PAT v2 beta (#31013)
Co-authored-by: Hirsch Singhal <1666363+hpsin@users.noreply.github.com> Co-authored-by: Jovel Crisostomo <jovel@github.com> Co-authored-by: Lucas Costi <lucascosti@users.noreply.github.com> Co-authored-by: Vanessa <vgrl@github.com>
This commit is contained in:
Sarah Edwards
@@ -36,9 +36,9 @@ You can find both the HTTPS or an SSH URLs for cloning a repository on {% data v
|
||||
|
||||
For more information about the use of SSH to access repositories on {% data variables.product.product_name %}, see "[Connecting to {% data variables.product.prodname_dotcom %} with SSH](/authentication/connecting-to-github-with-ssh)."
|
||||
|
||||
## Contributing to multiple accounts using HTTPS and PATs
|
||||
## Contributing to multiple accounts using HTTPS and {% data variables.product.pat_generic %}s
|
||||
|
||||
Alternatively, if you want to use the HTTPS protocol for both accounts, you can use different personal access tokens (PAT) for each account by configuring Git to store different credentials for each repository.
|
||||
Alternatively, if you want to use the HTTPS protocol for both accounts, you can use different {% data variables.product.pat_generic %}s for each account by configuring Git to store different credentials for each repository.
|
||||
|
||||
{% mac %}
|
||||
|
||||
|
||||
@@ -55,9 +55,9 @@ Before creating your {% data variables.product.prodname_actions %} workflow, you
|
||||
|
||||
1. Set registry credentials for your web app.
|
||||
|
||||
Create a personal access token with the `repo` and `read:packages` scopes. For more information, see "[Creating a personal access token](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
Create a {% data variables.product.pat_v1 %} with the `repo` and `read:packages` scopes. For more information, see "[Creating a {% data variables.product.pat_generic %}](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
|
||||
Set `DOCKER_REGISTRY_SERVER_URL` to `https://ghcr.io`, `DOCKER_REGISTRY_SERVER_USERNAME` to the GitHub username or organization that owns the repository, and `DOCKER_REGISTRY_SERVER_PASSWORD` to your personal access token from above. This will give your web app credentials so it can pull the container image after your workflow pushes a newly built image to the registry. You can do this with the following Azure CLI command:
|
||||
Set `DOCKER_REGISTRY_SERVER_URL` to `https://ghcr.io`, `DOCKER_REGISTRY_SERVER_USERNAME` to the GitHub username or organization that owns the repository, and `DOCKER_REGISTRY_SERVER_PASSWORD` to your {% data variables.product.pat_generic %} from above. This will give your web app credentials so it can pull the container image after your workflow pushes a newly built image to the registry. You can do this with the following Azure CLI command:
|
||||
|
||||
```shell
|
||||
az webapp config appsettings set \
|
||||
|
||||
@@ -112,7 +112,7 @@ jobs:
|
||||
# NOT clone them initially and instead, include them manually
|
||||
# only for the test groups that we know need the files.
|
||||
lfs: {% raw %}${{ matrix.test-group == 'content' }}{% endraw %}
|
||||
# Enables cloning the Early Access repo later with the relevant PAT
|
||||
# Enables cloning the Early Access repo later with the relevant {% data variables.product.pat_generic %}
|
||||
persist-credentials: 'false'
|
||||
|
||||
- name: Figure out which docs-early-access branch to checkout, if internal repo
|
||||
|
||||
@@ -42,7 +42,7 @@ You can use the self-hosted runner application's `run` script with the `--check`
|
||||
In addition to `--check`, you must provide two arguments to the script:
|
||||
|
||||
* `--url` with the URL to your {% data variables.product.company_short %} repository, organization, or enterprise. For example, `--url https://github.com/octo-org/octo-repo`.
|
||||
* `--pat` with the value of a personal access token, which must have the `workflow` scope. For example, `--pat ghp_abcd1234`. For more information, see "[Creating a personal access token](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
* `--pat` with the value of a {% data variables.product.pat_v1 %}, which must have the `workflow` scope{% ifversion pat-v2%}, or a {% data variables.product.pat_v2 %} with workflows read and write access {% endif %}. For example, `--pat ghp_abcd1234`. For more information, see "[Creating a {% data variables.product.pat_generic %}](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
|
||||
For example:
|
||||
|
||||
|
||||
@@ -56,8 +56,8 @@ In the tutorial, you will first make a workflow file that uses the [`alex-page/g
|
||||
- Change the value for `project` to the name of your project board. If you have multiple project boards with the same name, the `alex-page/github-project-automation-plus` action will act on all projects with the specified name.
|
||||
- Change the value for `column` to the name of the column where you want issues to move when they are assigned.
|
||||
- Change the value for `repo-token`:
|
||||
1. Create a personal access token with the `repo` scope. For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
1. Store this personal access token as a secret in your repository. For more information about storing secrets, see "[Encrypted secrets](/actions/reference/encrypted-secrets)."
|
||||
1. Create a {% data variables.product.pat_v1 %} with the `repo` scope. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
1. Store this {% data variables.product.pat_generic %} as a secret in your repository. For more information about storing secrets, see "[Encrypted secrets](/actions/reference/encrypted-secrets)."
|
||||
1. In your workflow file, replace `PERSONAL_ACCESS_TOKEN` with the name of your secret.
|
||||
6. {% data reusables.actions.commit-workflow %}
|
||||
|
||||
|
||||
@@ -115,7 +115,7 @@ If you do provide the `repository` key in your *package.json* file, then the rep
|
||||
|
||||
To perform authenticated operations against the {% data variables.product.prodname_registry %} registry in your workflow, you can use the `GITHUB_TOKEN`. {% data reusables.actions.github-token-permissions %}
|
||||
|
||||
If you want to publish your package to a different repository, you must use a personal access token (PAT) that has permission to write to packages in the destination repository. For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)" and "[Encrypted secrets](/actions/reference/encrypted-secrets)."
|
||||
If you want to publish your package to a different repository, you must use a {% data variables.product.pat_v1 %} that has permission to write to packages in the destination repository. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)" and "[Encrypted secrets](/actions/reference/encrypted-secrets)."
|
||||
|
||||
### Example workflow
|
||||
|
||||
|
||||
@@ -117,9 +117,9 @@ The permissions for the `GITHUB_TOKEN` are initially set to the default setting
|
||||
|
||||
### Granting additional permissions
|
||||
|
||||
If you need a token that requires permissions that aren't available in the `GITHUB_TOKEN`, you can create a personal access token and set it as a secret in your repository:
|
||||
If you need a token that requires permissions that aren't available in the `GITHUB_TOKEN`, you can create a {% data variables.product.pat_generic %} and set it as a secret in your repository:
|
||||
|
||||
1. Use or create a token with the appropriate permissions for that repository. For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
1. Use or create a token with the appropriate permissions for that repository. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
1. Add the token as a secret in your workflow's repository, and refer to it using the {%raw%}`${{ secrets.SECRET_NAME }}`{% endraw %} syntax. For more information, see "[Creating and using encrypted secrets](/github/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets)."
|
||||
|
||||
### Further reading
|
||||
|
||||
@@ -60,7 +60,7 @@ You can also manage secrets using the REST API. For more information, see "[Secr
|
||||
|
||||
### Limiting credential permissions
|
||||
|
||||
When generating credentials, we recommend that you grant the minimum permissions possible. For example, instead of using personal credentials, use [deploy keys](/developers/overview/managing-deploy-keys#deploy-keys) or a service account. Consider granting read-only permissions if that's all that is needed, and limit access as much as possible. When generating a personal access token (PAT), select the fewest scopes necessary.
|
||||
When generating credentials, we recommend that you grant the minimum permissions possible. For example, instead of using personal credentials, use [deploy keys](/developers/overview/managing-deploy-keys#deploy-keys) or a service account. Consider granting read-only permissions if that's all that is needed, and limit access as much as possible. When generating a {% data variables.product.pat_v1 %}, select the fewest scopes necessary.{% ifversion pat-v2 %} When generating a {% data variables.product.pat_v2 %}, select the minimum repository access required.{% endif %}
|
||||
|
||||
{% note %}
|
||||
|
||||
|
||||
@@ -261,11 +261,11 @@ This list describes the recommended approaches for accessing repository data wit
|
||||
- Note that deploy keys can only clone and push to the repository using Git, and cannot be used to interact with the REST or GraphQL API, so they may not be appropriate for your requirements.
|
||||
3. **{% data variables.product.prodname_github_app %} tokens**
|
||||
- {% data variables.product.prodname_github_apps %} can be installed on select repositories, and even have granular permissions on the resources within them. You could create a {% data variables.product.prodname_github_app %} internal to your organization, install it on the repositories you need access to within your workflow, and authenticate as the installation within your workflow to access those repositories.
|
||||
4. **Personal access tokens**
|
||||
- You should never use personal access tokens from your own account. These tokens grant access to all repositories within the organizations that you have access to, as well as all personal repositories in your personal account. This indirectly grants broad access to all write-access users of the repository the workflow is in. In addition, if you later leave an organization, workflows using this token will immediately break, and debugging this issue can be challenging.
|
||||
- If a personal access token is used, it should be one that was generated for a new account that is only granted access to the specific repositories that are needed for the workflow. Note that this approach is not scalable and should be avoided in favor of alternatives, such as deploy keys.
|
||||
4. **{% data variables.product.pat_generic %}s**
|
||||
- You should never use a {% data variables.product.pat_v1 %}. These tokens grant access to all repositories within the organizations that you have access to, as well as all personal repositories in your personal account. This indirectly grants broad access to all write-access users of the repository the workflow is in.
|
||||
- If you do use a {% data variables.product.pat_generic %}, you should never use a {% data variables.product.pat_generic %} from your own account. If you later leave an organization, workflows using this token will immediately break, and debugging this issue can be challenging. Instead, you should use a {% ifversion pat-v2%}{% data variables.product.pat_v2 %}s{% else %}{% data variables.product.pat_generic %}s{% endif %} for a new account that belongs to your organization and that is only granted access to the specific repositories that are needed for the workflow. Note that this approach is not scalable and should be avoided in favor of alternatives, such as deploy keys.
|
||||
5. **SSH keys on a personal account**
|
||||
- Workflows should never use the SSH keys on a personal account. Similar to personal access tokens, they grant read/write permissions to all of your personal repositories as well as all the repositories you have access to through organization membership. This indirectly grants broad access to all write-access users of the repository the workflow is in. If you're intending to use an SSH key because you only need to perform repository clones or pushes, and do not need to interact with public APIs, then you should use individual deploy keys instead.
|
||||
- Workflows should never use the SSH keys on a personal account. Similar to {% data variables.product.pat_v1_plural %}, they grant read/write permissions to all of your personal repositories as well as all the repositories you have access to through organization membership. This indirectly grants broad access to all write-access users of the repository the workflow is in. If you're intending to use an SSH key because you only need to perform repository clones or pushes, and do not need to interact with public APIs, then you should use individual deploy keys instead.
|
||||
|
||||
## Hardening for self-hosted runners
|
||||
|
||||
|
||||
@@ -36,9 +36,9 @@ The following steps occur to trigger a workflow run:
|
||||
|
||||
{% data reusables.actions.actions-do-not-trigger-workflows %} For more information, see "[Authenticating with the GITHUB_TOKEN](/actions/configuring-and-managing-workflows/authenticating-with-the-github_token)."
|
||||
|
||||
If you do want to trigger a workflow from within a workflow run, you can use a personal access token instead of `GITHUB_TOKEN` to trigger events that require a token. You'll need to create a personal access token and store it as a secret. To minimize your {% data variables.product.prodname_actions %} usage costs, ensure that you don't create recursive or unintended workflow runs. For more information about creating a personal access token, see "[Creating a personal access token](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)." For more information about storing a personal access token as a secret, see "[Creating and storing encrypted secrets](/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets)."
|
||||
If you do want to trigger a workflow from within a workflow run, you can use a {% data variables.product.pat_generic %} instead of `GITHUB_TOKEN` to trigger events that require a token. You'll need to create a {% data variables.product.pat_generic %} and store it as a secret. To minimize your {% data variables.product.prodname_actions %} usage costs, ensure that you don't create recursive or unintended workflow runs. For more information about creating a {% data variables.product.pat_generic %}, see "[Creating a {% data variables.product.pat_generic %}](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)." For more information about storing a {% data variables.product.pat_generic %} as a secret, see "[Creating and storing encrypted secrets](/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets)."
|
||||
|
||||
For example, the following workflow uses a personal access token (stored as a secret called `MY_TOKEN`) to add a label to an issue via {% data variables.product.prodname_cli %}. Any workflows that run when a label is added will run once this step is performed.
|
||||
For example, the following workflow uses a {% data variables.product.pat_generic %} (stored as a secret called `MY_TOKEN`) to add a label to an issue via {% data variables.product.prodname_cli %}. Any workflows that run when a label is added will run once this step is performed.
|
||||
|
||||
```yaml
|
||||
on:
|
||||
|
||||
@@ -497,7 +497,7 @@ jobs:
|
||||
|
||||
#### Example: Using an action inside a different private repository than the workflow
|
||||
|
||||
Your workflow must checkout the private repository and reference the action locally. Generate a personal access token and add the token as an encrypted secret. For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)" and "[Encrypted secrets](/actions/reference/encrypted-secrets)."
|
||||
Your workflow must checkout the private repository and reference the action locally. Generate a {% data variables.product.pat_generic %} and add the token as an encrypted secret. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)" and "[Encrypted secrets](/actions/reference/encrypted-secrets)."
|
||||
|
||||
Replace `PERSONAL_ACCESS_TOKEN` in the example with the name of your secret.
|
||||
|
||||
|
||||
@@ -62,7 +62,7 @@ Specifically, you can download CSV reports that list
|
||||
- all organizations
|
||||
- all repositories
|
||||
|
||||
You can also access these reports programmatically via standard HTTP authentication with a site admin account. You must use a personal access token with the `site_admin` scope. For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
You can also access these reports programmatically via standard HTTP authentication with a site admin account. You must use a {% data variables.product.pat_v1 %} with the `site_admin` scope. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
|
||||
For example, here is how you would download the "all users" report using cURL:
|
||||
|
||||
|
||||
@@ -44,7 +44,7 @@ The `actions-sync` tool can only download actions from {% data variables.product
|
||||
## Prerequisites
|
||||
|
||||
* Before using the `actions-sync` tool, you must ensure that all destination organizations already exist in your enterprise. The following example demonstrates how to sync actions to an organization named `synced-actions`. For more information, see "[Creating a new organization from scratch](/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch)."
|
||||
* You must create a personal access token (PAT) on your enterprise that can create and write to repositories in the destination organizations. For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."{% ifversion ghes %}
|
||||
* You must create a {% data variables.product.pat_generic %} on your enterprise that can create and write to repositories in the destination organizations. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."{% ifversion ghes %}
|
||||
* If you want to sync the bundled actions in the `actions` organization on {% data variables.location.product_location %}, you must be an owner of the `actions` organization.
|
||||
|
||||
{% note %}
|
||||
@@ -84,7 +84,7 @@ This example demonstrates using the `actions-sync` tool to sync an individual ac
|
||||
The above command uses the following arguments:
|
||||
|
||||
* `--cache-dir`: The cache directory on the machine running the command.
|
||||
* `--destination-token`: A personal access token for the destination enterprise instance.
|
||||
* `--destination-token`: A {% data variables.product.pat_generic %} for the destination enterprise instance.
|
||||
* `--destination-url`: The URL of the destination enterprise instance.
|
||||
* `--repo-name`: The action repository to sync. This takes the format of `owner/repository:destination_owner/destination_repository`.
|
||||
|
||||
|
||||
@@ -33,9 +33,9 @@ Other issues you should take into consideration include:
|
||||
|
||||
* **Group membership:** When you use LDAP to authenticate, users are automatically [suspended and unsuspended](/enterprise/admin/guides/user-management/suspending-and-unsuspending-users) based on restricted group membership and account status with Active Directory.
|
||||
|
||||
* **Git authentication:** SAML and CAS only supports Git authentication over HTTP or HTTPS using a [personal access token](/articles/creating-an-access-token-for-command-line-use). Password authentication over HTTP or HTTPS is not supported. LDAP supports password-based Git authentication by default, but we recommend that you [disable that method](/enterprise/admin/authentication/using-ldap#disabling-password-authentication-for-git-operations) and force authentication via a personal access token or SSH key.
|
||||
* **Git authentication:** SAML and CAS only supports Git authentication over HTTP or HTTPS using a [{% data variables.product.pat_generic %}](/articles/creating-an-access-token-for-command-line-use). Password authentication over HTTP or HTTPS is not supported. LDAP supports password-based Git authentication by default, but we recommend that you [disable that method](/enterprise/admin/authentication/using-ldap#disabling-password-authentication-for-git-operations) and force authentication via a {% data variables.product.pat_generic %} or SSH key.
|
||||
|
||||
* **API authentication:** SAML and CAS only supports API authentication using a [personal access token](/articles/creating-an-access-token-for-command-line-use). Basic authentication is not supported.
|
||||
* **API authentication:** SAML and CAS only supports API authentication using a [{% data variables.product.pat_generic %}](/articles/creating-an-access-token-for-command-line-use). Basic authentication is not supported.
|
||||
|
||||
* **Two-factor authentication:** {% data reusables.enterprise_user_management.external_auth_disables_2fa %}
|
||||
|
||||
|
||||
@@ -24,7 +24,7 @@ topics:
|
||||
|
||||
CAS is a single sign-on (SSO) protocol that centralizes authentication to multiple web applications. For more information, see "[Central Authentication Service](https://en.wikipedia.org/wiki/Central_Authentication_Service)" on Wikipedia.
