GitHub/SAML issues: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
(Vastly simplifying the paths through this page.)
Line 5: Line 5:
There are several things needed in your account in people.mozilla.org in order to successfully SAML with GitHub, and other settings that may lead to problems with SAML authentication to GitHub organizations with Mozilla IP.
There are several things needed in your account in people.mozilla.org in order to successfully SAML with GitHub, and other settings that may lead to problems with SAML authentication to GitHub organizations with Mozilla IP.


If you're confused about what this is all about, we have a [[GitHub/GHE SAML User FAQ|FAQ]]
If you're confused about what this is all about, we have a [[GitHub/GHE SAML User FAQ|FAQ]] - There are pre-reqs in that page that you almost certainly already meet.
 
== You need a profile in people.mozilla.org ==
* If you're Mozilla staff or NDA'd, you should already have one linked to your LDAP account
* If you're not, but still need access to SAML'd GitHub resources, you can sign up for one by going [https://people.mozilla.org/ here] and clicking on "Log in/Sign up"
** You'll need to use either LDAP or an FxA account as the login source
*** '''NOTE: DO NOT use GitHub to authorize to people.m.o - use either Firefox accounts'''
== Linking your people.mozilla.org account to your GitHub ID ==
In your profile on people.mozilla.org you need to have your identity from GitHub connected and verified.
 
# Log onto your profile [https://people.mozilla.org/e/ people.mozilla.org]
# Scroll down until you see the "Identities" section
# Click on the pencil icon to edit it.
# Click on "+ Identities"
# Select "GitHub" from the dropdown menu and click "VERIFY"
## Note, you can also link your Bugzilla ID here.
# You should be taken to GitHub to log in and verify your ID.
## You may see a button to “Authorize Mozilla” - Click that.
# Get back to your people.m.o profile, and edit the identities (Steps 1-5)
 
This linkage does '''NOT''' change anything in your GitHub account, merely allowing Mozilla staff to see the connection between your GitHub ID and your people account.
 
== Make an email address at least Staff visible ==
# Log onto your profile [https://people.mozilla.org/e/ people.mozilla.org]
# Scroll down until you see the "Contact" section
# Click on the pencil icon to edit it.
# Add an email (if there isn't one already)
# Click on the small icon to the right of the text box, and select "Staff"
# Click Save.
 
== Being a member of the correct groups in people.mozilla.org ==
If you want to SAML to a GitHub organization named <ORGNAME> you'll need to belong to a group in people.mozilla.org named "GHE_<ORGNAME>_users" - so if "mozilla-it" is the org, "GHE_mozilla-it_users" is the group.
# File a bug [https://bugzilla.mozilla.org/enter_bug.cgi?product=mozilla.org&component=Github%3A+Administration GitHub Administration] asking for your mozilla account to be added to the appropriate people.m.o group.  (for example, GHE_mozilla-it_users)
# If your invitation is approved, you'll receive an email for confirmation, and you'll be a member of the group.
## Once you have the invitation approved, log out of people (click on the profile pic in the upper left and click "Logout") then click "Sign in" also in the upper left.


