going
to
protect
all
of
the
organizations
it
asked
me
to
authenticate
before,
but
I
was
already
signed
in
and
this
is
going
to
go
downstream
to
all
of
the
organizations
that
exist
in
this
case
I'll
disable
it.
You
guys,
saw
my
recovery
codes
anyways,
but
yeah.
So
with
that
in
mind,
that's
largely
what
I
wanted
to
go
over
for
like
sso
and
policies.
A
There's
no
questions
on
that
kind
of
the
last
place
that
I
wanted
to
point
to,
and
I
know
sarah
has
a
lot
more
knowledge
on
on
this
kind
of
stuff,
because
her
background
and
her
kind
of
skills
and
automation
is
going
to
be
the
audit
log.
So
I'll.
Let
her
kind
of
talk
a
little
bit
more
to
the
to
the
audit
log
at
the
ea
level
and
the
org
level.
B
Yeah
thanks
thanks
niels,
so
who
here
has
actually
looked
through
the
audit
log,
if
you're
an
enterprise
owner
or
an
org
owner,
you
can
see
an
audit
log
across
your
enterprise
and
across
your
org.
So
this
is
the
enterprise
view
that
niels
is
showing
right
now.
What's
really
really
awesome
about
this.
Is
that
these
the
enterprise
that
niels
has
has
multiple
organizations,
and
these
orgs
can
be.
B
You
know
coming
in
from
people
that
have
been
acquired
or
say
you're
a
large
corporation,
and
you
have
you
know
transportation,
aviation,
healthcare
divisions
and
you
don't
want
everybody
to
be
in
the
exact
same
org.
Well,
this
umbrella
enterprise
allows
you
to
put
all
these
orgs
and
associate
them
to
one
enterprise.
Well,
how
do
you
monitor
across
all
of
that?
Well,
this
audit
log
really
gets
into
the
more
details
of
what's
happening
at
each.
You
know
at
each
event,
all
of
these
events
are
great
to
see
and
you
can
search
across
it.
B
B
What's
really
good
about
this
is
that
you
can
grab
all
that
information
and
if
we
want
to
just
jump
into
the
org
level
audit
log
as
well
so
a
lot
of
the
times,
not
everybody
can
access
the
enterprise
audit
log
because
that
might
be
owned
by
corporate.
But
then
your
organization
is
where
you
want
to
find
specifics
to
your
org
and
what's
happening
across
that
part
of
the
that
part
of
the
enterprise.
I
guess
in
this
case
you
can
again
look
through
very
similar
things.
B
All
that's
all
the
github
events
that
we
track
are
all
going
to
be
here.
You
can
search
amongst
them.
You
can
find
when
repos
are
deleted,
created
and
so
forth.
Well,
what's
really
really
awesome
about
this
is
that
you
can
take
this
information,
because
we
have
an
audit
log
api
and
create
automation
around
it.
With
that
automation,
you
don't
have
to
worry
about
every
single
time.
B
You
have
to
make
sure
that
you're
monitoring
by
you
know
hand
and
manually
to
check
if
somebody
deleted
a
repo
or
transfer
to
repo,
like
I
did
to
nils
earlier,
you
could
have
actually
gone
to
this
organization
level
or
enterprise
level
audit
log
and
see
that
I
removed
or
like
niels
removed
me
as
a
member,
or
I
moved
the
repo
and
transferred
to
somewhere
else.
You
can
track
all
of
that,
and
once
you
can
get
that
information,
that
means
you
can
automate
this.
B
So
if
there's
any
type
of
events
that
you
want
to
trigger,
you
can
do
that
with
the
audit
log
api.
Well,
the
other
thing
that
you
can
use
to
do
that
and
that's
been
recently
announced
over
the
past
year
is
github
actions.
All
of
these
are
github
events.