|
||||
|
||||
After you configure CAS, people who use {% data variables.location.product_location %} must use a personal access token to authenticate API or Git requests over HTTP(S). CAS credentials cannot be used to authenticate these requests. For more information, see "[Creating a personal access token](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
After you configure CAS, people who use {% data variables.location.product_location %} must use a {% data variables.product.pat_generic %} to authenticate API or Git requests over HTTP(S). CAS credentials cannot be used to authenticate these requests. For more information, see "[Creating a {% data variables.product.pat_generic %}](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
|
||||
If you configure CAS, people with accounts on your identity provider (IdP) do not consume a user license until the person signs into {% data variables.location.product_location %}.
|
||||
|
||||
|
||||
@@ -36,9 +36,9 @@ For more information about using OIDC with {% data variables.product.prodname_em
|
||||
|
||||
### {% data variables.product.prodname_actions %}
|
||||
|
||||
Actions that use a personal access token will likely be blocked by your IdP's CAP. We recommend that personal access tokens are created by a service account which is then exempted from IP controls in your IdP's CAP.
|
||||
Actions that use a {% data variables.product.pat_generic %} will likely be blocked by your IdP's CAP. We recommend that {% data variables.product.pat_generic %}s are created by a service account which is then exempted from IP controls in your IdP's CAP.
|
||||
|
||||
If you're unable to use a service account, another option for unblocking actions that use personal access tokens is to allow the IP ranges used by {% data variables.product.prodname_actions %}. For more information, see "[About GitHub's IP addresses](/authentication/keeping-your-account-and-data-secure/about-githubs-ip-addresses)."
|
||||
If you're unable to use a service account, another option for unblocking actions that use {% data variables.product.pat_generic %}s is to allow the IP ranges used by {% data variables.product.prodname_actions %}. For more information, see "[About GitHub's IP addresses](/authentication/keeping-your-account-and-data-secure/about-githubs-ip-addresses)."
|
||||
|
||||
### {% data variables.product.prodname_github_apps %} and {% data variables.product.prodname_oauth_apps %}
|
||||
|
||||
|
||||
@@ -25,7 +25,7 @@ You can use {% data variables.product.prodname_emus %} with Okta as your identit
|
||||
|
||||
Before you can configure provisioning with Okta, you must configure SAML single-sign on. For more information, see "[Configuring SAML single sign-on for Enterprise Managed Users](/admin/identity-and-access-management/managing-iam-with-enterprise-managed-users/configuring-saml-single-sign-on-for-enterprise-managed-users)."
|
||||
|
||||
To configure provisioning with Okta, you must set your enterprise's name in the {% data variables.product.prodname_emu_idp_application %} application and enter your setup user's personal access token. You can then start provisioning users in Okta.
|
||||
To configure provisioning with Okta, you must set your enterprise's name in the {% data variables.product.prodname_emu_idp_application %} application and enter your setup user's {% data variables.product.pat_generic %}. You can then start provisioning users in Okta.
|
||||
|
||||
## Supported features
|
||||
|
||||
@@ -60,14 +60,14 @@ After your {% data variables.enterprise.prodname_emu_enterprise %} has been crea
|
||||
|
||||
After setting your enterprise name, you can proceed to configure provisioning settings.
|
||||
|
||||
To configure provisioning, the setup user with the **@<em>SHORT-CODE</em>_admin** username will need to provide a personal access token with the **admin:enterprise** scope. For more information on creating a new token, see "[Creating a personal access token](/github/setting-up-and-managing-your-enterprise/managing-your-enterprise-users-with-your-identity-provider/configuring-scim-provisioning-for-enterprise-managed-users#creating-a-personal-access-token)."
|
||||
To configure provisioning, the setup user with the **@<em>SHORT-CODE</em>_admin** username will need to provide a {% data variables.product.pat_v1 %} with the **admin:enterprise** scope. For more information on creating a new token, see "[Creating a {% data variables.product.pat_generic %}](/github/setting-up-and-managing-your-enterprise/managing-your-enterprise-users-with-your-identity-provider/configuring-scim-provisioning-for-enterprise-managed-users#creating-a-personal-access-token)."
|
||||
|
||||
1. Navigate to your {% data variables.product.prodname_emu_idp_application %} application on Okta.
|
||||
1. Click the **Provisioning** tab.
|
||||
1. In the settings menu, click **Integration**.
|
||||
1. To make changes, click **Edit**.
|
||||
1. Select **Enable API integration**.
|
||||
1. In the "API Token" field, enter the personal access token with the **admin:enterprise** scope belonging to the setup user.
|
||||
1. In the "API Token" field, enter the {% data variables.product.pat_v1 %} with the **admin:enterprise** scope belonging to the setup user.
|
||||
|
||||
1. Click **Test API Credentials**. If the test is successful, a verification message will appear at the top of the screen.
|
||||
1. To save the token, click **Save**.
|
||||
|
||||
@@ -30,9 +30,9 @@ Before you can configure provisioning for {% data variables.product.prodname_emu
|
||||
- For more information on configuring OIDC, see "[Configuring OIDC for Enterprise Managed Users](/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-oidc-for-enterprise-managed-users)"
|
||||
- {% endif %}For information on configuring SAML, see "[Configuring SAML single sign-on for Enterprise Managed Users](/admin/identity-and-access-management/managing-iam-with-enterprise-managed-users/configuring-saml-single-sign-on-for-enterprise-managed-users)."
|
||||
|
||||
## Creating a personal access token
|
||||
## Creating a {% data variables.product.pat_generic %}
|
||||
|
||||
To configure provisioning for your {% data variables.enterprise.prodname_emu_enterprise %}, you need a personal access token with the **admin:enterprise** scope that belongs to the setup user.
|
||||
To configure provisioning for your {% data variables.enterprise.prodname_emu_enterprise %}, you need a {% data variables.product.pat_v1 %} with the **admin:enterprise** scope that belongs to the setup user.
|
||||
|
||||
{% warning %}
|
||||
|
||||
@@ -59,7 +59,7 @@ To configure provisioning for your {% data variables.enterprise.prodname_emu_ent
|
||||
|
||||
## Configuring provisioning for {% data variables.product.prodname_emus %}
|
||||
|
||||
After creating your personal access token and storing it securely, you can configure provisioning on your identity provider.
|
||||
After creating your {% data variables.product.pat_generic %} and storing it securely, you can configure provisioning on your identity provider.
|
||||
|
||||
{% data reusables.scim.emu-scim-rate-limit %}
|
||||
|
||||
|
||||
@@ -47,11 +47,11 @@ If you're new to {% data variables.product.prodname_emus %} and haven't yet conf
|
||||
|
||||
1. Read both warnings and click to continue.
|
||||
{% data reusables.enterprise-accounts.emu-azure-admin-consent %}
|
||||
1. In a new tab or window, while signed in as the setup user on {% data variables.product.prodname_dotcom_the_website %}, create a personal access token with the **admin:enterprise** scope and **no expiration** and copy it to your clipboard. For more information about creating a new token, see "[Creating a personal access token](/github/setting-up-and-managing-your-enterprise/managing-your-enterprise-users-with-your-identity-provider/configuring-scim-provisioning-for-enterprise-managed-users#creating-a-personal-access-token)."
|
||||
1. In a new tab or window, while signed in as the setup user on {% data variables.product.prodname_dotcom_the_website %}, create a {% data variables.product.pat_v1 %} with the **admin:enterprise** scope and **no expiration** and copy it to your clipboard. For more information about creating a new token, see "[Creating a {% data variables.product.pat_generic %}](/github/setting-up-and-managing-your-enterprise/managing-your-enterprise-users-with-your-identity-provider/configuring-scim-provisioning-for-enterprise-managed-users#creating-a-personal-access-token)."
|
||||
1. In the settings for the {% data variables.product.prodname_emu_idp_oidc_application %} application in Azure Portal, under "Tenant URL", type `https://api.github.com/scim/v2/enterprises/YOUR_ENTERPRISE`, replacing YOUR_ENTERPRISE with the name of your enterprise account.
|
||||
|
||||
For example, if your enterprise account's URL is `https://github.com/enterprises/octo-corp`, the name of the enterprise account is `octo-corp`.
|
||||
1. Under "Secret token", paste the personal access token with the **admin:enterprise** scope that you created earlier.
|
||||
1. Under "Secret token", paste the {% data variables.product.pat_v1 %} with the **admin:enterprise** scope that you created earlier.
|
||||
1. To test the configuration, click **Test Connection**.
|
||||
1. To save your changes, at the top of the form, click **Save**.
|
||||
1. In Azure Portal, copy the users and groups from the old {% data variables.product.prodname_emu_idp_application %} application to the new {% data variables.product.prodname_emu_idp_oidc_application %} application.
|
||||
|
||||
@@ -89,11 +89,11 @@ Use these attributes to finish configuring LDAP for {% data variables.location.p
|
||||
|
||||
### Disabling password authentication for Git operations
|
||||
|
||||
Select **Disable username and password authentication for Git operations** in your LDAP settings to enforce use of personal access tokens or SSH keys for Git access, which can help prevent your server from being overloaded by LDAP authentication requests. We recommend this setting because a slow-responding LDAP server, especially combined with a large number of requests due to polling, is a frequent source of performance issues and outages.
|
||||
Select **Disable username and password authentication for Git operations** in your LDAP settings to enforce use of {% data variables.product.pat_generic %}s or SSH keys for Git access, which can help prevent your server from being overloaded by LDAP authentication requests. We recommend this setting because a slow-responding LDAP server, especially combined with a large number of requests due to polling, is a frequent source of performance issues and outages.
|
||||
|
||||
|
||||
|
||||
When this option is selected, if a user tries to use a password for Git operations via the command line, they will receive an error message that says, `Password authentication is not allowed for Git operations. You must use a personal access token.`
|
||||
When this option is selected, if a user tries to use a password for Git operations via the command line, they will receive an error message that says, `Password authentication is not allowed for Git operations. You must use a {% data variables.product.pat_generic %}.`
|
||||
|
||||
### Enabling LDAP certificate verification
|
||||
|
||||
|
||||
@@ -81,9 +81,9 @@ To enable single sign-on (SSO) for {% data variables.product.prodname_ghe_manage
|
||||
|
||||
## Enabling API integration
|
||||
|
||||
The "GitHub AE" app in Okta uses the {% data variables.product.product_name %} API to interact with your enterprise for SCIM and SSO. This procedure explains how to enable and test access to the API by configuring Okta with a personal access token for {% data variables.product.prodname_ghe_managed %}.
|
||||
The "GitHub AE" app in Okta uses the {% data variables.product.product_name %} API to interact with your enterprise for SCIM and SSO. This procedure explains how to enable and test access to the API by configuring Okta with a {% data variables.product.pat_generic %} for {% data variables.product.prodname_ghe_managed %}.
|
||||
|
||||
1. In {% data variables.product.prodname_ghe_managed %}, generate a personal access token with the `admin:enterprise` scope. For more information, see "[Creating a personal access token](/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token)".
|
||||
1. In {% data variables.product.prodname_ghe_managed %}, generate a {% data variables.product.pat_v1 %} with the `admin:enterprise` scope. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token)".
|
||||
{% data reusables.saml.okta-ae-applications-menu %}
|
||||
{% data reusables.saml.okta-ae-configure-app %}
|
||||
{% data reusables.saml.okta-ae-provisioning-tab %}
|
||||
@@ -93,7 +93,7 @@ The "GitHub AE" app in Okta uses the {% data variables.product.product_name %} A
|
||||
|
||||
|
||||
|
||||
1. For "API Token", type the {% data variables.product.prodname_ghe_managed %} personal access token you generated previously.
|
||||
1. For "API Token", type the {% data variables.product.prodname_ghe_managed %} {% data variables.product.pat_generic %} you generated previously.
|
||||
|
||||
1. Click **Test API Credentials**.
|
||||
|
||||
|
||||
@@ -48,17 +48,17 @@ You must have administrative access on your IdP to configure the application for
|
||||
|
||||
## Enabling user provisioning for your enterprise
|
||||
|
||||
1. While signed into {% data variables.location.product_location %} as an enterprise owner, create a personal access token with **admin:enterprise** scope. For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
1. While signed into {% data variables.location.product_location %} as an enterprise owner, create a {% data variables.product.pat_v1 %} with **admin:enterprise** scope. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
{% note %}
|
||||
|
||||
**Notes**:
|
||||
- To create the personal access token, we recommend using the account for the first enterprise owner that you created during initialization. For more information, see "[Initializing {% data variables.product.prodname_ghe_managed %}](/admin/configuration/initializing-github-ae)."
|
||||
- You'll need this personal access token to configure the application for SCIM on your IdP. Store the token securely in a password manager until you need the token again later in these instructions.
|
||||
- To create the {% data variables.product.pat_generic %}, we recommend using the account for the first enterprise owner that you created during initialization. For more information, see "[Initializing {% data variables.product.prodname_ghe_managed %}](/admin/configuration/initializing-github-ae)."
|
||||
- You'll need this {% data variables.product.pat_generic %} to configure the application for SCIM on your IdP. Store the token securely in a password manager until you need the token again later in these instructions.
|
||||
|
||||
{% endnote %}
|
||||
{% warning %}
|
||||
|
||||
**Warning**: If the user account for the enterprise owner who creates the personal access token is deactivated or deprovisioned, your IdP will no longer provision and deprovision user accounts for your enterprise automatically. Another enterprise owner must create a new personal access token and reconfigure provisioning on the IdP.
|
||||
**Warning**: If the user account for the enterprise owner who creates the {% data variables.product.pat_generic %} is deactivated or deprovisioned, your IdP will no longer provision and deprovision user accounts for your enterprise automatically. Another enterprise owner must create a new {% data variables.product.pat_generic %} and reconfigure provisioning on the IdP.
|
||||
|
||||
{% endwarning %}
|
||||
{% data reusables.enterprise-accounts.access-enterprise %}
|
||||
@@ -82,4 +82,4 @@ You must have administrative access on your IdP to configure the application for
|
||||
| Value | Other names | Description | Example |
|
||||
| :- | :- | :- | :- |
|
||||
| URL | Tenant URL | URL to the SCIM provisioning API for your enterprise on {% data variables.product.prodname_ghe_managed %} | <nobr><code>{% data variables.product.api_url_pre %}/scim/v2</nobr></code> |
|
||||
| Shared secret | Personal access token, secret token | Token for application on your IdP to perform provisioning tasks on behalf of an enterprise owner | Personal access token you created in step 1 |
|
||||
| Shared secret | {% data variables.product.pat_generic_caps %}, secret token | Token for application on your IdP to perform provisioning tasks on behalf of an enterprise owner | {% data variables.product.pat_generic_caps %} you created in step 1 |
|
||||
|
||||
@@ -28,7 +28,7 @@ After you configure SAML SSO for your enterprise account, the new configuration
|
||||
|
||||
Enterprise members will not be notified when an enterprise owner enables SAML for the enterprise account. If SAML SSO was previously enforced at the organization level, members should not see a major difference when navigating directly to organization resources. The members will continue to be prompted to authenticate via SAML. If members navigate to organization resources via their IdP dashboard, they will need to click the new tile for the enterprise-level app, instead of the old tile for the organization-level app. The members will then be able to choose the organization to navigate to.
|
||||
|
||||
Any personal access tokens (PATs), SSH keys, {% data variables.product.prodname_oauth_apps %}, and {% data variables.product.prodname_github_apps %} that were previously authorized for the organization will continue to be authorized for the organization. However, members will need to authorize any PATs, SSH keys, {% data variables.product.prodname_oauth_apps %}, and {% data variables.product.prodname_github_apps %} that were never authorized for use with SAML SSO for the organization.
|
||||
Any {% data variables.product.pat_generic %}s, SSH keys, {% data variables.product.prodname_oauth_apps %}, and {% data variables.product.prodname_github_apps %} that were previously authorized for the organization will continue to be authorized for the organization. However, members will need to authorize any PATs, SSH keys, {% data variables.product.prodname_oauth_apps %}, and {% data variables.product.prodname_github_apps %} that were never authorized for use with SAML SSO for the organization.
|
||||
|
||||
SCIM provisioning is not currently supported when SAML SSO is configured for an enterprise account. If you are currently using SCIM for an organization owned by your enterprise account, you will lose this functionality when switching to an enterprise-level configuration.
|
||||
|
||||
@@ -41,5 +41,5 @@ You are not required to remove any organization-level SAML configurations before
|
||||
1. If you kept any organization-level SAML configurations in place, to prevent confusion, consider hiding the tile for the organization-level apps in your IdP.
|
||||
1. Advise your enterprise members about the change.
|
||||
- Members will no longer be able to access their organizations by clicking the SAML app for the organization in the IdP dashboard. They will need to use the new app configured for the enterprise account.
|
||||
- Members will need to authorize any PATs or SSH keys that were not previously authorized for use with SAML SSO for their organization. For more information, see "[Authorizing a personal access token for use with SAML single sign-on](/github/authenticating-to-github/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on)" and "[Authorizing an SSH key for use with SAML single sign-on](/github/authenticating-to-github/authenticating-with-saml-single-sign-on/authorizing-an-ssh-key-for-use-with-saml-single-sign-on)."
|
||||
- Members will need to authorize any PATs or SSH keys that were not previously authorized for use with SAML SSO for their organization. For more information, see "[Authorizing a {% data variables.product.pat_generic %} for use with SAML single sign-on](/github/authenticating-to-github/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on)" and "[Authorizing an SSH key for use with SAML single sign-on](/github/authenticating-to-github/authenticating-with-saml-single-sign-on/authorizing-an-ssh-key-for-use-with-saml-single-sign-on)."