== If you've been logging in using SAML previously, and end up here, check membership ==
== If you've been logging in using SAML previously, and end up here, check membership ==
Rarely, people.mozilla.org will lose track of your groups.  The website will show membership, but the underlying systems won't.  Which will lead you here when logging into github.   
Rarely, people.mozilla.org will lose track of your groups.  The website will show membership, but the underlying systems won't.  Which will lead you here when logging into github.   
# Go to https://sso.mozilla.com/info and verify that the group "mozilliansorg_ghe_<ORGNAME>_users" exists for whichever ORGNAME you're logging into
# Go to https://sso.mozilla.com/info and verify that the group "mozilliansorg_ghe_<ORGNAME>_users" exists for whichever ORGNAME you're logging into
# From the URL of this page, please record the "dbg=XXXX" value and include just that (not the rest of the URL) in any bug filed
# From the URL of this page, please record the "dbg=XXXX" value and include that in the bug filed via this [https://bugzilla.mozilla.org/enter_bug.cgi?assigned_to=nobody%40mozilla.org&bug_ignored=0&bug_severity=--&bug_status=NEW&bug_type=task&cf_fx_iteration=---&cf_fx_points=---&comment=I%27m%20having%20trouble%20logging%20into%20GitHub%2C%20and%20I%27m%20being%20sent%20to%20the%20%5BSAML_issues%5D%28https%3A%2F%2Fwiki.mozilla.org%2Findex.php%3Ftitle%3DGitHub%2FSAML_issues%29%20page.%20%20And%20per%20that%20page%20here%20is%20my%20information%3A%0D%0A%0D%0AGitHub%20Username%3A%20%0D%0AGitHub%20Org%3A%20%0D%0AIn%20the%20URL%20of%20that%20SAML_Issues%20page%20I%20have%20the%20following%20%22dbg%3DXXXX%22%20in%20the%20URL%3A%0D%0AXXXX%20%3D%20%0D%0A%0D%0A&component=Github%3A%20Administration&contenttypemethod=list&contenttypeselection=text%2Fplain&defined_groups=1&filed_via=standard_form&flag_type-4=X&flag_type-607=X&flag_type-800=X&flag_type-803=X&flag_type-936=X&form_name=enter_bug&maketemplate=Remember%20values%20as%20bookmarkable%20template&op_sys=Unspecified&priority=--&product=mozilla.org&qa_contact=cknowles%40mozilla.com&rep_platform=Unspecified&short_desc=SAML%20errors%20trying%20to%20log%20into%20GitHub%20org%20ORGNAME&target_milestone=---&version=other template]
# If it doesn't, a GitHub admin will need to remove/readd your access to that group - file a bug [https://bugzilla.mozilla.org/enter_bug.cgi?product=mozilla.org&component=Github%3A+Administration%20GitHub%20Administration here]
# If there's no "dbg=XXXX" - include that information in the bug/contact so we know this is a different concern.
# If it does, that's extra odd, either file a bug to the same as above with steps you've taken here, or reach out to us on matrix on the #github-admin channel so we can look.  There might be a service interruption.


== If nothing works ==
== Contacting us if it's NOT a "dbg=XXXX" issue ==
Record the URL of the page you get sent to (this one) as it should have some debug data in the URL.  Then reach out to us:
Record the URL of the page you get sent to (this one) as it should have some debug data in the URL.  Then reach out to us:
* Best - bugzilla bug for [https://bugzilla.mozilla.org/enter_bug.cgi?product=mozilla.org&component=Github%3A+Administration GitHub Administration]
* Best - bugzilla bug for [https://bugzilla.mozilla.org/enter_bug.cgi?product=mozilla.org&component=Github%3A+Administration GitHub Administration]
* We're on matrix in the #github-admin channel
* We're on matrix in the #github-admin channel
* Email to ghe-admins@mozilla.com
* Email to ghe-admins@mozilla.com

Revision as of 19:50, 30 November 2023

GitHub Enterprise SAML Issues

This page is a landing spot from Auth0 if there's been an error authenticating your SAML connection with GitHub

There are several things needed in your account in people.mozilla.org in order to successfully SAML with GitHub, and other settings that may lead to problems with SAML authentication to GitHub organizations with Mozilla IP.

If you're confused about what this is all about, we have a FAQ - There are pre-reqs in that page that you almost certainly already meet.

If you've been logging in using SAML previously, and end up here, check membership

Rarely, people.mozilla.org will lose track of your groups. The website will show membership, but the underlying systems won't. Which will lead you here when logging into github.

  1. Go to https://sso.mozilla.com/info and verify that the group "mozilliansorg_ghe_<ORGNAME>_users" exists for whichever ORGNAME you're logging into
  2. From the URL of this page, please record the "dbg=XXXX" value and include that in the bug filed via this template
  3. If there's no "dbg=XXXX" - include that information in the bug/contact so we know this is a different concern.

Contacting us if it's NOT a "dbg=XXXX" issue

Record the URL of the page you get sent to (this one) as it should have some debug data in the URL. Then reach out to us:

  • Best - bugzilla bug for GitHub Administration
  • We're on matrix in the #github-admin channel
  • Email to ghe-admins@mozilla.com
Retrieved from "https://wiki.mozilla.org/index.php?title=GitHub/SAML_issues&oldid=1249115"