So,
if
you
want
something
to
happen
on
a
specific
event,
for
example,
you
want
to
make
sure
that
whenever
there's
a
visibility
change
across
your
repository,
you
can
create
an
action
that
allows
you
to
track
that
and
say
hey
when
the
visibility
change
happens.
B
B
And
lastly,
because
automation
is
cool
when
you
can
just
read
through
things,
what
really
is
helpful
is
type
of
all
the
other
types
of
integrations
that
exist
out
there.
So
terraform
there's
a
terraform
provider
that
actually
works
with
github.
It's
called
the
github
terraform
provider,
and
I
know
a
lot
of
people
have
terraform,
especially
code,
sorry
configures
code.
So
you
don't
have
to
manage
a
lot
of
your.
You
know
configuration
back
manually
every
single
time
and
then
not
be
able
to
track
the
changes.
B
So
all
of
that
really
boils
down
to
niels
is
awesome
at
securing
the
organization
and
he
did
a
better
job.
The
second
time
around
after
he
learned
his
lesson
the
first
time,
but
you
don't
want
to
do
this
manually
every
single
time
you
want
to
maybe
run
through
it
a
couple
of
times
to
figure
out
what
the
changes.
What
what
are
some
of
the
changes
you
want,
but
then
there's
tools
that
help
you
automate
to
see.
If
this
these
changes
did
happen,
there's
tools
that
help
you
automate
how
to
configure
your.
B
A
Yeah
and
on
top
of
that,
if
there's
specific
feedback,
obviously
we're
happy
to
do
that.
If
there's
any
specific
topics,
you
want
to
go
over
more
in
depth.
We're
looking
for
more
things
to
talk
about
in
these
demo
days,
and
so
please
feel
free
to
reach
out
with
any
of
that
information
or
reach
out
afterwards
and
more
questions.
C
There
there
are
a
few
questions
in
the
chat
that
I
wanted
to
highlight
some
about
some
documentation
on
our
audit
log
api.
I
just
sent
one
link
on
how
you
can
access
that
and
also
sharing
a
really
cool
blog
post
by
kevin
alwell
on
how
you
can
kind
of
like
get
started
with
our
graphql
api
and
how
you
can
use
the
audit
log.
So
I'm
just
sharing
those
right
now
and
there
was
another
question
that
might
be
good
for
discussion.
C
There
was
a
question
about
an
enterprise
account
owner
taking
ownership
of
an
org
under
the
enterprise.
I
think
I
think
you
answered
that
meals,
but
just
to
echo
that
you
know
or
organization
owners
they
really
own
that
content
of
an
organization.
You
know
where
all
the
repositories
live,
where
all
the
teams
are
attached
to
things
like
that.
A
B
So
to
add
to
that,
not
only
that
it
it's
a
common
practice
to
have
more
than
just
one
enterprise
account
owner.
You
want
to
have
at
least
two
enterprise
account
owners
at
any
time.
Just
so
you
make
sure
that
you
know
if
somebody
leaves
or
something
happens,
another
person
has
access
to
your
enterprise
account.
If
that
is
still
that's,
you
know
always
configurable
when
you
follow
ticket
to
support,
but
that's
a
whole
process
right.
B
Another
question
related
to
security,
but
a
little
on
a
different
aspect
is
how
can
you
prevent
people
from
submitting
tokens
in
a
public
organization
or
in
a
public
sorry
in
a
public
repository,
so
that
was
one
of
the
questions.
Well,
github
has
token
scanning,
so
it
does
public
token
scanning
across
all
public
repos
and
it
has
an
sla
with
certain
type
of
vendors.
For
example,
somebody
contributes
commits
into
their
repo
aws
credentials
or
azure
credentials
or
google
cloud
credentials
or
other
types
of
credentials.
B
There's
an
sla
that
we've
have
with
our
vendors.
That
say:
hey
if
this
person,
if
there's
a
token,
that's
been
compromised,
it
needs
to
be
handled
by
the
company.