|
||||
- Members may need to reauthorize {% data variables.product.prodname_oauth_apps %} that were previously authorized for the organization. For more information, see "[About authentication with SAML single sign-on](/github/authenticating-to-github/authenticating-with-saml-single-sign-on/about-authentication-with-saml-single-sign-on#about-oauth-apps-github-apps-and-saml-sso)."
|
||||
|
||||
@@ -573,7 +573,7 @@ Before you'll see `git` category actions, you must enable Git events in the audi
|
||||
|
||||
| Action | Description
|
||||
|--------|-------------
|
||||
`oauth_access.create` | An [OAuth access token][] was generated for a user account. For more information, see "[Creating a personal access token](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
`oauth_access.create` | An [OAuth access token][] was generated for a user account. For more information, see "[Creating a {% data variables.product.pat_generic %}](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
`oauth_access.destroy` | An [OAuth access token][] was deleted from a user account.
|
||||
|
||||
[OAuth access token]: /developers/apps/building-oauth-apps/authorizing-oauth-apps
|
||||
|
||||
@@ -129,7 +129,7 @@ For more information about {% data variables.product.product_name %}'s user perm
|
||||
- SSH public key authentication provides both repository access using Git and administrative shell access. For more information, see "[About SSH](/authentication/connecting-to-github-with-ssh/about-ssh)" and "[Accessing the administrative shell (SSH)](/admin/configuration/configuring-your-enterprise/accessing-the-administrative-shell-ssh)."
|
||||
- Username and password authentication with HTTP cookies provides web application access and session management, with optional two-factor authentication (2FA). For more information, see "[Using built-in authentication](/admin/identity-and-access-management/authenticating-users-for-your-github-enterprise-server-instance/using-built-in-authentication)."
|
||||
- External LDAP, SAML, or CAS authentication using an LDAP service, SAML Identity Provider (IdP), or other compatible service provides access to the web application. For more information, see "[Managing IAM for your enterprise](/admin/identity-and-access-management/managing-iam-for-your-enterprise)."
|
||||
- OAuth and Personal Access Tokens provide access to Git repository data and APIs for both external clients and services. For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
- OAuth and {% data variables.product.pat_generic %}s provide access to Git repository data and APIs for both external clients and services. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
|
||||
### Audit and access logging
|
||||
|
||||
|
||||
@@ -0,0 +1,62 @@
|
||||
---
|
||||
title: Enforcing policies for personal access tokens in your enterprise
|
||||
intro: Enterprise owners can control whether to allow {% data variables.product.pat_v2 %}s and {% data variables.product.pat_v1_plural %}, and can require approval for {% data variables.product.pat_v2 %}s.
|
||||
versions:
|
||||
feature: pat-v2-enterprise
|
||||
shortTitle: "{% data variables.product.pat_generic_caps %} policies"
|
||||
---
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**: {% data reusables.user-settings.pat-v2-beta %}
|
||||
|
||||
During the beta, enterprises must opt in to {% data variables.product.pat_v2 %}s. If your enterprise has not already opted-in, then you will be prompted to opt-in and set policies when you follow the steps below.
|
||||
|
||||
Even if an enterprise has not opted in to {% data variables.product.pat_v2 %}s, organizations owned by the enterprise can still opt in. All users, including {% data variables.product.prodname_emus %}, can create {% data variables.product.pat_v2 %}s that can access resources owned by the user (such as repositories created under their account) even if the enterprise has not opted in to {% data variables.product.pat_v2 %}s.
|
||||
|
||||
{% endnote %}
|
||||
|
||||
## Restricting access by {% data variables.product.pat_v2 %}s
|
||||
|
||||
Enterprise owners can prevent {% data variables.product.pat_v2 %}s from accessing private and internal resources owned by the enterprise. {% data variables.product.pat_v2_caps %}s will still be able to access public resources within the organizations. This setting only controls access by {% data variables.product.pat_v2 %}s, not {% data variables.product.pat_v1_plural %}. For more information about restricting access by {% data variables.product.pat_v1_plural %}, see "[Restricting access by {% data variables.product.pat_v1_plural %}](#restricting-access-by-personal-access-tokens-classic)" on this page.
|
||||
|
||||
{% data reusables.enterprise-accounts.access-enterprise %}
|
||||
{% data reusables.enterprise-accounts.policies-tab %}
|
||||
1. Under {% octicon "law" aria-label="The law icon" %} **Policies**, click **Organizations**.
|
||||
1. Under **Restrict access via {% data variables.product.pat_v2 %}s**, select the option that meets your needs:
|
||||
- **Allow organizations to configure access requirements**: Each organization owned by the enterprise can decide whether to restrict access by {% data variables.product.pat_v2 %}s.
|
||||
- **Restrict access via {% data variables.product.pat_v2 %}s**: {% data variables.product.pat_v2_caps %}s cannot access organizations owned by the enterprise. SSH keys created by {% data variables.product.pat_v2 %}s will continue to work. Organizations cannot override this setting.
|
||||
- **Allow access via {% data variables.product.pat_v2 %}s**: {% data variables.product.pat_v2_caps %}s can access organizations owned by the enterprise. Organizations cannot override this setting.
|
||||
1. Click **Save**.
|
||||
|
||||
## Enforcing an approval policy for {% data variables.product.pat_v2 %}s
|
||||
|
||||
Enterprise owners can require that all organizations owned by the enterprise must approve each {% data variables.product.pat_v2 %} that can access the organization. {% data variables.product.pat_v2_caps %}s will still be able to read public resources within the organization without approval. Conversely, enterprise owners can allow {% data variables.product.pat_v2 %}s to access organizations in the enterprise without prior approval. Enterprise owners can also let each organization in the enterprise choose their own approval settings.
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**: Only {% data variables.product.pat_v2 %}s, not {% data variables.product.pat_v1_plural %}, are subject to approval. Unless the organization or enterprise has restricted access by {% data variables.product.pat_v1_plural %}, any {% data variables.product.pat_v1 %} can access organization resources without prior approval. For more information about restricting {% data variables.product.pat_v1_plural %}, see "[Restricting access by {% data variables.product.pat_v1_plural %}](#restricting-access-by-personal-access-tokens-classic)" on this page and "[Setting a {% data variables.product.pat_generic %} policy for your organization](/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
{% data reusables.enterprise-accounts.access-enterprise %}
|
||||
{% data reusables.enterprise-accounts.policies-tab %}
|
||||
1. Under {% octicon "law" aria-label="The law icon" %} **Policies**, click **Organizations**.
|
||||
1. Under **Require approval of {% data variables.product.pat_v2 %}s**, select the option that meets your needs:
|
||||
- **Allow organizations to configure approval requirements**: Each organization owned by the enterprise can decide whether to require approval of {% data variables.product.pat_v2 %} that can access the organization.
|
||||
- **Require organizations to use the approval flow**: All organizations owned by the enterprise must approve each {% data variables.product.pat_v2 %} that can access the organization. {% data variables.product.pat_v2_caps %}s created by organization owners will not need approval. Organizations cannot override this setting.
|
||||
- **Disable the approval flow in all organizations**: {% data variables.product.pat_v2_caps %}s created by organization members can access organizations owned by the enterprise without prior approval. Organizations cannot override this setting.
|
||||
1. Click **Save**.
|
||||
|
||||
## Restricting access by {% data variables.product.pat_v1_plural %}
|
||||
|
||||
Enterprise owners can prevent {% data variables.product.pat_v1_plural %} from accessing the enterprise and organizations owned by the enterprise. {% data variables.product.pat_v1_caps_plural %} will still be able to access public resources within the organization. This setting only controls access by {% data variables.product.pat_v1_plural %}, not {% data variables.product.pat_v2 %}s. For more information about restricting access by {% data variables.product.pat_v2 %}s, see "[Restricting access by {% data variables.product.pat_v2 %}s](#restricting-access-by-fine-grained-personal-access-tokens)" on this page.
|
||||
|
||||
{% data reusables.enterprise-accounts.access-enterprise %}
|
||||
{% data reusables.enterprise-accounts.policies-tab %}
|
||||
1. Under {% octicon "law" aria-label="The law icon" %} **Policies**, click **Organizations**.
|
||||
1. Under **Restrict {% data variables.product.pat_v1_plural %} from accessing your organizations**, select the option that meets your needs:
|
||||
- **Allow organizations to configure {% data variables.product.pat_v1_plural %} access requirements**: Each organization owned by the enterprise can decide whether to restrict access by {% data variables.product.pat_v1_plural %}.
|
||||
- **Restrict access via {% data variables.product.pat_v1_plural %}**: {% data variables.product.pat_v1_caps_plural %} cannot access the enterprise or organizations owned by the enterprise. SSH keys created by {% data variables.product.pat_v1_plural %} will continue to work. Organizations cannot override this setting.
|
||||
- **Allow access via {% data variables.product.pat_v1_plural %}**: {% data variables.product.pat_v1_caps_plural %} can access the enterprise and organizations owned by the enterprise. Organizations cannot override this setting.
|
||||
1. Click **Save**.
|
||||
@@ -22,6 +22,7 @@ children:
|
||||
- /enforcing-policies-for-dependency-insights-in-your-enterprise
|
||||
- /enforcing-policies-for-github-actions-in-your-enterprise
|
||||
- /enforcing-policies-for-code-security-and-analysis-for-your-enterprise
|
||||
- /enforcing-policies-for-personal-access-tokens-in-your-enterprise
|
||||
shortTitle: Enforce policies
|
||||
---
|
||||
|
||||
|
||||
@@ -31,7 +31,7 @@ After you add an existing organization to your enterprise, the organization's re
|
||||
- Enterprise owners can manage their role within the organization. For more information, see "[Managing your role in an organization owned by your enterprise](/admin/user-management/managing-organizations-in-your-enterprise/managing-your-role-in-an-organization-owned-by-your-enterprise)."
|
||||
- Any policies applied to the enterprise will apply to the organization. For more information, see "[About enterprise policies](/admin/policies/enforcing-policies-for-your-enterprise/about-enterprise-policies)."
|
||||
- If SAML SSO is configured for the enterprise account, the enterprise's SAML configuration will apply to the organization. If the organization used SAML SSO, the enterprise account's configuration will replace the organization's configuration. SCIM is not available for enterprise accounts, so SCIM will be disabled for the organization. For more information, see "[Configuring SAML single sign-on for your enterprise](/admin/identity-and-access-management/using-saml-for-enterprise-iam/configuring-saml-single-sign-on-for-your-enterprise)" and "[Switching your SAML configuration from an organization to an enterprise account](/admin/identity-and-access-management/using-saml-for-enterprise-iam/switching-your-saml-configuration-from-an-organization-to-an-enterprise-account)."
|
||||
- If SAML SSO was configured for the organization, members' existing personal access tokens (PATs) or SSH keys that were authorized to access the organization's resources will be authorized to access the same resources. To access additional organizations owned by the enterprise, members must authorize the PAT or key. For more information, see "[Authorizing a personal access token for use with SAML single sign-on](/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on)" and "[Authorizing an SSH key for use with SAML single sign-on](/authentication/authenticating-with-saml-single-sign-on/authorizing-an-ssh-key-for-use-with-saml-single-sign-on)."
|
||||
- If SAML SSO was configured for the organization, members' existing {% data variables.product.pat_generic %} or SSH keys that were authorized to access the organization's resources will be authorized to access the same resources. To access additional organizations owned by the enterprise, members must authorize the {% data variables.product.pat_generic %} or key. For more information, see "[Authorizing a {% data variables.product.pat_generic %} for use with SAML single sign-on](/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on)" and "[Authorizing an SSH key for use with SAML single sign-on](/authentication/authenticating-with-saml-single-sign-on/authorizing-an-ssh-key-for-use-with-saml-single-sign-on)."
|
||||
- If the organization was connected to {% data variables.product.prodname_ghe_server %} or {% data variables.product.prodname_ghe_managed %} using {% data variables.product.prodname_github_connect %}, adding the organization to an enterprise will not update the connection. {% data variables.product.prodname_github_connect %} features will no longer function for the organization. To continue using {% data variables.product.prodname_github_connect %}, you must disable and re-enable the feature. For more information, see the following articles.
|
||||
|
||||
- "[Managing {% data variables.product.prodname_github_connect %}](/enterprise-server@latest/admin/configuration/configuring-github-connect/managing-github-connect)" in the {% data variables.product.prodname_ghe_server %} documentation
|
||||
|
||||
@@ -47,9 +47,9 @@ shortTitle: Export from your enterprise
|
||||
```shell
|
||||
Enter username authorized for migration: admin
|
||||
```
|
||||
4. When prompted for a personal access token, enter the access token you created in "[Preparing the {% data variables.product.prodname_ghe_server %} source instance](#preparing-the-github-enterprise-server-source-instance)":
|
||||
4. When prompted for a {% data variables.product.pat_generic %}, enter the access token you created in "[Preparing the {% data variables.product.prodname_ghe_server %} source instance](#preparing-the-github-enterprise-server-source-instance)":
|
||||
```shell
|
||||
Enter personal access token: **************
|
||||
Enter {% data variables.product.pat_generic %}: **************
|
||||
```
|
||||
5. When `ghe-migrator add` has finished it will print the unique "Migration GUID" that it generated to identify this export as well as a list of the resources that were added to the export. You will use the Migration GUID that it generated in subsequent `ghe-migrator add` and `ghe-migrator export` steps to tell `ghe-migrator` to continue operating on the same export.
|
||||
```shell
|
||||
|
||||
@@ -30,7 +30,7 @@ After you prepare the data and resolve conflicts, you can apply the imported dat
|
||||
|
||||
2. Using the `ghe-migrator import` command, start the import process. You'll need:
|
||||
* Your Migration GUID. For more information, see "[Preparing to migrate data to your enterprise](/admin/user-management/preparing-to-migrate-data-to-your-enterprise)."
|
||||
* Your personal access token for authentication. The personal access token that you use is only for authentication as a site administrator, and does not require any specific scope. For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
* Your {% data variables.product.pat_generic %} for authentication. The {% data variables.product.pat_generic %} that you use is only for authentication as a site administrator, and does not require any specific scope{% ifversion pat-v2 %} or permissions{% endif %}. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
|
||||
```shell
|
||||
$ ghe-migrator import /home/admin/MIGRATION-GUID.tar.gz -g MIGRATION-GUID -u USERNAME -p TOKEN
|
||||
|
||||
@@ -46,13 +46,13 @@ If you sign in with a SAML identity that is already linked to another {% data va
|
||||
|
||||
If the SAML identity you sign in with does not match the SAML identity that is currently linked to your {% data variables.product.prodname_dotcom %} account, you'll receive a warning that you are about to relink your account. Because your SAML identity is used to govern access and team membership, continuing with the new SAML identity can cause you to lose access to teams and organizations inside of {% data variables.product.prodname_dotcom %}. Only continue if you know that you're supposed to use that new SAML identity for authentication in the future.
|
||||
|
||||
## Authorizing PATs and SSH keys with SAML SSO
|
||||
## Authorizing {% data variables.product.pat_generic %}s and SSH keys with SAML SSO
|
||||
|
||||
To use the API or Git on the command line to access protected content in an organization that uses SAML SSO, you will need to use an authorized personal access token over HTTPS or an authorized SSH key.
|
||||
To use the API or Git on the command line to access protected content in an organization that uses SAML SSO, you will need to use an authorized {% data variables.product.pat_generic %} over HTTPS or an authorized SSH key.
|
||||
|
||||
If you don't have a personal access token or an SSH key, you can create a personal access token for the command line or generate a new SSH key. For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)" or "[Generating a new SSH key and adding it to the ssh-agent](/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent)."
|
||||
If you don't have a {% data variables.product.pat_generic %} or an SSH key, you can create a {% data variables.product.pat_generic %} for the command line or generate a new SSH key. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)" or "[Generating a new SSH key and adding it to the ssh-agent](/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent)."
|
||||
|
||||
To use a new or existing personal access token or SSH key with an organization that uses or enforces SAML SSO, you will need to authorize the token or authorize the SSH key for use with a SAML SSO organization. For more information, see "[Authorizing a personal access token for use with SAML single sign-on](/articles/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on)" or "[Authorizing an SSH key for use with SAML single sign-on](/articles/authorizing-an-ssh-key-for-use-with-saml-single-sign-on)."
|
||||
To use a new or existing {% data variables.product.pat_generic %} or SSH key with an organization that uses or enforces SAML SSO, you will need to authorize the token or authorize the SSH key for use with a SAML SSO organization. For more information, see "[Authorizing a {% data variables.product.pat_generic %} for use with SAML single sign-on](/articles/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on)" or "[Authorizing an SSH key for use with SAML single sign-on](/articles/authorizing-an-ssh-key-for-use-with-saml-single-sign-on)."
|
||||
|
||||
## About {% data variables.product.prodname_oauth_apps %}, {% data variables.product.prodname_github_apps %}, and SAML SSO
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Authorizing a personal access token for use with SAML single sign-on
|
||||
intro: 'To use a personal access token with an organization that uses SAML single sign-on (SSO), you must first authorize the token.'
|
||||
intro: 'To use a {% data variables.product.pat_v1 %} with an organization that uses SAML single sign-on (SSO), you must first authorize the token.'
