How to Configure Duo SSO SAML 2.0 for GitHub Enterprise
All docs on this site are unofficial
Prerequisites:
- You have a GitHub Enterprise account
- Duo SSO is already configured with an authentication source
Outline
- What’s been tested
- SSO Configuration Steps
What’s been tested:
I have tested the following and confirmed they work:
- SP-initiated authentication
- IdP-initiated authentication
- Just In Time (JIT) provisioning
SSO Configuration Steps
For more information on configuring SAML for GitHub Enterprise, see Enabling and testing SAML single sign-on for your organization
Create a GitHub Enterprise application in Duo
- Login to your Duo Admin Panel
- Navigate to Protect an Application
- Search for Generic Service Provider and click Protect Note: be sure to select the one for Single Sign-On (hosted by Duo)
- Make a point of where the Entity ID and Single Sign-On URL are located as you will need to copy them into GitHub in the next section.
- Download the Certificate and save it to your desktop.
Note: Leave your Duo Admin panel open on this newly created application as you need to copy items from it into your GitHub account.
Configure SSO in GitHub Enterprise
- Login to your GitHub account with someone who has access to modify SAML settings.
- Navigate to *Settings - Security - SAML single sign-on
- Check the box next to Enable SAML Authentication
- Sign on URL is the Single Sign-On URL of the newly created GitHub application in Duo:: Example [https://GUID.sso.duosecurity.com/saml2/sp/GUID/sso]
- Issuer is the Entity ID of the newly created GitHub application in Duo:: Example [https://GUID.sso.duosecurity.com/saml2/sp/GUID/metadata]
- Public certificate add the certificate that you downloaded from Duo in the section above. Note: you will need to open the certificate so you can copy and paste it in GitHub. Be sure to include —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—–
Do not click Test SAML configuration yet as you need to finish creating the GitHub application in your Duo admin panel. Keep this page open though as you will need to come back once you finish configuring the GitHub application in Duo.
Configure the GitHub application in Duo
- Navigate back to the application we created above in your Duo Admin panel.
- Next to Service Provider name enter anything. I choose GitHub
- Next to Entity ID enter [https://github.com/orgs/[YourGitHubOrgName]]
- Next to Assertion Consumer Service enter [https://github.com/orgs/[YourGitHubOrgName]/saml/consume]
- NameID format should stay as the default: urn.oasis:names:tc:SAML:1.1:nameid-format:emailAddress
- Next to NameID attribute input the attribute that maps to your email address. If possible, I always recommend choosing Duo’s preconfigured attributes, in this case This will allow you to change Duo SSO Authentication Source in the future, if needed. For example, from AD to a SAML IdP.
- Next to Signing options leave both Sign response and Sign assertion checked.
- Scroll down to the Policy section and choose the policy you wish to implement for this application.
- Scroll down to the Settings section and next to Name add GitHub Enterprise. You may also want to configure other options under this section, depending on how you have Duo MFA configured for your users.
- Scroll to the bottom and click Save
Finish the GitHub configuration
- Click Test SAML Configuration This will take you through the full SAML SSO flow.
- One your test is successfully completed, click Save.
Optionally you can click *Require SAML SSO authentication for all members of the *YourGitHubOrgName organization.
You are now ready to use SAML SSO authentication into GitHub Enterprise! To test IdP initiated authentication, copy the Single Sign-On URL from the GitHub Enterprise application in your Duo Admin panel. If you want to test SP initiated authentication, use the following: [https://github.com/orgs/[YourGitHubOrgName]/sso]
With GitHub Enterprise, there is no special configuration needed for Just In Time (JIT) Provisioning to work.