This document describes how to configure Secret Double Octopus as an IdP for GitHub using the SAML protocol.
Integration Environment
The environment used for the integration described in this document is based on the following software versions:
Octopus Authentication Server version 6.6.2
GitHub Cloud Tenant
Integration Workflow
The integration process involves the following sequential phases:
Creating the GitHub SAML Service: Add and configure the SAML service in the Octopus Management Console
Configuring SAML Authentication in GitHub: Set up SAML authentication service integration in the GitHub console
Completing Service Integration: Add required parameters to the Octopus SAML service
The following procedure explains how to create the required SAML service in the Octopus Management Console. The service settings will be used later for integration with the GitHub Cloud Tenant.
To add and configure the GitHub SAML service:
From the Octopus Management Console, select the Services menu. At the upper left corner of the page, click Add Service.
In the Generic SAML tile, click Add.
Then, in the dialog that opens, click Create.
Configure the following settings in the General Info tab:
Setting
Description
Service Name
Enter a display name to identify the service (e.g., GitHub).
Issuer
Enter the issuer of the service.
Description
Enter a brief note about the service.
Display icon
This icon will be displayed on the Login page for the service. To change the default icon, click and upload the logo of your choice. (Supported image size is 128x128 pixels.)
Login Page URL
<https://<Enterprise Base URL>/saml/<random UUID>/login> The Enterprise Base URL can be modified in System Settings > General Settings.
Then, click Save.
Open the Sign on tab and update the default message in the Custom Message field. (This is the message displayed to the user upon successful login.)
At the bottom of the Sign on tab, click Save.
Open the Directories tab and select the checkbox of the directory you want to integrate with the service. Then, click Save.
Open the Users tab and click Add.
A popup opens, with a list of directories displayed on the left.
Expand the directories list and select the checkboxes of the groups and users that you want to add to the service. Then, click Save to close the popup.
The groups and users you selected are listed in the Users tab.
From the toolbar at the top of the page, click PUBLISH and publish your changes.
Follow the steps below to integrate the Octopus SAML service in the GitHub Cloud Tenant.
Before you begin, verify that you have access to the following settings from the Sign on tab of the service you created in the Octopus Management Console:
Issuer URL: Click the Copy icon to copy the URL.
SAML 2.0 Endpoint (HTTP): Click the Copy icon to copy the URL.
X.509 Certificate: Click the Copy icon to copy certificate content.
 |
To configure SAML authentication in GitHub:
From the GitHub organization configuration page, navigate to Security -> Authentication security.
In the SAML single sign-on section, select the Enable SAML authentication checkbox.
Then, configure the following properties, as shown in the example below the table:
Property
Description
Sign on URL
Paste the SAML 2.0 Endpoint (HTTP) URL you copied from the Octopus SAML service.
Issuer
Paste the Issuer URL you copied from the Octopus SAML service.
Public certificate
Paste the X.509 Certificate content you copied from the Octopus SAML service.
Copy and save the assertion consumer service URL. You will need it to complete the integration (as described in the next section).
Click Save.
The final phase of the integration involves adding the ACS URL to the Octopus SAML service and creating a required custom parameter.
Before starting the procedure below, make sure you have access to the assertion consumer service URL that you copied from your GitHub environment.
To complete service integration:
Log into the Octopus Management Console and open the Services menu.
In the card or row of the GitHub SAML service, click
to display the service settings.
Open the Parameters tab. In the ACS URL field, paste the assertion consumer service URL copied from GitHub.
Add the urn:oasis:names:tc:SAML:2.0:assertion parameter:
At the bottom of the Parameters tab, click Add Parameter.
In the Parameter Key field, enter urn:oasis:names:tc:SAML:2.0:assertion.
Then, from the dropdown list to the right, select Free Text.
Click Save.
From the toolbar at the top of the page, click PUBLISH and publish your changes.