|
||||
redirect_from:
|
||||
- /articles/authorizing-a-personal-access-token-for-use-with-a-saml-single-sign-on-organization
|
||||
- /articles/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on
|
||||
@@ -10,9 +10,9 @@ versions:
|
||||
ghec: '*'
|
||||
topics:
|
||||
- SSO
|
||||
shortTitle: PAT with SAML
|
||||
shortTitle: '{% data variables.product.pat_generic_caps %} with SAML'
|
||||
---
|
||||
You can authorize an existing personal access token, or [create a new personal access token](/github/authenticating-to-github/creating-a-personal-access-token) and then authorize it.
|
||||
You must authorize your {% data variables.product.pat_v1 %} after creation before the token can access an organization that uses SAML single sign-on (SSO). For more information about creating a new {% data variables.product.pat_v1 %}, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."{% ifversion pat-v2 %} {% data variables.product.pat_v2_caps %}s are authorized during token creation, before access to the organization is granted.{% endif %}
|
||||
|
||||
{% data reusables.saml.must-authorize-linked-identity %}
|
||||
|
||||
@@ -23,11 +23,11 @@ You can authorize an existing personal access token, or [create a new personal a
|
||||
{% data reusables.user-settings.personal_access_tokens %}
|
||||
3. Next to the token you'd like to authorize, click **Configure SSO**. {% data reusables.saml.authenticate-with-saml-at-least-once %}
|
||||
|
||||
|
||||
|
||||
4. To the right of the organization you'd like to authorize the token for, click **Authorize**.
|
||||
|
||||
|
||||
## Further reading
|
||||
|
||||
- "[Creating a personal access token](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)"
|
||||
- "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)"
|
||||
- "[About authentication with SAML single sign-on](/articles/about-authentication-with-saml-single-sign-on)"
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: About SSH
|
||||
intro: 'Using the SSH protocol, you can connect and authenticate to remote servers and services. With SSH keys, you can connect to {% data variables.product.product_name %} without supplying your username and personal access token at each visit.{% ifversion ssh-commit-verification %} You can also use an SSH key to sign commits.{% endif %}'
|
||||
intro: 'Using the SSH protocol, you can connect and authenticate to remote servers and services. With SSH keys, you can connect to {% data variables.product.product_name %} without supplying your username and {% data variables.product.pat_generic %} at each visit.{% ifversion ssh-commit-verification %} You can also use an SSH key to sign commits.{% endif %}'
|
||||
redirect_from:
|
||||
- /articles/about-ssh
|
||||
- /github/authenticating-to-github/about-ssh
|
||||
|
||||
@@ -22,7 +22,7 @@ You can access your resources in {% data variables.product.product_name %} in a
|
||||
{%- ifversion not fpt %}
|
||||
- Your identity provider (IdP){% endif %}{% ifversion not ghae %}
|
||||
- Username and password with two-factor authentication{% endif %}
|
||||
- Personal access token
|
||||
- {% data variables.product.pat_generic_caps %}
|
||||
- SSH key
|
||||
|
||||
## Authenticating in your browser
|
||||
@@ -67,8 +67,8 @@ You can authenticate with {% data variables.product.prodname_desktop %} using yo
|
||||
|
||||
You can authenticate with the API in different ways.
|
||||
|
||||
- **Personal access tokens**
|
||||
- In limited situations, such as testing, you can use a personal access token to access the API. Using a personal access token enables you to revoke access at any time. For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
- **{% data variables.product.pat_generic_caps %}s**
|
||||
- In limited situations, such as testing, you can use a {% data variables.product.pat_generic %} to access the API. Using a {% data variables.product.pat_generic %} enables you to revoke access at any time. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
- **Web application flow**
|
||||
- For OAuth Apps in production, you should authenticate using the web application flow. For more information, see "[Authorizing OAuth Apps](/apps/building-oauth-apps/authorizing-oauth-apps/#web-application-flow)."
|
||||
- **GitHub Apps**
|
||||
@@ -82,22 +82,22 @@ You can access repositories on {% data variables.product.product_name %} from th
|
||||
|
||||
You can work with all repositories on {% data variables.product.product_name %} over HTTPS, even if you are behind a firewall or proxy.
|
||||
|
||||
If you authenticate with {% data variables.product.prodname_cli %}, you can either authenticate with a personal access token or via the web browser. For more information about authenticating with {% data variables.product.prodname_cli %}, see [`gh auth login`](https://cli.github.com/manual/gh_auth_login).
|
||||
If you authenticate with {% data variables.product.prodname_cli %}, you can either authenticate with a {% data variables.product.pat_generic %} or via the web browser. For more information about authenticating with {% data variables.product.prodname_cli %}, see [`gh auth login`](https://cli.github.com/manual/gh_auth_login).
|
||||
|
||||
If you authenticate without {% data variables.product.prodname_cli %}, you must authenticate with a personal access token. {% data reusables.user-settings.password-authentication-deprecation %} Every time you use Git to authenticate with {% data variables.product.product_name %}, you'll be prompted to enter your credentials to authenticate with {% data variables.product.product_name %}, unless you cache them with a [credential helper](/github/getting-started-with-github/caching-your-github-credentials-in-git).
|
||||
If you authenticate without {% data variables.product.prodname_cli %}, you must authenticate with a {% data variables.product.pat_generic %}. {% data reusables.user-settings.password-authentication-deprecation %} Every time you use Git to authenticate with {% data variables.product.product_name %}, you'll be prompted to enter your credentials to authenticate with {% data variables.product.product_name %}, unless you cache them with a [credential helper](/github/getting-started-with-github/caching-your-github-credentials-in-git).
|
||||
|
||||
### SSH
|
||||
|
||||
You can work with all repositories on {% data variables.product.product_name %} over SSH, although firewalls and proxies might refuse to allow SSH connections.
|
||||
|
||||
If you authenticate with {% data variables.product.prodname_cli %}, the CLI will find SSH public keys on your machine and will prompt you to select one for upload. If {% data variables.product.prodname_cli %} does not find a SSH public key for upload, it can generate a new SSH public/private keypair and upload the public key to your account on {% ifversion ghae %}{% data variables.product.product_name %}{% else %}{% data variables.location.product_location %}{% endif %}. Then, you can either authenticate with a personal access token or via the web browser. For more information about authenticating with {% data variables.product.prodname_cli %}, see [`gh auth login`](https://cli.github.com/manual/gh_auth_login).
|
||||
If you authenticate with {% data variables.product.prodname_cli %}, the CLI will find SSH public keys on your machine and will prompt you to select one for upload. If {% data variables.product.prodname_cli %} does not find a SSH public key for upload, it can generate a new SSH public/private keypair and upload the public key to your account on {% ifversion ghae %}{% data variables.product.product_name %}{% else %}{% data variables.location.product_location %}{% endif %}. Then, you can either authenticate with a {% data variables.product.pat_generic %} or via the web browser. For more information about authenticating with {% data variables.product.prodname_cli %}, see [`gh auth login`](https://cli.github.com/manual/gh_auth_login).
|
||||
|
||||
If you authenticate without {% data variables.product.prodname_cli %}, you will need to generate an SSH public/private keypair on your local machine and add the public key to your account on {% ifversion ghae %}{% data variables.product.product_name %}{% else %}{% data variables.location.product_location %}{% endif %}. For more information, see "[Generating a new SSH key and adding it to the ssh-agent](/github/authenticating-to-github/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent)." Every time you use Git to authenticate with {% data variables.product.product_name %}, you'll be prompted to enter your SSH key passphrase, unless you've [stored the key](/github/authenticating-to-github/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent#adding-your-ssh-key-to-the-ssh-agent).
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
### Authorizing for SAML single sign-on
|
||||
|
||||
To use a personal access token or SSH key to access resources owned by an organization that uses SAML single sign-on, you must also authorize the personal token or SSH key. For more information, see "[Authorizing a personal access token for use with SAML single sign-on](/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on)" or "[Authorizing an SSH key for use with SAML single sign-on](/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-an-ssh-key-for-use-with-saml-single-sign-on){% ifversion fpt %}" in the {% data variables.product.prodname_ghe_cloud %} documentation.{% else %}."{% endif %}{% endif %}
|
||||
To use a {% data variables.product.pat_generic %} or SSH key to access resources owned by an organization that uses SAML single sign-on, you must also authorize the personal token or SSH key. For more information, see "[Authorizing a {% data variables.product.pat_generic %} for use with SAML single sign-on](/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on)" or "[Authorizing an SSH key for use with SAML single sign-on](/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-an-ssh-key-for-use-with-saml-single-sign-on){% ifversion fpt %}" in the {% data variables.product.prodname_ghe_cloud %} documentation.{% else %}."{% endif %}{% endif %}
|
||||
|
||||
## {% data variables.product.company_short %}'s token formats
|
||||
|
||||
@@ -105,7 +105,7 @@ To use a personal access token or SSH key to access resources owned by an organi
|
||||
|
||||
| Token type | Prefix | More information |
|
||||
| :- | :- | :- |
|
||||
| Personal access token | `ghp_` | "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)" |
|
||||
| {% data variables.product.pat_generic_caps %} | `ghp_` | "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)" |
|
||||
| OAuth access token | `gho_` | "[Authorizing {% data variables.product.prodname_oauth_apps %}](/developers/apps/authorizing-oauth-apps)" |
|
||||
| User-to-server token for a {% data variables.product.prodname_github_app %} | `ghu_` | "[Identifying and authorizing users for {% data variables.product.prodname_github_apps %}](/developers/apps/identifying-and-authorizing-users-for-github-apps)" |
|
||||
| Server-to-server token for a {% data variables.product.prodname_github_app %} | `ghs_` | "[Authenticating with {% data variables.product.prodname_github_apps %}](/developers/apps/authenticating-with-github-apps#authenticating-as-an-installation)" |
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Creating a personal access token
|
||||
intro: You can create a personal access token to use in place of a password with the command line or with the API.
|
||||
intro: You can create a {% data variables.product.pat_generic %} to use in place of a password with the command line or with the API.
|
||||
redirect_from:
|
||||
- /articles/creating-an-oauth-token-for-command-line-use
|
||||
- /articles/creating-an-access-token-for-command-line-use
|
||||
@@ -17,37 +17,105 @@ versions:
|
||||
topics:
|
||||
- Identity
|
||||
- Access management
|
||||
shortTitle: Create a PAT
|
||||
shortTitle: Create a {% data variables.product.pat_generic %}
|
||||
---
|
||||
{% note %}
|
||||
|
||||
**Notes:**
|
||||
{% warning %}
|
||||
|
||||
- If you use {% data variables.product.prodname_cli %} to authenticate to {% data variables.product.product_name %} on the command line, you can skip generating a personal access token and authenticate via the web browser instead. For more information about authenticating with {% data variables.product.prodname_cli %}, see [`gh auth login`](https://cli.github.com/manual/gh_auth_login).
|
||||
- [Git Credential Manager](https://github.com/GitCredentialManager/git-credential-manager/blob/main/README.md) is a secure, cross-platform alternative to using personal access tokens (PATs) and eliminates the need to manage PAT scope and expiration. For installation instructions, see [Download and install](https://github.com/GitCredentialManager/git-credential-manager/blob/main/README.md#download-and-install) in the GitCredentialManager/git-credential-manager repository.
|
||||
**Warning**: Treat your access tokens like passwords.
|
||||
|
||||
{% endnote %}
|
||||
To access {% data variables.product.company_short %} from the command line, consider using {% data variables.product.prodname_cli %} or [Git Credential Manager](https://github.com/GitCredentialManager/git-credential-manager/blob/main/README.md) instead of creating a {% data variables.product.pat_generic %}.
|
||||
|
||||
Personal access tokens (PATs) are an alternative to using passwords for authentication to {% data variables.product.product_name %} when using the [GitHub API](/rest/overview/other-authentication-methods#via-oauth-and-personal-access-tokens) or the [command line](#using-a-token-on-the-command-line).
|
||||
When using a {% data variables.product.pat_generic %} in a script, consider storing your token as a secret and running your script through {% data variables.product.prodname_actions %}. For more information, see "[Encrypted secrets](/actions/security-guides/encrypted-secrets)."{%- ifversion ghec or fpt %} You can also store your token as a {% data variables.product.prodname_codespaces %} secret and run your script in {% data variables.product.prodname_codespaces %}. For more information, see "[Managing encrypted secrets for your codespaces](/codespaces/managing-your-codespaces/managing-encrypted-secrets-for-your-codespaces)."{% endif %}
|
||||
|
||||
{% ifversion fpt or ghec %}If you want to use a PAT to access resources owned by an organization that uses SAML SSO, you must authorize the PAT. For more information, see "[About authentication with SAML single sign-on](/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/about-authentication-with-saml-single-sign-on)" and "[Authorizing a personal access token for use with SAML single sign-on](/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on){% ifversion fpt %}" in the {% data variables.product.prodname_ghe_cloud %} documentation.{% else %}."{% endif %}{% endif %}
|
||||
If these options are not possible, consider using another service such as [the 1Password CLI](https://developer.1password.com/docs/cli/secret-references/) to store your token securely.
|
||||
|
||||
{% endwarning %}
|
||||
|
||||
## About {% data variables.product.pat_generic %}s
|
||||
|
||||
{% data variables.product.pat_generic_caps %} are an alternative to using passwords for authentication to {% data variables.product.product_name %} when using the [GitHub API](/rest/overview/other-authentication-methods#via-oauth-and-personal-access-tokens) or the [command line](#using-a-token-on-the-command-line). {% data variables.product.pat_generic_caps %}s are intended to access {% data variables.product.company_short %} resources on behalf of yourself. To access resources on behalf of an organization, or for long-lived integrations, you should use a {% data variables.product.prodname_github_app %}. For more information, see "[About apps](/developers/apps/getting-started-with-apps/about-apps)."
|
||||
|
||||
{% ifversion pat-v2 %}
|
||||
|
||||
{% data variables.product.company_short %} currently supports two types of {% data variables.product.pat_generic %}s: {% data variables.product.pat_v2 %}s and {% data variables.product.pat_v1_plural %}. {% data variables.product.company_short %} recommends that you use {% data variables.product.pat_v2 %}s instead of {% data variables.product.pat_v1_plural %} whenever possible. {% data variables.product.pat_v2_caps %}s have several security advantages over {% data variables.product.pat_v1_plural %}:
|
||||
|
||||
- Each token can only access resources owned by a single user or organization.
|
||||
- Each token can only access specific repositories.
|
||||
- Each token is granted specific permissions, which offer more control than the scopes granted to {% data variables.product.pat_v1_plural %}.
|
||||
- Each token must have an expiration date.
|
||||
- Organization owners can require approval for any {% data variables.product.pat_v2 %}s that can access resources in the organization.{% ifversion ghec or ghes or ghae %}
|
||||
- Enterprise owners can require approval for any {% data variables.product.pat_v2 %}s that can access resources in organizations owned by the enterprise.{% endif %}
|
||||
|
||||
Additionally, organization owners can restrict the access of {% data variables.product.pat_v1 %} to their organization{% ifversion ghec or ghes or ghae %}, and enterprise owners can restrict the access of {% data variables.product.pat_v1 %} to the enterprise or organizations owned by the enterprise{% endif %}.
|
||||
|
||||
{% data reusables.user-settings.patv2-limitations %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% ifversion fpt or ghec %}{% data reusables.user-settings.removes-personal-access-tokens %}{% endif %}
|
||||
|
||||
A token with no assigned scopes can only access public information. To use your token to access repositories from the command line, select `repo`. For more information, see "[Available scopes](/apps/building-oauth-apps/scopes-for-oauth-apps#available-scopes)".
|
||||
{% ifversion pat-v2 %}
|
||||
|
||||
## Creating a token
|
||||
## Creating a {% data variables.product.pat_v2 %}
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**: {% data reusables.user-settings.pat-v2-beta %}
|
||||
|
||||
{% endnote %}
|
||||
|
||||
{% ifversion fpt or ghec %}1. [Verify your email address](/github/getting-started-with-github/verifying-your-email-address), if it hasn't been verified yet.{% endif %}
|
||||
{% data reusables.user-settings.access_settings %}
|
||||
{% data reusables.user-settings.developer_settings %}
|
||||
{% data reusables.user-settings.personal_access_tokens %}
|
||||
{% data reusables.user-settings.generate_new_token %}
|
||||
1. In the left sidebar, under **{% octicon "key" aria-label="The key icon" %} {% data variables.product.pat_generic_caps %}s**, click **Fine-grained tokens**.
|
||||
1. Click **Generate new token**.
|
||||
1. Optionally, under **Token name**, enter a name for the token.
|
||||
1. Under **Expiration**, select an expiration for the token.
|
||||
1. Optionally, under **Description**, add a note to describe the purpose of the token.
|
||||
1. Under **Resource owner**, select a resource owner. The token will only be able to access resources owned by the selected resource owner. Organizations that you are a member of will not appear unless the organization opted in to {% data variables.product.pat_v2 %}s. For more information, see "[Setting a {% data variables.product.pat_generic %} policy for your organization](/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization)."{% ifversion ghec or ghae %} You may be required to perform SAML single sign-on (SSO) if the selected organization requires it and you do not already have an active SAML session.{% endif %}
|
||||
1. Optionally, if the resource owner is an organization that requires approval for {% data variables.product.pat_v2 %}s, below the resource owner, in the box, enter a justification for the request.
|
||||
1. Under **Repository access**, select which repositories you want the token to access. You should choose the minimal repository access that meets your needs. Tokens always include read-only access to all public repositories on GitHub.
|
||||
1. If you selected **Only select repositories** in the previous step, under the **Selected repositories** dropdown, select the repositories that you want the token to access.
