100
edits
GitHub/GHE SAML Overview: Difference between revisions
Jump to navigation
Jump to search
typo corrections
Cknowles-moz (talk | contribs) (Initial add of the overview of the GHE/SAML migration process.) |
Cknowles-moz (talk | contribs) (typo corrections) |
||
| Line 5: | Line 5: | ||
This project is around getting Mozilla's GitHub organizations imported into GitHub Enterprise (GHE) and getting SAML enforced - which uses Auth0 to verify the user's phonebook (LDAP or FxA backed) account and link it to the user's GitHub account. | This project is around getting Mozilla's GitHub organizations imported into GitHub Enterprise (GHE) and getting SAML enforced - which uses Auth0 to verify the user's phonebook (LDAP or FxA backed) account and link it to the user's GitHub account. | ||
This allows for more certain onboarding and | This allows for more certain onboarding and off-boarding, and better communication paths around any other maintenance activity regarding GitHub. Previously large effect actions have been hampered because we have no way to reliably communicate with large numbers of folk in our GitHub orgs. | ||
== Common questions/concerns == | == Common questions/concerns == | ||
| Line 14: | Line 14: | ||
*** Unlimited private repos. (This is mainly a concern for older "legacy" orgs) | *** Unlimited private repos. (This is mainly a concern for older "legacy" orgs) | ||
*** Actions can be run against private repos | *** Actions can be run against private repos | ||
*** SAML linkages (from phonebook profile to GitHub ID) - making onboard/ | *** SAML linkages (from phonebook profile to GitHub ID) - making onboard/off-board administration easier | ||
*** GitHub enterprise level support is available | *** GitHub enterprise level support is available | ||
** In addition to GHE, IT is also involving itself more in the secops posture and KTLO level work | ** In addition to GHE, IT is also involving itself more in the secops posture and KTLO level work | ||
| Line 50: | Line 50: | ||
=== Auditing for people with unneeded ownership permissions to the org === | === Auditing for people with unneeded ownership permissions to the org === | ||
With IT helping with | With IT helping with on-board/off-board/KTLO, there's less need, and with secops involved, less desire to have many owners in the org. So we'll be reaching out to the owners to reverify their need for ownership. | ||
=== Getting as many non-phonebook linked people linked === | === Getting as many non-phonebook linked people linked === | ||
| Line 58: | Line 58: | ||
==== Bots ==== | ==== Bots ==== | ||
Since there's no "BOT" flag in | Since there's no "BOT" flag in GitHub, we'll need the help of the org members to identify bot accounts. | ||
Once identified, they can be converted to "Outside Collaborators" - which removes them from concern with regards to SAML enforcement, and still allows them access to their repos. | Once identified, they can be converted to "Outside Collaborators" - which removes them from concern with regards to SAML enforcement, and still allows them access to their repos. | ||
| Line 92: | Line 92: | ||
** an early org was unknowingly migrated ... 3 weeks before an OWNER noticed - unknown if the users have noticed. | ** an early org was unknowingly migrated ... 3 weeks before an OWNER noticed - unknown if the users have noticed. | ||
* We send out comms to all identified users in the org (phonebook linked) telling them of the upcoming SAML changes, and steps they'll need to do when that happens in about a week | * We send out comms to all identified users in the org (phonebook linked) telling them of the upcoming SAML changes, and steps they'll need to do when that happens in about a week | ||
* We invite all identified users into | * We invite all identified users into the phonebook group giving them access. | ||
** Accepting this invite is one of the items in that comms email | ** Accepting this invite is one of the items in that comms email | ||
* We also put the directions and notifications in | * We also put the directions and notifications in an org-wide team notification, trying to reach whoever we can. | ||
=== Enable === | === Enable === | ||
* A week after the previous step we enable the SAML connection in the org. | * A week after the previous step we enable the SAML connection in the org. | ||
* We send out comms about this, and that people should click the green button for | * We send out comms about this, and that people should click the green button for SAML, and follow the (now repeated) directions | ||
* At this point, we're waiting and watching the org, helping any stragglers (people who didn't accept invites, have the wrong GH ID linked, etc) | * At this point, we're waiting and watching the org, helping any stragglers (people who didn't accept invites, have the wrong GH ID linked, etc) | ||
* One week after enablement we'll look at the SAML rate, and if it's low, we'll send out a reminder. | * One week after enablement we'll look at the SAML rate, and if it's low, we'll send out a reminder. | ||