GitHub SAML SSO Guides for GitHub Enterprise Cloud, 18 Oct 2022

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: SAML SSO Guide Part I: SAML SSO & IP Protection within GitHub Enterprise Cloud

Description

—Summary—
00:00 Intro
00:36 Prerequisites
01:00 SAML SSO - a security layer
01:52 How does SAML SSO works?
02:43 SAML SSO DEMO from an Administrator perspective
03:21 Personal Access Tokens and SSH keys
04:09 Personal Access Tokens and SSH keys authorisation DEMO
05:15 Outside Collaborators

—Documentation—
About authentication with SAML single sign-on - GitHub Enterprise Cloud Docs: https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/about-authentication-with-saml-single-sign-on
Authorizing an SSH key for use with SAML single sign-on - GitHub Enterprise Cloud Docs: https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-an-ssh-key-for-use-with-saml-single-sign-on
Authorizing a personal access token for use with SAML single sign-on - GitHub Enterprise Cloud Docs: https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on
Viewing and managing your active SAML sessions - GitHub Enterprise Cloud Docs: https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/viewing-and-managing-your-active-saml-sessions

--
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github

About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com

A

Hi. welcome to this series of saml sso guides for enterprise.. My name is marcio and I'm a solutions. Engineer.

A

In this video and in this series of videos, we are going to touch the most commonly asked questions.

A

In this realm. in this video specifically,, we are going to talk about how the saml sso helps to protect.

A

Your intellectual property, so my hope is that by the end of this video, you are going to be.

A

Able to understand better how saml works and how thus it protects your ip. So, let's get started.

A

So, firstly, let's take a look at the prerequisites for this guide.. You have to be using github.

A

Enterprise cloud platform,, the no enterprise managed users version.. Also, we are looking to the.

A

Saml 2.0 standard, so your idp has to implement this one, and this guide is for users that have.

A

Admin access, be it for organization or for the enterprise, account. intellectual property,.

A

Is a key and valuable assets to any business, and here at github you couldn't read it differently.

A

With github enterprise cloud,, you can maintain access controls of your private repositories using.

A

Saml sso, but how does it work without saml sso?, so without saml sso in your github enterprise, cloud,.

A

You can invite users to your github enterprise account or your organization account through the.

A

Basic authentication., by leveraging saml,, you ensure that only authorized employees have.

A

Access to your code base, while they are still having a frictionless experience within github.

A

So that happens, connecting your github enterprise, cloud organization or enterprise account to an.

A

Identity provider. we're going to take a look on. How does that work in the next part.

A

So saml sso is this feature that enables your enterprise account or your organization account.

A

To create a secure connection between your identity provider and your github enterprise cloud., so how.

A

Does that work? so when we enforce it, when you enforce samlsso for your organization,.

A

You're actually saying, "hey, only the github members that have linked their personal account with your.

A

Identity provider are going to be able to have access to your github enterprise cloud resources".

A

As an enterprise or organization and administrator,, you are able to verify the.

A

Link in the sso identity of a user and verify, if that's granted or not. what you're also able to do.

A

Is to revoke that access, so that might make sense when a user doesn't belong anymore to the company.

A

And is leaving the company doesn't need access to those resources anymore.. So how does it look like.

A

At github?, so I have this organization here and I have inside this organization the people tab in.

A

The people tab, I have access to the members who are part of this organization.. If I click on one.

A

Of those members, I can see this ssoidentity linkage section clicking on it. I have the link.

A

Sso identity, which is related to the identity provider that I have linked to here and also I.

A

Have the access to that active sso sessions where I could go ahead and revoke a session, for example,.

A

I also could revoke the sso identity and this user wouldn't be able to access this organization.

A

Anymore. so now, let's delve a bit more on the subject of the programmatic access and the ssh.

A

Keys., how are those impacted once enabled or enforced saml?? So, as you might be, familiar, programmatic.

A

Access at github is done through personal access, token., both personal access, token and ssh keys.. They.

A

Belong to a user, accounts. they're associated to a user account, so these users actually will.

A

Have to authorize these tokens and these ssh keys if they wanted to continue working as.

A

Previously after saml is enabled and enforced, so this is a process that has to happen and it's an.

A

Extra protection actually so to ensure you don't have a non-ssh keys, usage or lingering.

A

Personal access tokens once you go through this process of enabling and enforcing saml.

A

Now, let's take a look hands-on on how to authorize a personal access token, so I click here on my.

A

User account I go under settings and going into developer settings and finally, personal access.

A

Tokens I'm going to have access to my personal access tokens, the ones that I created so far.

A

What is interesting here is that inside each and every personal access token, you also have the.

A

Option to configure sso configure is assuming exactly that authorize those personal access.

A

Token so let's say I want to authorize for this organization. Clicking on authorize is going to.

A

Redirect me to the identity provider of that and that's configured for that organization, so.

A

If I click here and continue on the single sign-on process, it's going to redirect me to the idp, which.

A

I already signing in this process, and it's going to promptly right after if I want to authorize the.

A

Credential access to this organization, so I'm going to continue on that clicking on that and.

A

Continue to complete the process of enabling and authorizing this personal access token. So, lastly,.

A

If you have contractors work in your company, you probably have then assigned to the role outside.

A

Collaborator, so the outside collaborators are not members in the sense that they have access to one.

A

Or more of organization repositories, but they are not fully members, not part of teams, um so there.

A

Are two options actually to add in this outside of collaborators to your uh to your github enterprise?.

A

Cloud and to giving access to resources, so the first option is to actually giving access granular.

A

Access to those repositories to the resources, so you add them individually to each repository where.

A

They want to have to give access then to, and the other option is to add them to your ident.

A

Provider so we manage that from your audience provider and they're going to be part of github.

A

Actually, as as members, that's really nice, because it actually gives the flexibility that you need.

A

To allow outside collaborators in one fashion or or the other great, so thanks for watching.