|
||||
1. Under **Permissions**, select which permissions to grant the token. Depending on which resource owner and which repository access you specified, there are repository, organization, and account permissions. You should choose the minimal permissions necessary for your needs. For more information about what permissions are required for each REST API operation, see "[Permissions required for {% data variables.product.pat_v2 %}s](/rest/overview/permissions-required-for-fine-grained-personal-access-tokens)."
|
||||
1. Click **Generate token**.
|
||||
|
||||
If you selected an organization as the resource owner and the organization requires approval for {% data variables.product.pat_v2 %}s, then your token will be marked as `pending` until it is reviewed by an organization administrator. Your token will only be able to read public resources until it is approved. If you are an owner of the organization, your request is automatically approved. For more information, see "[Reviewing and revoking {% data variables.product.pat_generic %}s in your organization](/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization)".
|
||||
|
||||
{% endif %}
|
||||
|
||||
## Creating a {% data variables.product.pat_v1 %}
|
||||
|
||||
{% ifversion pat-v2 %}
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**: Organization owners can restrict the access of {% data variables.product.pat_v1 %} to their organization. If you try to use a {% data variables.product.pat_v1 %} to access resources in an organization that has disabled {% data variables.product.pat_v1 %} access, your request will fail with a 403 response. Instead, you must use a {% data variables.product.prodname_github_app %}, {% data variables.product.prodname_oauth_app %}, or {% data variables.product.pat_v2 %}.
|
||||
|
||||
{% endnote %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% ifversion pat-v2 %}
|
||||
|
||||
{% warning %}
|
||||
|
||||
**Note**: Your {% data variables.product.pat_v1 %} can access every repository that you can access. {% data variables.product.company_short %} recommends that you use {% data variables.product.pat_v2 %}s instead, which you can restrict to specific repositories. {% data variables.product.pat_v2_caps %}s also enable you to specify fine-grained permissions instead of broad scopes.
|
||||
|
||||
{% endwarning %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% ifversion fpt or ghec %}1. [Verify your email address](/github/getting-started-with-github/verifying-your-email-address), if it hasn't been verified yet.{% endif %}
|
||||
{% data reusables.user-settings.access_settings %}
|
||||
{% data reusables.user-settings.developer_settings %}
|
||||
{% ifversion pat-v2 %}1. In the left sidebar, under **{% octicon "key" aria-label="The key icon" %} {% data variables.product.pat_generic_caps %}s**, click **Tokens (classic)**.{% else %}{% data reusables.user-settings.personal_access_tokens %}{% endif %}
|
||||
{% ifversion pat-v2%}1. Select **Generate new token**, then click **Generate new token (classic)**.{% else %}{% data reusables.user-settings.generate_new_token %}{% endif %}
|
||||
5. Give your token a descriptive name.
|
||||
{% ifversion fpt or ghes > 3.2 or ghae or ghec %}
|
||||
6. To give your token an expiration, select the **Expiration** drop-down menu, then click a default or use the calendar picker.
|
||||
{% endif %}
|
||||
7. Select the scopes, or permissions, you'd like to grant this token. To use your token to access repositories from the command line, select **repo**.
|
||||
7. Select the scopes you'd like to grant this token. To use your token to access repositories from the command line, select **repo**. A token with no assigned scopes can only access public information. For more information, see "[Available scopes](/apps/building-oauth-apps/scopes-for-oauth-apps#available-scopes)".
|
||||
{% ifversion fpt or ghes or ghec %}
|
||||
|
||||
{% elsif ghae %}
|
||||
@@ -60,25 +128,18 @@ A token with no assigned scopes can only access public information. To use your
|
||||
{% elsif ghes or ghae %}
|
||||
|
||||
{% else %}
|
||||
|
||||
{% endif %}
|
||||
{% warning %}
|
||||
|
||||
**Warning:** Treat your tokens like passwords and keep them secret. When working with the API, use tokens as environment variables instead of hardcoding them into your programs.
|
||||
|
||||
{% endwarning %}
|
||||
|
||||
{% ifversion fpt or ghec %}9. To use your token to authenticate to an organization that uses SAML single sign-on, authorize the token. For more information, see "[Authorizing a personal access token for use with SAML single sign-on](/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on){% ifversion fpt %}" in the {% data variables.product.prodname_ghe_cloud %} documentation.{% else %}."{% endif %}{% endif %}
|
||||
{% endif %}{% ifversion fpt or ghec %}
|
||||
1. To use your token to access resources owned by an organization that uses SAML single sign-on, authorize the token. For more information, see "[Authorizing a {% data variables.product.pat_generic %} for use with SAML single sign-on](/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on){% ifversion fpt %}" in the {% data variables.product.prodname_ghe_cloud %} documentation.{% else %}."{% endif %}{% endif %}
|
||||
|
||||
## Using a token on the command line
|
||||
|
||||
{% data reusables.command_line.providing-token-as-password %}
|
||||
|
||||
Personal access tokens can only be used for HTTPS Git operations. If your repository uses an SSH remote URL, you will need to [switch the remote from SSH to HTTPS](/github/getting-started-with-github/managing-remote-repositories/#switching-remote-urls-from-ssh-to-https).
|
||||
{% data variables.product.pat_generic_caps %}s can only be used for HTTPS Git operations. If your repository uses an SSH remote URL, you will need to [switch the remote from SSH to HTTPS](/github/getting-started-with-github/managing-remote-repositories/#switching-remote-urls-from-ssh-to-https).
|
||||
|
||||
If you are not prompted for your username and password, your credentials may be cached on your computer. You can [update your credentials in the Keychain](/github/getting-started-with-github/updating-credentials-from-the-macos-keychain) to replace your old password with the token.
|
||||
|
||||
Instead of manually entering your PAT for every HTTPS Git operation, you can cache your PAT with a Git client. Git will temporarily store your credentials in memory until an expiry interval has passed. You can also store the token in a plain text file that Git can read before every request. For more information, see "[Caching your {% data variables.product.prodname_dotcom %} credentials in Git](/github/getting-started-with-github/caching-your-github-credentials-in-git)."
|
||||
Instead of manually entering your {% data variables.product.pat_generic %} for every HTTPS Git operation, you can cache your {% data variables.product.pat_generic %} with a Git client. Git will temporarily store your credentials in memory until an expiry interval has passed. You can also store the token in a plain text file that Git can read before every request. For more information, see "[Caching your {% data variables.product.prodname_dotcom %} credentials in Git](/github/getting-started-with-github/caching-your-github-credentials-in-git)."
|
||||
|
||||
## Further reading
|
||||
|
||||
|
||||
@@ -20,28 +20,29 @@ This article explains the possible reasons your {% data variables.product.produc
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note:** When a personal access token or OAuth token expires or is revoked, you may see an `oauth_authorization.destroy` action in your security log. For more information, see "[Reviewing your security log](/github/authenticating-to-github/keeping-your-account-and-data-secure/reviewing-your-security-log)."
|
||||
**Note:** When a {% data variables.product.pat_generic %} or OAuth token expires or is revoked, you may see an `oauth_authorization.destroy` action in your security log. For more information, see "[Reviewing your security log](/github/authenticating-to-github/keeping-your-account-and-data-secure/reviewing-your-security-log)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
{% ifversion fpt or ghae or ghes > 3.2 or ghec %}
|
||||
## Token revoked after reaching its expiration date
|
||||
|
||||
When you create a personal access token, we recommend that you set an expiration for your token. Upon reaching your token's expiration date, the token is automatically revoked. For more information, see "[Creating a personal access token](/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
When you create a {% data variables.product.pat_generic %}, we recommend that you set an expiration for your token. Upon reaching your token's expiration date, the token is automatically revoked. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
{% endif %}
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
## Token revoked when pushed to a public repository or public gist
|
||||
|
||||
If a valid OAuth token, {% data variables.product.prodname_github_app %} token, or personal access token is pushed to a public repository or public gist, the token will be automatically revoked.
|
||||
If a valid OAuth token, {% data variables.product.prodname_github_app %} token, or {% data variables.product.pat_generic %} is pushed to a public repository or public gist, the token will be automatically revoked.
|
||||
|
||||
OAuth tokens and personal {% data variables.product.pat_v1_plural %} pushed to public repositories and public gists will only be revoked if the token has scopes.{% ifversion pat-v2 %} {% data variables.product.pat_v2_caps %}s will always be revoked.{% endif %}
|
||||
|
||||
OAuth tokens and personal access tokens pushed to public repositories and public gists will only be revoked if the token has scopes.
|
||||
{% endif %}
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
## Token expired due to lack of use
|
||||
|
||||
{% data variables.product.product_name %} will automatically revoke an OAuth token or personal access token when the token hasn't been used in one year.
|
||||
{% data variables.product.product_name %} will automatically revoke an OAuth token or {% data variables.product.pat_generic %} when the token hasn't been used in one year.
|
||||
{% endif %}
|
||||
|
||||
## Token revoked by the user
|
||||
|
||||
@@ -65,7 +65,7 @@ For greater security, enable two-factor authentication in addition to changing y
|
||||
{% endif %}
|
||||
## Updating your access tokens
|
||||
|
||||
See "[Reviewing your authorized integrations](/articles/reviewing-your-authorized-integrations)" for instructions on reviewing and deleting access tokens. To generate new access tokens, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
See "[Reviewing your authorized integrations](/articles/reviewing-your-authorized-integrations)" for instructions on reviewing and deleting access tokens. To generate new access tokens, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
|
||||
{% ifversion not ghae %}
|
||||
|
||||
|
||||
@@ -59,7 +59,7 @@ If you have installed and signed in to {% data variables.product.prodname_mobile
|
||||
|
||||
## Using two-factor authentication with the command line
|
||||
|
||||
After you've enabled 2FA, you will no longer use your password to access {% data variables.product.product_name %} on the command line. Instead, use Git Credential Manager, a personal access token, or an SSH key.
|
||||
After you've enabled 2FA, you will no longer use your password to access {% data variables.product.product_name %} on the command line. Instead, use Git Credential Manager, a {% data variables.product.pat_generic %}, or an SSH key.
|
||||
|
||||
### Authenticating on the command line using Git Credential Manager
|
||||
|
||||
@@ -69,11 +69,11 @@ Setup instructions vary based on your computer's operating system. For more info
|
||||
|
||||
### Authenticating on the command line using HTTPS
|
||||
|
||||
After you've enabled 2FA, you must create a personal access token to use as a password when authenticating to {% data variables.product.product_name %} on the command line using HTTPS URLs.
|
||||
After you've enabled 2FA, you must create a {% data variables.product.pat_generic %} to use as a password when authenticating to {% data variables.product.product_name %} on the command line using HTTPS URLs.
|
||||
|
||||
When prompted for a username and password on the command line, use your {% data variables.product.product_name %} username and personal access token. The command line prompt won't specify that you should enter your personal access token when it asks for your password.
|
||||
When prompted for a username and password on the command line, use your {% data variables.product.product_name %} username and {% data variables.product.pat_generic %}. The command line prompt won't specify that you should enter your {% data variables.product.pat_generic %} when it asks for your password.
|
||||
|
||||
For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
|
||||
### Authenticating on the command line using SSH
|
||||
|
||||
@@ -81,7 +81,7 @@ Enabling 2FA doesn't change how you authenticate to {% data variables.product.pr
|
||||
|
||||
## Using two-factor authentication to access a repository using Subversion
|
||||
|
||||
When you access a repository via Subversion, you must provide a personal access token instead of entering your password. For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
When you access a repository via Subversion, you must provide a {% data variables.product.pat_generic %} instead of entering your password. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
|
||||
@@ -152,4 +152,4 @@ After signing in, you can now use your device for 2FA.
|
||||
- "[Configuring two-factor authentication recovery methods](/articles/configuring-two-factor-authentication-recovery-methods)"
|
||||
- "[Accessing {% data variables.product.prodname_dotcom %} using two-factor authentication](/articles/accessing-github-using-two-factor-authentication)"
|
||||
- "[Recovering your account if you lose your 2FA credentials](/articles/recovering-your-account-if-you-lose-your-2fa-credentials)"
|
||||
- "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)"
|
||||
- "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)"
|
||||
|
||||
@@ -62,7 +62,7 @@ If you lose access to your primary TOTP app or phone number, you can provide a t
|
||||
If you configured two-factor authentication using a security key, you can use your security key as a secondary authentication method to automatically regain access to your account. For more information, see "[Configuring two-factor authentication](/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication#configuring-two-factor-authentication-using-a-security-key)."
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
## Authenticating with a verified device, SSH token, or personal access token
|
||||
## Authenticating with a verified device, SSH token, or {% data variables.product.pat_generic %}
|
||||
|
||||
If you know your password for {% data variables.location.product_location %} but don't have the two-factor authentication credentials or your two-factor authentication recovery codes, you can have a one-time password sent to your verified email address to begin the verification process and regain access to your account.
|
||||
|
||||
@@ -102,7 +102,7 @@ You can use your two-factor authentication credentials or two-factor authenticat
|
||||
1. Choose an alternative verification factor.
|
||||
- If you've used your current device to log into this account before and would like to use the device for verification, click **Verify with this device**.
|
||||
- If you've previously set up an SSH key on this account and would like to use the SSH key for verification, click **SSH key**.
|
||||
- If you've previously set up a personal access token and would like to use the personal access token for verification, click **Personal access token**.
|
||||
- If you've previously set up a {% data variables.product.pat_generic %} and would like to use the {% data variables.product.pat_generic %} for verification, click **{% data variables.product.pat_generic_caps %}**.
|
||||
|
||||
|
||||
1. A member of {% data variables.contact.github_support %} will review your request and email you within three business days. If your request is approved, you'll receive a link to complete your account recovery process. If your request is denied, the email will include a way to contact support with any additional questions.
|
||||
|
||||
@@ -45,7 +45,7 @@ All data transferred out, when triggered by {% data variables.product.prodname_a
|
||||
||Hosted|Self-Hosted|
|
||||
|-|-|-|
|
||||
|Access using a `GITHUB_TOKEN`|Free|Free|
|
||||
|Access using a personal access token|Free|$|
|
||||
|Access using a {% data variables.product.pat_generic %}|Free|$|
|
||||
|
||||
Storage usage is shared with build artifacts produced by {% data variables.product.prodname_actions %} for repositories owned by your account. For more information, see "[About billing for {% data variables.product.prodname_actions %}](/billing/managing-billing-for-github-actions/about-billing-for-github-actions)."
|
||||
|
||||
|
||||
@@ -351,7 +351,7 @@ If your workflow uses packs that are published on a {% data variables.product.pr
|
||||
{% endraw %}
|
||||
```
|
||||
|
||||
The package patterns in the registries list are examined in order, so you should generally place the most specific package patterns first. The values for `token` must be a personal access token generated by the GitHub instance you are downloading from with the `read:packages` permission.
|
||||
The package patterns in the registries list are examined in order, so you should generally place the most specific package patterns first. The values for `token` must be a {% data variables.product.pat_v1 %} generated by the GitHub instance you are downloading from with the `read:packages` permission.
|
||||
|
||||
Notice the `|` after the `registries` property name. This is important since {% data variables.product.prodname_actions %} inputs can only accept strings. Using the `|` converts the subsequent text to a string, which is parsed later by the {% data reusables.actions.action-codeql-action-init %} action.
|
||||
|
||||
|
||||
@@ -187,7 +187,7 @@ $ codeql database analyze /codeql-dbs/example-repo \
|
||||
|
||||
{% data reusables.code-scanning.upload-sarif-alert-limit %}
|
||||
|
||||
Before you can upload results to {% data variables.product.product_name %}, you must determine the best way to pass the {% data variables.product.prodname_github_app %} or personal access token you created earlier to the {% data variables.product.prodname_codeql_cli %} (see [Installing {% data variables.product.prodname_codeql_cli %} in your CI system](/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system#generating-a-token-for-authentication-with-github)). We recommend that you review your CI system's guidance on the secure use of a secret store. The {% data variables.product.prodname_codeql_cli %} supports:
|
||||
Before you can upload results to {% data variables.product.product_name %}, you must determine the best way to pass the {% data variables.product.prodname_github_app %} or {% data variables.product.pat_generic %} you created earlier to the {% data variables.product.prodname_codeql_cli %} (see [Installing {% data variables.product.prodname_codeql_cli %} in your CI system](/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system#generating-a-token-for-authentication-with-github)). We recommend that you review your CI system's guidance on the secure use of a secret store. The {% data variables.product.prodname_codeql_cli %} supports:
|
||||
|
||||
- Passing the token to the CLI via standard input using the `--github-auth-stdin` option (recommended).
|
||||
- Saving the secret in the environment variable `GITHUB_TOKEN` and running the CLI without including the `--github-auth-stdin` option.
|
||||
@@ -207,7 +207,7 @@ When you have decided on the most secure and reliable method for your CI server,
|
||||
| <nobr>`--commit`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the full SHA of the commit you analyzed.
|
||||
| <nobr>`--sarif`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the SARIF file to load.{% ifversion ghes or ghae %}
|
||||
| <nobr>`--github-url`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the URL for {% data variables.product.product_name %}.{% endif %}
|
||||
| <nobr>`--github-auth-stdin`</nobr> | | Optional. Use to pass the CLI the {% data variables.product.prodname_github_app %} or personal access token created for authentication with {% data variables.product.company_short %}'s REST API via standard input. This is not needed if the command has access to a `GITHUB_TOKEN` environment variable set with this token.
|
||||
| <nobr>`--github-auth-stdin`</nobr> | | Optional. Use to pass the CLI the {% data variables.product.prodname_github_app %} or {% data variables.product.pat_generic %} created for authentication with {% data variables.product.company_short %}'s REST API via standard input. This is not needed if the command has access to a `GITHUB_TOKEN` environment variable set with this token.
