GitHub Authentication with SAML Single Sign-On for AIQ

GitHub Authentication with SAML Single Sign-On for AIQ

YouUse canthis authenticatearticle when AIQ or related CI/CD workflows need to access a GitHub organization withthat enforces SAML single sign-onon. (SSO)Validate authentication and viewauthorization yourbefore activeusing sessions.the workflow in scheduled runs.

SAML

Configuration singlechecklist

sign-on

• Confirm is available withthe GitHub Enterpriseorganization, Cloud.identity Forprovider, moreand information,user seeor "GitHub'sservice products."identity
  that needs access.

Authorize

Aboutthe authenticationGitHub withtoken or app for the SAML-protected organization.

Use least-privilege repository access and avoid personal administrator credentials for automation.Store tokens in secured variables or a secret manager, not in AIQ steps, scripts, or logs.Document token owner, expiration, rotation process, and support contact.

Validation workflow

1. Confirm SAML singleauthorization sign-onin

   YouGitHub canfor accessthe antarget organizationorganization.

2. Run a small read-only repository operation first.
3. Validate the CI/CD or AIQ integration path that usesrequires GitHub access.
4. Review logs to confirm no token or SAML singledetails sign-onare (SSO) by authenticating through an identity provider (IdP). After you authenticate with the IdP successfully from GitHub, you must authorize any personal access token, SSH key, or OAuth App you would like to access the organization's resources. exposed.

Authorizing an SSH key for use with SAML single sign-on

To use an SSH key with an organization that uses SAML single sign-on (SSO), you must first authorize the key.

Authorizing a personal access token for use with SAML single sign-on

To use a personal access token with an organization that uses SAML single sign-on (SSO), you must first authorize the token. See Github Repository Authorization for more information.

Viewing and managing your active SAML sessions

You can view and revoke your active SAML sessions in your security settings.

Github Repository Authorization

If you see the following Git error:

Git Error: https://github.com/<...>>/<GIT Repository>.git: git-upload-pack not permitted on “https://github.com/<...>>/<GIT Repository>.git"

Repository creds valid: false || <USER> || <Organization>

It is caused by the github repository not being properly authorized. In the case of private Github repositories and using SSO login configuration, you must authorize the repository while creating the github access token.

In the upper-right corner of any page on GitHub, click your profile photo, then click Settings.

In the left sidebar, click Developer settings.

In the left sidebar, click Personal access tokens.

Next to the token you would like to authorize, click Configure SSO.

In the drop down menu, to the right of the organization you'd like to authorize the token for, click Authorize.