<div dir="ltr"><div dir="ltr">Thank you James.<input name="virtru-metadata" type="hidden" value="{"email-policy":{"state":"closed","expirationUnit":"days","disableCopyPaste":false,"disablePrint":false,"disableForwarding":false,"enableNoauth":false,"persistentProtection":false,"expandedWatermarking":false,"expires":false,"isManaged":false},"attachments":{},"compose-id":"13","compose-window":{"secure":false}}"><div><br></div><div>We have been using GitHub for quite a few months now, and have users in there already, so we're probably past the point of provisioning this. We will have to work with what we have -- SSH keys, repos, and all. Yes, we would want to deny their SAML auth.</div><div><br></div><div>BTW that SCIM link is not working for me for some reason...</div><div><br></div><div>Joanne</div><div><br></div></div><br><div class="gmail_quote" style=""><div dir="ltr" class="gmail_attr">On Wed, Jul 15, 2020 at 5:32 PM James Oulman <<a href="mailto:oulman@ufl.edu">oulman@ufl.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_5703632128080184197WordSection1">
<p class="MsoNormal">We have been looking at this a bit and Github seems to want to use SCIM to automate invitations into Organizations. Unfortunately, the one that we have available AzureAD does not support AzureAD as the SCIM provider and a direct integration
with Shibboleth. You get a “Unsupported IdP” error when you try to go through the set up. They seem to want you to use their application integration in the Azure AD marketplace (or whatever it’s called these days).<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><a href="https://docs.github.com/en/github/setting-up-and-managing-organizations-and-teams/about-scim" target="_blank">https://docs.github.com/en/github/setting-up-and-managing-organizations-and-teams/about-scim</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Since our AzureAD SSO is uses ADFS, and our ADFS uses Shibboleth as a claims provider trust, we’ll probably just go the native AzureAD route. From there we can synchronize Github Org memberships with AD Groups.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Is your desire to leave them as a member of the Org but deny their SAML auth? What about SSH keys, API access, etc.?
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of "Schwendner, Joanne" <<a href="mailto:joanne_schwendner@brown.edu" target="_blank">joanne_schwendner@brown.edu</a>><br>
<b>Reply-To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Date: </b>Wednesday, July 15, 2020 at 2:03 PM<br>
<b>To: </b>"<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>" <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject: </b>GitHub access control<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-size:9pt;font-family:Arial,sans-serif;color:rgb(250,70,22)">[External Email]</span></b>
<u></u><u></u></p>
</div>
<table border="0" cellspacing="0" cellpadding="0" align="left" width="100%" style="width:100%">
<tbody>
<tr>
<td style="padding:0in"></td>
</tr>
</tbody>
</table>
<div>
<div>
<p class="MsoNormal">Does anyone have experience with controlling access to individual Organizations in GitHub Cloud? We would like to control access by using Grouper group memberships. We are successfully using their SAML SSO support. But...
<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">It seems the only attribute GitHub cares about is NameID. We are currently passing our persistent ID in NameID. If it's there, they get in. To block access for a user, we would have to NOT send NameID in the assertion, if that's even
possible.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Is it possible to conditionally NOT send NameID depending on a user's other attributes? Is there another way to manage GitHub Org access (besides manually)?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<div>
<p class="MsoNormal">Thanks.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Joanne<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">---<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif;color:rgb(32,33,36)">Joanne Schwendner<br>
Senior Developer - </span><span style="color:rgb(136,136,136)">Web, Integration, & Identity Services</span><span style="font-family:Arial,sans-serif;color:rgb(32,33,36)"><br>
Brown University</span> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div></div>