|
||||
|
||||
For more information, see [github upload-results](https://codeql.github.com/docs/codeql-cli/manual/github-upload-results/) in the documentation for the {% data variables.product.prodname_codeql_cli %}.
|
||||
|
||||
@@ -231,12 +231,12 @@ There is no output from this command unless the upload was unsuccessful. The com
|
||||
|
||||
The {% data variables.product.prodname_codeql_cli %} bundle includes queries that are maintained by {% data variables.product.company_short %} experts, security researchers, and community contributors. If you want to run queries developed by other organizations, {% data variables.product.prodname_codeql %} query packs provide an efficient and reliable way to download and run queries. For more information, see "[About code scanning with CodeQL](/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql#about-codeql-queries)."
|
||||
|
||||
Before you can use a {% data variables.product.prodname_codeql %} pack to analyze a database, you must download any packages you require from the {% data variables.product.company_short %} {% data variables.product.prodname_container_registry %}. This can be done either by using the `--download` flag as part of the `codeql database analyze` command. If a package is not publicly available, you will need to use a {% data variables.product.prodname_github_app %} or personal access token to authenticate. For more information and an example, see "[Uploading results to {% data variables.product.product_name %}](#uploading-results-to-github)" above.
|
||||
Before you can use a {% data variables.product.prodname_codeql %} pack to analyze a database, you must download any packages you require from the {% data variables.product.company_short %} {% data variables.product.prodname_container_registry %}. This can be done either by using the `--download` flag as part of the `codeql database analyze` command. If a package is not publicly available, you will need to use a {% data variables.product.prodname_github_app %} or {% data variables.product.pat_generic %} to authenticate. For more information and an example, see "[Uploading results to {% data variables.product.product_name %}](#uploading-results-to-github)" above.
|
||||
|
||||
| Option | Required | Usage |
|
||||
|--------|:--------:|-----|
|
||||
| <nobr>`<scope/name@version:path>`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the scope and name of one or more CodeQL query packs to download using a comma-separated list. Optionally, include the version to download and unzip. By default the latest version of this pack is downloaded. Optionally, include a path to a query, directory, or query suite to run. If no path is included, then run the default queries of this pack. |
|
||||
| <nobr>`--github-auth-stdin`</nobr> | | Optional. Pass the {% data variables.product.prodname_github_app %} or personal access token created for authentication with {% data variables.product.company_short %}'s REST API to the CLI via standard input. This is not needed if the command has access to a `GITHUB_TOKEN` environment variable set with this token.
|
||||
| <nobr>`--github-auth-stdin`</nobr> | | Optional. Pass the {% data variables.product.prodname_github_app %} or {% data variables.product.pat_generic %} created for authentication with {% data variables.product.company_short %}'s REST API to the CLI via standard input. This is not needed if the command has access to a `GITHUB_TOKEN` environment variable set with this token.
|
||||
|
||||
### Basic example
|
||||
|
||||
|
||||
@@ -147,7 +147,7 @@ Initializes the {% data variables.product.prodname_codeql_runner %} and creates
|
||||
| ---- |:--------:| ----------- |
|
||||
| `--repository` | ✓ | Name of the repository to initialize. |
|
||||
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |
|
||||
| <nobr>`--github-auth-stdin`</nobr> | ✓ | Read the {% data variables.product.prodname_github_apps %} token or personal access token from standard input. |
|
||||
| <nobr>`--github-auth-stdin`</nobr> | ✓ | Read the {% data variables.product.prodname_github_apps %} token or {% data variables.product.pat_generic %} from standard input. |
|
||||
| `--languages` | | Comma-separated list of languages to analyze. By default, the {% data variables.product.prodname_codeql_runner %} detects and analyzes all supported languages in the repository. |
|
||||
| `--queries` | | Comma-separated list of additional queries to run, in addition to the default suite of security queries. This overrides the `queries` setting in the custom configuration file. |
|
||||
| `--config-file` | | Path to custom configuration file. |
|
||||
@@ -181,7 +181,7 @@ Analyzes the code in the {% data variables.product.prodname_codeql %} databases
|
||||
| `--commit` | ✓ | SHA of the commit to analyze. In Git and in Azure DevOps, this corresponds to the value of `git rev-parse HEAD`. In Jenkins, this corresponds to `$GIT_COMMIT`. |
|
||||
| `--ref` | ✓ | Name of the reference to analyze, for example `refs/heads/main` or `refs/pull/42/merge`. In Git or in Jenkins, this corresponds to the value of `git symbolic-ref HEAD`. In Azure DevOps, this corresponds to `$(Build.SourceBranch)`. |
|
||||
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |
|
||||
| <nobr>`--github-auth-stdin`</nobr> | ✓ | Read the {% data variables.product.prodname_github_apps %} token or personal access token from standard input. |
|
||||
| <nobr>`--github-auth-stdin`</nobr> | ✓ | Read the {% data variables.product.prodname_github_apps %} token or {% data variables.product.pat_generic %} from standard input. |
|
||||
| <nobr>`--checkout-path`</nobr> | | The path to the checkout of your repository. The default is the current working directory. |
|
||||
| `--no-upload` | | None. Stops the {% data variables.product.prodname_codeql_runner %} from uploading the results to {% data variables.product.product_name %}. |
|
||||
| `--output-dir` | | Directory where the output SARIF files are stored. The default is in the directory of temporary files. |
|
||||
@@ -210,7 +210,7 @@ Uploads SARIF files to {% data variables.product.product_name %}.
|
||||
| `--commit` | ✓ | SHA of the commit that was analyzed. In Git and in Azure DevOps, this corresponds to the value of `git rev-parse HEAD`. In Jenkins, this corresponds to `$GIT_COMMIT`. |
|
||||
| `--ref` | ✓ | Name of the reference that was analyzed, for example `refs/heads/main` or `refs/pull/42/merge`. In Git or in Jenkins, this corresponds to the value of `git symbolic-ref HEAD`. In Azure DevOps, this corresponds to `$(Build.SourceBranch)`. |
|
||||
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |
|
||||
| <nobr>`--github-auth-stdin`</nobr> | ✓ | Read the {% data variables.product.prodname_github_apps %} token or personal access token from standard input. |
|
||||
| <nobr>`--github-auth-stdin`</nobr> | ✓ | Read the {% data variables.product.prodname_github_apps %} token or {% data variables.product.pat_generic %} from standard input. |
|
||||
| <nobr>`--checkout-path`</nobr> | | The path to the checkout of your repository. The default is the current working directory. |
|
||||
| `--debug` | | None. Prints more verbose output. |
|
||||
| `-h`, `--help` | | None. Displays help for the command. |
|
||||
|
||||
@@ -112,7 +112,7 @@ You should check that the output contains the expected languages and also that t
|
||||
|
||||
## Generating a token for authentication with {% data variables.product.product_name %}
|
||||
|
||||
Each CI server needs a {% data variables.product.prodname_github_app %} or personal access token for the {% data variables.product.prodname_codeql_cli %} to use to upload results to {% data variables.product.product_name %}. You must use an access token or a {% data variables.product.prodname_github_app %} with the `security_events` write permission. If CI servers already use a token with this scope to checkout repositories from {% data variables.product.product_name %}, you could potentially allow the {% data variables.product.prodname_codeql_cli %} to use the same token. Otherwise, you should create a new token with the `security_events` write permission and add this to the CI system's secret store. For information, see "[Building {% data variables.product.prodname_github_apps %}](/developers/apps/building-github-apps)" and "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
Each CI server needs a {% data variables.product.prodname_github_app %} or {% data variables.product.pat_generic %} for the {% data variables.product.prodname_codeql_cli %} to use to upload results to {% data variables.product.product_name %}. You must use an access token or a {% data variables.product.prodname_github_app %} with the `security_events` write permission. If CI servers already use a token with this scope to checkout repositories from {% data variables.product.product_name %}, you could potentially allow the {% data variables.product.prodname_codeql_cli %} to use the same token. Otherwise, you should create a new token with the `security_events` write permission and add this to the CI system's secret store. For information, see "[Building {% data variables.product.prodname_github_apps %}](/developers/apps/building-github-apps)" and "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
|
||||
## Next steps
|
||||
|
||||
|
||||
@@ -88,7 +88,7 @@ chmod +x codeql-runner-linux
|
||||
|
||||
In addition to this, each CI server also needs:
|
||||
|
||||
- A {% data variables.product.prodname_github_app %} or personal access token for the {% data variables.product.prodname_codeql_runner %} to use. You must use an access token with the `repo` scope, or a {% data variables.product.prodname_github_app %} with the `security_events` write permission, and `metadata` and `contents` read permissions. For information, see "[Building {% data variables.product.prodname_github_apps %}](/developers/apps/building-github-apps)" and "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
- A {% data variables.product.prodname_github_app %} or {% data variables.product.pat_generic %} for the {% data variables.product.prodname_codeql_runner %} to use. You must use an access token with the `repo` scope, or a {% data variables.product.prodname_github_app %} with the `security_events` write permission, and `metadata` and `contents` read permissions. For information, see "[Building {% data variables.product.prodname_github_apps %}](/developers/apps/building-github-apps)" and "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
- Access to the {% data variables.product.prodname_codeql %} bundle associated with this release of the {% data variables.product.prodname_codeql_runner %}. This package contains queries and libraries needed for {% data variables.product.prodname_codeql %} analysis, plus the {% data variables.product.prodname_codeql %} CLI, which is used internally by the runner. For information, see "[{% data variables.product.prodname_codeql %} CLI](https://codeql.github.com/docs/codeql-cli/)."
|
||||
|
||||
The options for providing access to the {% data variables.product.prodname_codeql %} bundle are:
|
||||
@@ -103,7 +103,7 @@ You should call the {% data variables.product.prodname_codeql_runner %} from the
|
||||
1. `init` required to initialize the runner and create a {% data variables.product.prodname_codeql %} database for each language to be analyzed. These databases are populated and analyzed by subsequent commands.
|
||||
1. `analyze` required to populate the {% data variables.product.prodname_codeql %} databases, analyze them, and upload results to {% data variables.product.product_name %}.
|
||||
|
||||
For both commands, you must specify the URL of {% data variables.product.product_name %}, the repository *OWNER/NAME*, and the {% data variables.product.prodname_github_apps %} or personal access token to use for authentication. You also need to specify the location of the CodeQL bundle, unless the CI server has access to download it directly from the `github/codeql-action` repository.
|
||||
For both commands, you must specify the URL of {% data variables.product.product_name %}, the repository *OWNER/NAME*, and the {% data variables.product.prodname_github_apps %} or {% data variables.product.pat_generic %} to use for authentication. You also need to specify the location of the CodeQL bundle, unless the CI server has access to download it directly from the `github/codeql-action` repository.
|
||||
|
||||
You can configure where the {% data variables.product.prodname_codeql_runner %} stores the CodeQL bundle for future analysis on a server using the <nobr>`--tools-dir`</nobr> flag and where it stores temporary files during analysis using <nobr>`--temp-dir`</nobr>.
|
||||
|
||||
|
||||
@@ -68,7 +68,7 @@ shortTitle: Manage secret alerts
|
||||
|
||||
Once a secret has been committed to a repository, you should consider the secret compromised. {% data variables.product.prodname_dotcom %} recommends the following actions for compromised secrets:
|
||||
|
||||
- For a compromised {% data variables.product.prodname_dotcom %} personal access token, delete the compromised token, create a new token, and update any services that use the old token. For more information, see "[Creating a personal access token for the command line](/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line)."
|
||||
- For a compromised {% data variables.product.prodname_dotcom %} {% data variables.product.pat_generic %}, delete the compromised token, create a new token, and update any services that use the old token. For more information, see "[Creating a {% data variables.product.pat_generic %} for the command line](/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line)."
|
||||
- For all other secrets, first verify that the secret committed to {% data variables.product.product_name %} is valid. If so, create a new secret, update any services that use the old secret, and then delete the old secret.
|
||||
|
||||
{% ifversion ghec %}
|
||||
|
||||
@@ -43,7 +43,7 @@ In the security overview, you can view, sort, and filter alerts to understand th
|
||||
|
||||
{% ifversion security-overview-views %}
|
||||
|
||||
In the security overview, there are dedicated views for each type of security alert, such as Dependabot, code scanning, and secret scanning alerts. You can use these views to limit your analysis to a specific set of alerts, and narrow the results further with a range of filters specific to each view. For example, in the secret scanning alert view, you can use the `Secret type` filter to view only secret scanning alerts for a specific secret, like a GitHub Personal Access Token. At the repository level, you can use the security overview to assess the specific repository's current security status, and configure any additional security features not yet in use on the repository.
|
||||
In the security overview, there are dedicated views for each type of security alert, such as Dependabot, code scanning, and secret scanning alerts. You can use these views to limit your analysis to a specific set of alerts, and narrow the results further with a range of filters specific to each view. For example, in the secret scanning alert view, you can use the `Secret type` filter to view only secret scanning alerts for a specific secret, like a GitHub {% data variables.product.pat_generic %}. At the repository level, you can use the security overview to assess the specific repository's current security status, and configure any additional security features not yet in use on the repository.
|
||||
|
||||
{% endif %}
|
||||
|
||||
|
||||
@@ -30,7 +30,7 @@ If you publish a container image to {% data variables.packages.prodname_ghcr_or_
|
||||
|
||||
By default, when you publish a container image to {% data variables.packages.prodname_ghcr_or_npm_registry %}, the image inherits the access setting of the repository from which the image was published. For example, if the repository is public, the image is also public. If the repository is private, the image is also private, but is accessible from the repository.
|
||||
|
||||
This behavior is controlled by the **Inherit access from repo** option. **Inherit access from repo** is selected by default when publishing via {% data variables.product.prodname_actions %}, but not when publishing directly to {% data variables.packages.prodname_ghcr_or_npm_registry %} using a Personal Access Token (PAT).
|
||||
This behavior is controlled by the **Inherit access from repo** option. **Inherit access from repo** is selected by default when publishing via {% data variables.product.prodname_actions %}, but not when publishing directly to {% data variables.packages.prodname_ghcr_or_npm_registry %} using a % data variables.product.pat_generic %}.
|
||||
|
||||
If the **Inherit access from repo** option was not selected when the image was published, you can manually add the repository to the published container image's access controls. For more information, see "[Configuring a package's access control and visibility](/packages/learn-github-packages/configuring-a-packages-access-control-and-visibility#inheriting-access-for-a-container-image-from-a-repository)."
|
||||
|
||||
@@ -46,13 +46,13 @@ If you want to allow a subset of an organization's repositories to access a cont
|
||||
|
||||
### Publishing a container image from a codespace
|
||||
|
||||
Seamless access from a codespace to {% data variables.packages.prodname_ghcr_or_npm_registry %} is limited to pulling container images. If you want to publish a container image from inside a codespace, you must use a personal access token (PAT) with the `write:packages` scope.
|
||||
Seamless access from a codespace to {% data variables.packages.prodname_ghcr_or_npm_registry %} is limited to pulling container images. If you want to publish a container image from inside a codespace, you must use a {% data variables.product.pat_v1 %} with the `write:packages` scope.
|
||||
|
||||
We recommend publishing images via {% data variables.product.prodname_actions %}. For more information, see "[Publishing Docker images](/actions/publishing-packages/publishing-docker-images)" and "[Publishing Node.js packages](/actions/publishing-packages/publishing-nodejs-packages)."
|
||||
|
||||
## Accessing images stored in other container registries
|
||||
|
||||
If you are accessing a container image from a registry that isn't {% data variables.packages.prodname_ghcr_or_npm_registry %}, {% data variables.product.prodname_github_codespaces %} checks for the presence of three secrets, which define the server name, username, and personal access token (PAT) for a container registry. If these secrets are found, {% data variables.product.prodname_github_codespaces %} will make the registry available inside your codespace.
|
||||
If you are accessing a container image from a registry that isn't {% data variables.packages.prodname_ghcr_or_npm_registry %}, {% data variables.product.prodname_github_codespaces %} checks for the presence of three secrets, which define the server name, username, and {% data variables.product.pat_generic %} for a container registry. If these secrets are found, {% data variables.product.prodname_github_codespaces %} will make the registry available inside your codespace.
|
||||
|
||||
- `<*>_CONTAINER_REGISTRY_SERVER`
|
||||
- `<*>_CONTAINER_REGISTRY_USER`
|
||||
@@ -71,7 +71,7 @@ For a private image registry in Azure, you could create the following secrets:
|
||||
```
|
||||
ACR_CONTAINER_REGISTRY_SERVER = mycompany.azurecr.io
|
||||
ACR_CONTAINER_REGISTRY_USER = acr-user-here
|
||||
ACR_CONTAINER_REGISTRY_PASSWORD = <PAT>
|
||||
ACR_CONTAINER_REGISTRY_PASSWORD = <PERSONAL_ACCESS_TOKEN>
|
||||
```
|
||||
|
||||
For information on common image registries, see "[Common image registry servers](#common-image-registry-servers)." Note that accessing AWS Elastic Container Registry (ECR) is different.
|
||||
|
||||
@@ -24,7 +24,7 @@ shortTitle: Encrypted secrets
|
||||
|
||||
You can add encrypted secrets to your personal account that you want to use in your codespaces. For example, you may want to store and access the following sensitive information as encrypted secrets.