So,
for
example,
aws
has
a
five
second
sla,
where
they
will
actually
void
the
token
just
in
or
avoid
the
credentials
just
to
make
sure
that
nothing
is
exposed
in
time
and
there's
another
type
of
work
around
against.
B
I
guess
private
repositories,
you
don't
still
don't
want
any
credentials
to
be
stored
there
anyway,
so
we
have
a
tool
called
private
token
scanning,
and
then
we
can
talk
about
that
at
one
of
our
other
upcoming
sessions.
If
somebody's
interested
or
many
of
you
are
interested
in
talking
about
it,
it's
there's
some
pretty
awesome
stuff
that
we
can
always
cover
so
feel
free
to
message
us
and
say:
hey,
I'm
really
interested
in
learning
more
about
this.
Can
you
host
this
in
the
next
coming
sessions.
A
Oh,
go
ahead,
good
question
that
came
up
I'm
curious
about
your
thoughts
on
keeping
oss
projects
in
separate
organs,
separate
security
config
via
including
it
in
your
main
org.
When
the
main
org
yeah
I
mean
I
I've
seen
it
happen
both
ways,
also
where
I
think
that
that's
pretty
important,
too,
is
kind
of
you
know.
I
think
the
greater
conversation
is
around.
How
do
you
want
to
split
up
organizations
within
your
entire
kind
of
enterprise
account?
A
And
so
I
would
say
that's
a
way
that
we've
seen
it
make
sense
too,
because
then
you
could
put
stricter
organization
policies
around
kind
of
the
main
org
that
does
have
sso
enabled
that
does
have
kind
of
more
security,
focused
things
enabled
and
then
put
kind
of
your
more
open
source,
focused
ones
that
you
want
to
allow
public
repositories,
for
you
want
to
allow
kind
of
those
added
access
controls
in
I've.
Seen
that
be
very
successful,
and
I
could
definitely
recommend
going
that
case.
A
Obviously,
they're
both
achievable,
if
you
want
to
put
it
all
in
one
main,
org
you're,
going
to
start
having
to
go
through
outside
collaborators,
because
that's
how
you
get
around
the
sso
enablement
for
contractors
or
if
you
do
have
open
source
or
things
like
that,
they're
still
going
to
be
public.
But
I
would
I
mean
I.
I
think
you
can't
really
go
wrong
either
way.
B
Well,
you
still
want
to
enable
open
source
is
great,
but
when
you're
working
in
an
enterprise,
you
also
want
to
enable
inner
source.
Not
everything
can
be
public.
So
if
you
do
have
a
separate
org
for
open
source,
which
is
fine
and
have
a
separate
or
for
all
of
your
more
more
enterprise
projects,
so
you
don't
want
those
to
be
exposed.
You
can
add
people
when
you
have
an
enterprise
account.
You
have
that
capability
to
make
them
internal
projects
and
have
that
inner
source
where
people
can
access
both
repositories.
B
If
they're
internal
and
view
them,
as
you
know,
have
wreath
capabilities.
So,
as
a
member
on
an
enterprise,
you
have
that
capability
to
read
across
both
your
open
source
organization
and
your
own
internal
organization.
Without
having
to
make
too
much,
you
know
having
to
configure
your
enterprise
to
a
very
extensive
configuration
to
make
sure
that
everybody
has
access
to
the
right
thing:
that
if
there
is
a
new
capability,
called
internal
repositories
that
can
allow
you
to
do
that
and
still
maintain
your
open
source
and
still
maintain
the
private
repos.
A
Cool,
I
think
that
goes
through
most
of
the
chat
there
seems
to
be
some
excitement
about
private
token
scanning,
and
so
you
know
we're
happy
to
do
a
demo
day
about
that.
But,
besides
that
I
mean
I'm
happy
to
end
three
two
minutes
early
now
and
just
want
to
say
thank
you.
Everyone
for
kind
of
tuning
in
and
listening
to
us
talk.