English
No results found.

Explore by product

Enterprise administrators
  • Get started
  • Account and profile
  • Authentication
  • Repositories
  • GitHub
  • Enterprise administrators
  • Billing and payments
  • Organizations
  • Code security
  • GitHub Issues
  • GitHub Actions
  • GitHub Codespaces
  • GitHub Packages
  • Search on GitHub
  • Developers
  • REST API
  • GraphQL API
  • GitHub CLI
  • GitHub Discussions
  • GitHub Sponsors
  • Building communities
  • GitHub Pages
  • Education
  • GitHub Desktop
  • Atom
  • Electron
  • CodeQL
  • npm
    • English
  • English
  • 简体中文 (Simplified Chinese)
  • 日本語 (Japanese)
  • Español (Spanish)
  • Português do Brasil (Portuguese)

    • This version of GitHub Enterprise was discontinued on 2021-09-23. No patch releases will be made, even for critical security issues. For better performance, improved security, and new features, upgrade to the latest version of GitHub Enterprise. For help with the upgrade, contact GitHub Enterprise support.

    Article version

    In this article

    Using SAML

    SAML is an XML-based standard for authentication and authorization. GitHub Enterprise Server can act as a service provider (SP) with your internal SAML identity provider (IdP).

    If you want to authenticate users without adding them to your identity provider, you can configure built-in authentication. For more information, see "Allowing built-in authentication for users outside your identity provider."

    Supported SAML services

    GitHub Enterprise Server supports SAML SSO with IdPs that implement the SAML 2.0 standard. For more information, see the SAML Wiki on the OASIS website.

    GitHub officially supports and internally tests the following IdPs.

    • Active Directory Federation Services (AD FS)
    • Azure Active Directory (Azure AD)
    • Okta
    • OneLogin
    • PingOne
    • Shibboleth

    GitHub Enterprise Server does not support SAML Single Logout. To terminate an active SAML session, users should log out directly on your SAML IdP.

    Username considerations with SAML

    Each GitHub Enterprise Server username is determined by one of the following assertions in the SAML response, ordered by priority:

    • The custom username attribute, if defined and present
    • An http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name assertion, if present
    • An http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress assertion, if present
    • The NameID element

    The NameID element is required even if other attributes are present.

    A mapping is created between the NameID and the GitHub Enterprise Server username, so the NameID should be persistent, unique, and not subject to change for the lifecycle of the user.

    Note: If the NameID for a user does change on the IdP, the user will see an error message when they try to sign in to your GitHub Enterprise Server instance. To restore the user's access, you'll need to update the user account's NameID mapping. For more information, see "Updating a user's SAML NameID."

    GitHub Enterprise Server usernames can only contain alphanumeric characters and dashes (-). GitHub Enterprise Server will normalize any non-alphanumeric character in your account's username into a dash. For example, a username of gregory.st.john will be normalized to gregory-st-john. Note that normalized usernames also can't start or end with a dash. They also can't contain two consecutive dashes.

    Usernames created from email addresses are created from the normalized characters that precede the @ character.

    If multiple accounts are normalized into the same GitHub Enterprise Server username, only the first user account is created. Subsequent users with the same username won't be able to sign in.

    This table gives examples of how usernames are normalized in GitHub Enterprise Server:

    UsernameNormalized usernameResult
    Ms.Bubblesms-bubblesThis username is created successfully.
    !Ms.Bubbles-ms-bubblesThis username is not created, because it starts with a dash.
    Ms.Bubbles!ms-bubbles-This username is not created, because it ends with a dash.
    Ms!!Bubblesms--bubblesThis username is not created, because it contains two consecutive dashes.
    Ms!Bubblesms-bubblesThis username is not created. Although the normalized username is valid, it already exists.
    Ms.Bubbles@example.comms-bubbles