|
||||
|
||||
- Personal access tokens to cloud services
|
||||
- {% data variables.product.pat_generic %}s to cloud services
|
||||
- Service principals
|
||||
- Subscription identifiers
|
||||
- [Credentials for a private image registry](/codespaces/codespaces-reference/allowing-your-codespace-to-access-a-private-image-registry)
|
||||
|
||||
@@ -29,33 +29,33 @@ When you create or edit a prebuild configuration for a `devcontainer.json` file
|
||||
|
||||
## Allowing a prebuild write access external resources
|
||||
|
||||
If your project requires write access to resources, or if the external resources reside in a repository with a different owner to the repository for which you are creating a prebuild configuration, you can use a personal access token (PAT) to grant this access.
|
||||
If your project requires write access to resources, or if the external resources reside in a repository with a different owner to the repository for which you are creating a prebuild configuration, you can use a {% data variables.product.pat_generic %} to grant this access.
|
||||
|
||||
You will need to create a new personal account and then use this account to create a PAT with the appropriate scopes.
|
||||
You will need to create a new personal account and then use this account to create a {% data variables.product.pat_v1 %} with the appropriate scopes.
|
||||
|
||||
1. Create a new personal account on {% data variables.product.prodname_dotcom %}.
|
||||
|
||||
{% warning %}
|
||||
|
||||
**Warning**: Although you can generate the PAT using your existing personal account, we strongly recommend creating a new account with access only to the target repositories required for your scenario. This is because the access token's `repository` permission grants access to all of the repositories that the account has access to. For more information, see "[Signing up for a new GitHub account](/get-started/signing-up-for-github/signing-up-for-a-new-github-account)" and "[Security hardening for {% data variables.product.prodname_actions %}](/actions/security-guides/security-hardening-for-github-actions#considering-cross-repository-access)."
|
||||
**Warning**: Although you can generate the {% data variables.product.pat_v1 %} using your existing personal account, we strongly recommend creating a new account with access only to the target repositories required for your scenario. This is because the access token's `repository` permission grants access to all of the repositories that the account has access to. For more information, see "[Signing up for a new GitHub account](/get-started/signing-up-for-github/signing-up-for-a-new-github-account)" and "[Security hardening for {% data variables.product.prodname_actions %}](/actions/security-guides/security-hardening-for-github-actions#considering-cross-repository-access)."
|
||||
|
||||
{% endwarning %}
|
||||
1. Give the new account read access to the required repositories. For more information, see "[Managing an individual's access to an organization repository](/organizations/managing-access-to-your-organizations-repositories/managing-an-individuals-access-to-an-organization-repository)."
|
||||
1. While signed into the new account, create a PAT with the `repo` scope. Optionally, if the prebuild will need to download packages from the {% data variables.product.company_short %} {% data variables.product.prodname_container_registry %}, also select the `read:packages` scope. For more information, see "[Creating a personal access token](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
1. While signed into the new account, create a {% data variables.product.pat_v1 %} with the `repo` scope. Optionally, if the prebuild will need to download packages from the {% data variables.product.company_short %} {% data variables.product.prodname_container_registry %}, also select the `read:packages` scope. For more information, see "[Creating a {% data variables.product.pat_generic %}](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
|
||||
|
||||
|
||||
|
||||
If the prebuild will use a package from the {% data variables.product.company_short %} {% data variables.product.prodname_container_registry %}, you will need to either grant the new account access to the package or configure the package to inherit the access permissions of the repository you are prebuilding. For more information, see "[Configuring a package's access control and visibility](/packages/learn-github-packages/configuring-a-packages-access-control-and-visibility)."
|
||||
{% ifversion ghec %}1. Authorize the token for use with SAML single sign-on (SSO), so that it can access repositories that are owned by organizations with SSO enabled. For more information, see "[Authorizing a personal access token for use with SAML single sign-on](/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on)."
|
||||
{% ifversion ghec %}1. Authorize the token for use with SAML single sign-on (SSO), so that it can access repositories that are owned by organizations with SSO enabled. For more information, see "[Authorizing a {% data variables.product.pat_generic %} for use with SAML single sign-on](/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on)."
|
||||
|
||||
|
||||
|
||||
|
||||
{% endif %}
|
||||
1. Copy the token string. You will assign this to a {% data variables.product.prodname_codespaces %} repository secret.
|
||||
1. Sign back into the account that has admin access to the repository.
|
||||
1. In the repository for which you want to create {% data variables.product.prodname_github_codespaces %} prebuilds, create a new {% data variables.product.prodname_codespaces %} repository secret called `CODESPACES_PREBUILD_TOKEN`, giving it the value of the token you created and copied. For more information, see "[Managing encrypted secrets for your repository and organization for {% data variables.product.prodname_github_codespaces %}](/codespaces/managing-codespaces-for-your-organization/managing-encrypted-secrets-for-your-repository-and-organization-for-github-codespaces#adding-secrets-for-a-repository)."
|
||||
|
||||
The PAT will be used for all subsequent prebuilds created for your repository. Unlike other {% data variables.product.prodname_codespaces %} repository secrets, the `CODESPACES_PREBUILD_TOKEN` secret is only used for prebuilding and will not be available to use in codespaces created from your repository.
|
||||
The {% data variables.product.pat_generic %} will be used for all subsequent prebuilds created for your repository. Unlike other {% data variables.product.prodname_codespaces %} repository secrets, the `CODESPACES_PREBUILD_TOKEN` secret is only used for prebuilding and will not be available to use in codespaces created from your repository.
|
||||
|
||||
## Further reading
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ shortTitle: About connections
|
||||
---
|
||||
{% data variables.product.prodname_desktop %} connects to {% data variables.product.prodname_dotcom %} when you pull from, push to, clone, and fork remote repositories. To connect to {% data variables.product.prodname_dotcom %} from {% data variables.product.prodname_desktop %}, you must authenticate your account. For more information, see "[Authenticating to {% data variables.product.prodname_dotcom %}](/desktop/getting-started-with-github-desktop/authenticating-to-github)."
|
||||
|
||||
After you authenticate to {% data variables.product.prodname_dotcom %}, you can connect to remote repositories with {% data variables.product.prodname_desktop %}. {% data variables.product.prodname_desktop %} caches your credentials (username and password or personal access token) and uses the credentials to authenticate for each connection to the remote repository.
|
||||
After you authenticate to {% data variables.product.prodname_dotcom %}, you can connect to remote repositories with {% data variables.product.prodname_desktop %}. {% data variables.product.prodname_desktop %} caches your credentials (username and password or {% data variables.product.pat_generic %}) and uses the credentials to authenticate for each connection to the remote repository.
|
||||
|
||||
{% data variables.product.prodname_desktop %} connects to {% data variables.product.prodname_dotcom %} using HTTPS. If you use {% data variables.product.prodname_desktop %} to access repositories that were cloned using SSH, you may encounter errors. To connect to a repository that was cloned using SSH, change the remote's URLs. For more information, see "[Managing remote repositories](/github/getting-started-with-github/managing-remote-repositories)."
|
||||
|
||||
|
||||
@@ -267,7 +267,7 @@ For more information, see the "[OAuth 2.0 Device Authorization Grant](https://to
|
||||
|
||||
## Non-Web application flow
|
||||
|
||||
Non-web authentication is available for limited situations like testing. If you need to, you can use [Basic Authentication](/rest/overview/other-authentication-methods#basic-authentication) to create a personal access token using your [Personal access tokens settings page](/articles/creating-an-access-token-for-command-line-use). This technique enables the user to revoke access at any time.
|
||||
Non-web authentication is available for limited situations like testing. If you need to, you can use [Basic Authentication](/rest/overview/other-authentication-methods#basic-authentication) to create a {% data variables.product.pat_generic %} using your [{% data variables.product.pat_generic %}s settings page](/articles/creating-an-access-token-for-command-line-use). This technique enables the user to revoke access at any time.
|
||||
|
||||
{% ifversion fpt or ghes or ghec %}
|
||||
{% note %}
|
||||
|
||||
@@ -57,7 +57,7 @@ Name | Description
|
||||
**`admin:public_key`** | Fully manage public keys.
|
||||
 `write:public_key`| Create, list, and view details for public keys.
|
||||
 `read:public_key`| List and view details for public keys.
|
||||
**`admin:org_hook`** | Grants read, write, ping, and delete access to organization hooks. **Note:** OAuth tokens will only be able to perform these actions on organization hooks which were created by the OAuth App. Personal access tokens will only be able to perform these actions on organization hooks created by a user.
|
||||
**`admin:org_hook`** | Grants read, write, ping, and delete access to organization hooks. **Note:** OAuth tokens will only be able to perform these actions on organization hooks which were created by the OAuth App. {% data variables.product.pat_generic_caps %}s will only be able to perform these actions on organization hooks created by a user.
|
||||
**`gist`** | Grants write access to gists.
|
||||
**`notifications`** | Grants: <br/>* read access to a user's notifications <br/>* mark as read access to threads <br/>* watch and unwatch access to a repository, and <br/>* read, write, and delete access to thread subscriptions.
|
||||
**`user`** | Grants read/write access to profile info only. Note that this scope includes `user:email` and `user:follow`.
|
||||
|
||||
@@ -72,24 +72,25 @@ Keep these ideas in mind when creating {% data variables.product.prodname_oauth_
|
||||
|
||||
For more on {% data variables.product.prodname_oauth_apps %}, see "[Creating an {% data variables.product.prodname_oauth_app %}](/apps/building-oauth-apps/creating-an-oauth-app/)" and "[Registering your app](/rest/guides/basics-of-authentication#registering-your-app)."
|
||||
|
||||
## Personal access tokens
|
||||
## {% data variables.product.pat_generic_caps %}s
|
||||
|
||||
A [personal access token](/articles/creating-a-personal-access-token-for-the-command-line/) is a string of characters that functions similarly to an [OAuth token](/apps/building-oauth-apps/authorizing-oauth-apps/) in that you can specify its permissions via [scopes](/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/). A personal access token is also similar to a password, but you can have many of them and you can revoke access to each one at any time.
|
||||
A [{% data variables.product.pat_generic %}](/articles/creating-a-personal-access-token-for-the-command-line/) is a string of characters that functions similarly to an [OAuth token](/apps/building-oauth-apps/authorizing-oauth-apps/) in that you can specify its permissions via [scopes](/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/). A {% data variables.product.pat_generic %} is also similar to a password, but you can have many of them and you can revoke access to each one at any time.
|
||||
|
||||
As an example, you can enable a personal access token to write to your repositories. If then you run a cURL command or write a script that [creates an issue](/rest/reference/issues#create-an-issue) in your repository, you would pass the personal access token to authenticate. You can store the personal access token as an environment variable to avoid typing it every time you use it.
|
||||
As an example, you can enable a {% data variables.product.pat_generic %} to write to your repositories. If then you run a cURL command or write a script that [creates an issue](/rest/reference/issues#create-an-issue) in your repository, you would pass the {% data variables.product.pat_generic %} to authenticate. You can store the {% data variables.product.pat_generic %} as an environment variable to avoid typing it every time you use it.
|
||||
|
||||
Keep these ideas in mind when using personal access tokens:
|
||||
Keep these ideas in mind when using {% data variables.product.pat_generic %}s:
|
||||
|
||||
* Remember to use this token to represent yourself only.
|
||||
* You can perform one-off cURL requests.
|
||||
* You can run personal scripts.
|
||||
* Don't set up a script for your whole team or company to use.
|
||||
* Don't set up a shared personal account to act as a bot user.{% ifversion fpt or ghes > 3.2 or ghae or ghec %}
|
||||
* Do set an expiration for your personal access tokens, to help keep your information secure.{% endif %}
|
||||
* Grant your token the minimal privileges it needs.
|
||||
* Set an expiration for your {% data variables.product.pat_generic %}s, to help keep your information secure.{% endif %}
|
||||
|
||||
## Determining which integration to build
|
||||
|
||||
Before you get started creating integrations, you need to determine the best way to access, authenticate, and interact with the {% ifversion fpt or ghec %}{% data variables.product.prodname_dotcom %}{% else %}{% data variables.product.product_name %}{% endif %} APIs. The following image offers some questions to ask yourself when deciding whether to use personal access tokens, {% data variables.product.prodname_github_apps %}, or {% data variables.product.prodname_oauth_apps %} for your integration.
|
||||
Before you get started creating integrations, you need to determine the best way to access, authenticate, and interact with the {% ifversion fpt or ghec %}{% data variables.product.prodname_dotcom %}{% else %}{% data variables.product.product_name %}{% endif %} APIs. The following image offers some questions to ask yourself when deciding whether to use {% data variables.product.pat_generic %}s, {% data variables.product.prodname_github_apps %}, or {% data variables.product.prodname_oauth_apps %} for your integration.
|
||||
|
||||
|
||||
|
||||
@@ -98,7 +99,7 @@ Consider these questions about how your integration needs to behave and what it
|
||||
* Will my integration act only as me, or will it act more like an application?
|
||||
* Do I want it to act independently of me as its own entity?
|
||||
* Will it access everything that I can access, or do I want to limit its access?
|
||||
* Is it simple or complex? For example, personal access tokens are good for simple scripts and cURLs, whereas an {% data variables.product.prodname_oauth_app %} can handle more complex scripting.
|
||||
* Is it simple or complex? For example, {% data variables.product.pat_generic %}s are good for simple scripts and cURLs, whereas an {% data variables.product.prodname_oauth_app %} can handle more complex scripting.
|
||||
|
||||
## Requesting support
|
||||
|
||||
|
||||
@@ -25,7 +25,7 @@ We recommend creating a GitHub App rather than an OAuth App. {% data reusables.m
|
||||
- Apps should not share service accounts such as email or database services to manage your SaaS service.
|
||||
- All services used in your app should have unique login and password credentials.
|
||||
- Admin privilege access to the production hosting infrastructure should only be given to engineers and employees with administrative duties.
|
||||
- Apps should not use personal access tokens to authenticate and should authenticate as an [OAuth App](/apps/about-apps/#about-oauth-apps) or a [GitHub App](/apps/about-apps/#about-github-apps):
|
||||
- Apps should not use {% data variables.product.pat_generic %}s to authenticate and should authenticate as an [OAuth App](/apps/about-apps/#about-oauth-apps) or a [GitHub App](/apps/about-apps/#about-github-apps):
|
||||
- OAuth Apps should authenticate using an [OAuth token](/apps/building-oauth-apps/authorizing-oauth-apps/).
|
||||
- GitHub Apps should authenticate using either a [JSON Web Token (JWT)](/apps/building-github-apps/authenticating-with-github-apps/#authenticating-as-a-github-app), [OAuth token](/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps/), or [installation access token](/apps/building-github-apps/authenticating-with-github-apps/#authenticating-as-an-installation).
|
||||
|
||||
|
||||
@@ -61,7 +61,7 @@ If you don't want to use SSH keys, you can use HTTPS with OAuth tokens.
|
||||
|
||||
#### Setup
|
||||
|
||||
See [our guide on creating a personal access token](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token).
|
||||
See [our guide on creating a {% data variables.product.pat_generic %}](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token).
|
||||
|
||||
## Deploy keys
|
||||
|
||||
|
||||
@@ -110,7 +110,7 @@ key to use based on the value of `GITHUB-PUBLIC-KEY-IDENTIFIER`.
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**: When you send a request to the public key endpoint above, you may hit rate limits. To avoid hitting rate limits, you can use a personal access token (no scopes required) as suggested in the samples below, or use a conditional request. For more information, see "[Getting started with the REST API](/rest/guides/getting-started-with-the-rest-api#conditional-requests)."
|
||||
**Note**: When you send a request to the public key endpoint above, you may hit rate limits. To avoid hitting rate limits, you can use a {% data variables.product.pat_v1 %} (no scopes required){% ifversion pat-v2 %} or a {% data variables.product.pat_v2 %} (only the automatic public repositories read access required){% endif %} as suggested in the samples below, or use a conditional request. For more information, see "[Getting started with the REST API](/rest/guides/getting-started-with-the-rest-api#conditional-requests)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
@@ -149,7 +149,7 @@ HzZFI03Exwz8Lh/tCfL3YxwMdLjB+bMznsanlhK0RwcGP3IDb34kQDIo3Q==
|
||||
{% endnote %}
|
||||
|
||||
The following code snippets demonstrate how you could perform signature validation.
|
||||
The code examples assume you've set an environment variable called `GITHUB_PRODUCTION_TOKEN` with a generated [personal access token](https://github.com/settings/tokens) (PAT) to avoid hitting rate limits. The PAT does not need any scopes/permissions.
|
||||
The code examples assume you've set an environment variable called `GITHUB_PRODUCTION_TOKEN` with a generated [{% data variables.product.pat_generic %}](https://github.com/settings/tokens) to avoid hitting rate limits. The {% data variables.product.pat_generic %} does not need any scopes/permissions.
|
||||
|
||||
**Validation sample in Go**
|
||||
```golang
|
||||
|
||||
@@ -35,7 +35,7 @@ For more information about authenticating with {% data variables.product.prodnam
|
||||
|
||||
## Git Credential Manager
|
||||
|
||||
[Git Credential Manager](https://github.com/GitCredentialManager/git-credential-manager) (GCM) is another way to store your credentials securely and connect to GitHub over HTTPS. With GCM, you don't have to manually [create and store a PAT](/github/authenticating-to-github/creating-a-personal-access-token), as GCM manages authentication on your behalf, including 2FA (two-factor authentication).
|
||||
[Git Credential Manager](https://github.com/GitCredentialManager/git-credential-manager) (GCM) is another way to store your credentials securely and connect to GitHub over HTTPS. With GCM, you don't have to manually [create and store a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token), as GCM manages authentication on your behalf, including 2FA (two-factor authentication).
|
||||
|
||||
{% mac %}
|
||||
|
||||
|
||||
@@ -108,7 +108,7 @@ git@{% data variables.command_line.codeblock %}:USERNAME/REPOSITORY.git
|
||||
|
||||
The next time you `git fetch`, `git pull`, or `git push` to the remote repository, you'll be asked for your GitHub username and password. {% data reusables.user-settings.password-authentication-deprecation %}
|
||||
|
||||
You can [use a credential helper](/github/getting-started-with-github/caching-your-github-credentials-in-git) so Git will remember your GitHub username and personal access token every time it talks to GitHub.
|
||||
You can [use a credential helper](/github/getting-started-with-github/caching-your-github-credentials-in-git) so Git will remember your GitHub username and {% data variables.product.pat_generic %} every time it talks to GitHub.
|
||||
|
||||
### Switching remote URLs from HTTPS to SSH
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Updating credentials from the macOS Keychain
|
||||
intro: 'You''ll need to update your saved credentials in the `git-credential-osxkeychain` helper if you change your{% ifversion not ghae %} username, password, or{% endif %} personal access token on {% data variables.product.product_name %}.'
|
||||
intro: 'You''ll need to update your saved credentials in the `git-credential-osxkeychain` helper if you change your{% ifversion not ghae %} username, password, or{% endif %} {% data variables.product.pat_generic %} on {% data variables.product.product_name %}.'
|
||||
redirect_from:
|
||||
- /articles/updating-credentials-from-the-osx-keychain
|
||||
- /github/using-git/updating-credentials-from-the-osx-keychain
|
||||
@@ -16,9 +16,9 @@ shortTitle: macOS Keychain credentials
|
||||
---
|
||||
{% tip %}
|
||||
|
||||
**Note:** Updating credentials from the macOS Keychain only applies to users who manually configured a PAT using the `osxkeychain` helper that is built-in to macOS.
|
||||
**Note:** Updating credentials from the macOS Keychain only applies to users who manually configured a {% data variables.product.pat_generic %} using the `osxkeychain` helper that is built-in to macOS.
|
||||
|
||||
We recommend you either [configure SSH](/articles/generating-an-ssh-key) or upgrade to the [Git Credential Manager](/get-started/getting-started-with-git/caching-your-github-credentials-in-git) (GCM) instead. GCM can manage authentication on your behalf (no more manual PATs) including 2FA (two-factor auth).
|
||||
We recommend you either [configure SSH](/articles/generating-an-ssh-key) or upgrade to the [Git Credential Manager](/get-started/getting-started-with-git/caching-your-github-credentials-in-git) (GCM) instead. GCM can manage authentication on your behalf (no more manual {% data variables.product.pat_generic %}s) including 2FA (two-factor auth).
|
||||
|
||||
{% endtip %}
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ Using an HTTPS remote URL has some advantages compared with using SSH. It's easi
|
||||
|
||||
{% data reusables.user-settings.password-authentication-deprecation %}
|
||||
|
||||
You can avoid being prompted for your password by configuring Git to [cache your credentials](/github/getting-started-with-github/caching-your-github-credentials-in-git) for you. Once you've configured credential caching, Git automatically uses your cached personal access token when you pull or push a repository using HTTPS.
|
||||
You can avoid being prompted for your password by configuring Git to [cache your credentials](/github/getting-started-with-github/caching-your-github-credentials-in-git) for you. Once you've configured credential caching, Git automatically uses your cached {% data variables.product.pat_generic %} when you pull or push a repository using HTTPS.
|
||||
|
||||
## Further reading
|
||||
|
||||
|
||||
@@ -32,7 +32,7 @@ If you'd like to match the commits in your repository to the authors' GitHub per
|
||||
5. Review the information you entered, then click **Begin import**.
|
||||
|
||||
6. If your old project requires credentials, type your login information for that project, then click **Submit**.
|
||||
If SAML SSO or 2FA are enabled for your user account on the old project, enter a personal access token with repository read permissions in the "Password" field instead of your password.
|
||||
If SAML SSO or 2FA are enabled for your user account on the old project, enter a {% data variables.product.pat_generic %} with repository read permissions in the "Password" field instead of your password.
|
||||
|
||||
7. If there are multiple projects hosted at your old project's clone URL, choose the project you'd like to import, then click **Submit**.
|
||||
|
||||
|
||||
@@ -23,7 +23,7 @@ If you do not verify your email address, you will not be able to:
|
||||
- Create issues or pull requests
|
||||
- Comment on issues, pull requests, or commits
|
||||
- Authorize {% data variables.product.prodname_oauth_app %} applications
|
||||
- Generate personal access tokens
|
||||
- Generate {% data variables.product.pat_generic %}s
|
||||
- Receive email notifications
|
||||
- Star repositories
|
||||
- Create or update project boards, including adding cards
|
||||
|
||||
@@ -16,9 +16,11 @@ shortTitle: Form calls with GraphQL
|
||||
|
||||
## Authenticating with GraphQL
|
||||
|
||||
To communicate with the GraphQL server, you'll need an OAuth token with the right scopes.
|
||||
{% data reusables.user-settings.graphql-classic-pat-only %}
|
||||
|
||||
Follow the steps in "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)" to create a token. The scopes you require depends on the type of data you're trying to request. For example, select the **User** scopes to request user data. If you need access to repository information, select the appropriate **Repository** scopes.
|
||||
To communicate with the GraphQL server, you'll need a {% data variables.product.pat_generic %} with the right scopes.
|
||||
|
||||
Follow the steps in "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)" to create a token. The scopes you require depends on the type of data you're trying to request. For example, select the **User** scopes to request user data. If you need access to repository information, select the appropriate **Repository** scopes.
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
|
||||
|
||||
@@ -121,7 +121,7 @@ GraphQL is [introspective](https://graphql.github.io/learn/introspection/). This
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**: If you get the response `"message": "Bad credentials"` or `401 Unauthorized`, check that you are using a valid token. For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
**Note**: If you get the response `"message": "Bad credentials"` or `401 Unauthorized`, check that you are using a valid token. The GraphQL API only supports authentication using a {% data variables.product.pat_v1 %}. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
|
||||
@@ -41,17 +41,19 @@ For a list of the fields available with the Enterprise Accounts API, see "[Graph
|
||||
## Getting started using GraphQL for enterprise accounts
|
||||
|
||||
Follow these steps to get started using GraphQL to manage your enterprise accounts:
|
||||
- Authenticating with a personal access token
|
||||
- Authenticating with a {% data variables.product.pat_generic %}
|
||||
- Choosing a GraphQL client or using the GraphQL Explorer
|
||||
- Setting up Insomnia to use the GraphQL API
|
||||
|
||||
For some example queries, see "[An example query using the Enterprise Accounts API](#an-example-query-using-the-enterprise-accounts-api)."
|
||||
|
||||
### 1. Authenticate with your personal access token
|
||||
### 1. Authenticate with your {% data variables.product.pat_generic %}
|
||||
|
||||
1. To authenticate with GraphQL, you need to generate a personal access token (PAT) from developer settings. For more information, see "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
{% data reusables.user-settings.graphql-classic-pat-only %}
|
||||
|
||||
2. Grant admin and full control permissions to your personal access token for areas of GHES you'd like to access. For full permission to private repositories, organizations, teams, user data, and access to enterprise billing and profile data, we recommend you select these scopes for your personal access token:
|
||||
1. To authenticate with GraphQL, you need to generate a {% data variables.product.pat_generic %} from developer settings. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
|
||||
2. Grant admin and full control permissions to your {% data variables.product.pat_generic %} for areas of GHES you'd like to access. For full permission to private repositories, organizations, teams, user data, and access to enterprise billing and profile data, we recommend you select these scopes for your {% data variables.product.pat_generic %}:
|
||||
- `repo`
|
||||
- `admin:org`
|
||||
- `user`
|
||||
@@ -63,7 +65,7 @@ For some example queries, see "[An example query using the Enterprise Accounts A
|
||||
- `manage_runners:enterprise`: Access to manage GitHub Actions enterprise runners and runner-groups.{% endif %}
|
||||
- `read:enterprise`: Read enterprise profile data.
|
||||
|
||||
3. Copy your personal access token and keep it in a secure place until you add it to your GraphQL client.
|
||||
3. Copy your {% data variables.product.pat_generic %} and keep it in a secure place until you add it to your GraphQL client.
|
||||
|
||||
### 2. Choose a GraphQL client
|
||||
|
||||
@@ -82,11 +84,11 @@ The next steps will use Insomnia.
|
||||
- For your enterprise instance: `https://<HOST>/api/graphql`
|
||||
- For GitHub Enterprise Cloud: `https://api.github.com/graphql`
|
||||
|
||||
2. To authenticate, open the authentication options menu and select **Bearer token**. Next, add your personal access token that you copied earlier.
|
||||
2. To authenticate, open the authentication options menu and select **Bearer token**. Next, add your {% data variables.product.pat_generic %} that you copied earlier.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
3. Include header information.
|
||||
- Add `Content-Type` as the header and `application/json` as the value.
|
||||
|
||||
@@ -30,7 +30,7 @@ You may also want to use the **actions/add-to-project** workflow, which is maint
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note:** `GITHUB_TOKEN` is scoped to the repository level and cannot access {% data variables.projects.projects_v2 %}. To access {% data variables.projects.projects_v2 %} you can either create a {% data variables.product.prodname_github_app %} (recommended for organization projects) or a personal access token (recommended for user projects). Workflow examples for both approaches are shown below.
|
||||
**Note:** `GITHUB_TOKEN` is scoped to the repository level and cannot access {% data variables.projects.projects_v2 %}. To access {% data variables.projects.projects_v2 %} you can either create a {% data variables.product.prodname_github_app %} (recommended for organization projects) or a {% data variables.product.pat_generic %} (recommended for user projects). Workflow examples for both approaches are shown below.
|
||||
|
||||
{% endnote %}
|
||||
|
||||
@@ -167,10 +167,10 @@ jobs:
|
||||
|
||||
```
|
||||
|
||||
### Example workflow authenticating with a personal access token
|
||||
### Example workflow authenticating with a {% data variables.product.pat_generic %}
|
||||
|
||||
1. Create a personal access token with the `project` and `repo` scopes. For more information, see "[Creating a personal access token](/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
2. Save the personal access token as a secret in your repository or organization.
|
||||
1. Create a {% data variables.product.pat_v1 %} with the `project` and `repo` scopes. For more information, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
2. Save the {% data variables.product.pat_generic %} as a secret in your repository or organization.
|
||||
3. In the following workflow, replace `YOUR_TOKEN` with the name of the secret. Replace `YOUR_ORGANIZATION` with the name of your organization. For example, `octo-org`. Replace `YOUR_PROJECT_NUMBER` with your project number. To find the project number, look at the project URL. For example, `https://github.com/orgs/octo-org/projects/5` has a project number of 5.
|
||||
|
||||
```yaml{:copy}
|
||||
@@ -339,7 +339,7 @@ env:
|
||||
PROJECT_NUMBER: YOUR_PROJECT_NUMBER
|
||||
```
|
||||
|
||||
Personal access token:
|
||||
{% data variables.product.pat_generic_caps %}:
|
||||
|
||||
```yaml
|
||||
env:
|
||||
@@ -353,7 +353,7 @@ env:
|
||||
Sets environment variables for this step.
|
||||
<br>
|
||||
<br>
|
||||
If you are using a personal access token, replace <code>YOUR_TOKEN</code> with the name of the secret that contains your personal access token.
|
||||
If you are using a {% data variables.product.pat_generic %}, replace <code>YOUR_TOKEN</code> with the name of the secret that contains your {% data variables.product.pat_generic %}.
|
||||
<br>
|
||||
<br>
|
||||
Replace <code>YOUR_ORGANIZATION</code> with the name of your organization. For example, <code>octo-org</code>.
|
||||
@@ -433,7 +433,7 @@ env:
|
||||
PR_ID: {% raw %}${{ github.event.pull_request.node_id }}{% endraw %}
|
||||
```
|
||||
|
||||
Personal access token:
|
||||
{% data variables.product.pat_generic_caps %}:
|
||||
|
||||
```yaml
|
||||
env:
|
||||
@@ -504,7 +504,7 @@ env:
|
||||
GITHUB_TOKEN: {% raw %}${{ steps.generate_token.outputs.token }}{% endraw %}
|
||||
```
|
||||
|
||||
Personal access token:
|
||||
{% data variables.product.pat_generic_caps %}:
|
||||
|
||||
```yaml
|
||||
env:
|
||||
|
||||
@@ -21,7 +21,7 @@ This article demonstrates how to use the GraphQL API to manage a project. For mo
|
||||
|
||||
{% curl %}
|
||||
|
||||
In all of the following cURL examples, replace `TOKEN` with a token that has the `read:project` scope (for queries) or `project` scope (for queries and mutations). The token can be a personal access token for a user or an installation access token for a {% data variables.product.prodname_github_app %}. For more information about creating a personal access token, see "[Creating a personal access token](/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token)." For more information about creating an installation access token for a {% data variables.product.prodname_github_app %}, see "[Authenticating with {% data variables.product.prodname_github_apps %}](/developers/apps/building-github-apps/authenticating-with-github-apps#authenticating-as-a-github-app)."
|
||||
In all of the following cURL examples, replace `TOKEN` with a token that has the `read:project` scope (for queries) or `project` scope (for queries and mutations). The token can be a {% data variables.product.pat_v1 %} for a user or an installation access token for a {% data variables.product.prodname_github_app %}. For more information about creating a {% data variables.product.pat_generic %}, see "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token)." For more information about creating an installation access token for a {% data variables.product.prodname_github_app %}, see "[Authenticating with {% data variables.product.prodname_github_apps %}](/developers/apps/building-github-apps/authenticating-with-github-apps#authenticating-as-a-github-app)."
|
||||
|
||||
{% endcurl %}
|
||||
|
||||
|
||||
@@ -16,7 +16,7 @@ shortTitle: Manage SAML access
|
||||
|
||||
## About SAML access to your organization
|
||||
|
||||
When you enable SAML single sign-on for your organization, each organization member can link their external identity on your identity provider (IdP) to their existing account on {% data variables.location.product_location %}. To access your organization's resources on {% data variables.product.product_name %}, the member must have an active SAML session in their browser. To access your organization's resources using the API or Git, the member must use a personal access token or SSH key that the member has authorized for use with your organization.
|
||||
When you enable SAML single sign-on for your organization, each organization member can link their external identity on your identity provider (IdP) to their existing account on {% data variables.location.product_location %}. To access your organization's resources on {% data variables.product.product_name %}, the member must have an active SAML session in their browser. To access your organization's resources using the API or Git, the member must use a {% data variables.product.pat_generic %} or SSH key that the member has authorized for use with your organization.
|
||||
|
||||
You can view and revoke each member's linked identity, active sessions, and authorized credentials on the same page.
|
||||
|
||||
|
||||
@@ -39,11 +39,11 @@ children:
|
||||
- /managing-peoples-access-to-your-organization-with-roles
|
||||
- /organizing-members-into-teams
|
||||
- /collaborating-with-your-team
|
||||
- /managing-access-to-your-organizations-repositories
|
||||
- /managing-user-access-to-your-organizations-repositories
|
||||
- /managing-access-to-your-organizations-project-boards
|
||||
- /managing-access-to-your-organizations-apps
|
||||
- /managing-programmatic-access-to-your-organization
|
||||
- /managing-organization-settings
|
||||
- /restricting-access-to-your-organizations-data
|
||||
- /managing-oauth-access-to-your-organizations-data
|
||||
- /keeping-your-organization-secure
|
||||
- /managing-saml-single-sign-on-for-your-organization
|
||||
- /granting-access-to-your-organization-with-saml-single-sign-on
|
||||
|
||||
@@ -16,6 +16,5 @@ children:
|
||||
- /restricting-email-notifications-for-your-organization
|
||||
- /reviewing-the-audit-log-for-your-organization
|
||||
- /accessing-compliance-reports-for-your-organization
|
||||
- /reviewing-your-organizations-installed-integrations
|
||||
---
|
||||
|
||||
|
||||
@@ -39,6 +39,7 @@ To search for specific events, use the `action` qualifier in your query. Actions
|
||||
|------------------|-------------------{% ifversion fpt or ghec %}
|
||||
| [`account`](#account-category-actions) | Contains all activities related to your organization account.
|
||||
| [`advisory_credit`](#advisory_credit-category-actions) | Contains all activities related to crediting a contributor for a security advisory in the {% data variables.product.prodname_advisory_database %}. For more information, see "[About {% data variables.product.prodname_dotcom %} Security Advisories](/github/managing-security-vulnerabilities/about-github-security-advisories)."
|
||||
| [`auto_approve_personal_access_token_requests`](#auto_approve_personal_access_token_requests-category-actions) | Contains activities related to your organization's approval policy for {% data variables.product.pat_v2 %}s. For more information, see "[Setting a {% data variables.product.pat_generic %} policy for your organization](/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization)."
|
||||
| [`billing`](#billing-category-actions) | Contains all activities related to your organization's billing.
|
||||
| [`business`](#business-category-actions) | Contains activities related to business settings for an enterprise. |
|
||||
| [`codespaces`](#codespaces-category-actions) | Contains all activities related to your organization's codespaces. |{% endif %}{% ifversion fpt or ghec or ghes > 3.2 or ghae %}
|
||||
@@ -67,6 +68,7 @@ To search for specific events, use the `action` qualifier in your query. Actions
|
||||
| [`oauth_application`](#oauth_application-category-actions) | Contains all activities related to OAuth Apps.
|
||||
| [`packages`](#packages-category-actions) | Contains all activities related to {% data variables.product.prodname_registry %}.{% ifversion fpt or ghec %}
|
||||
| [`payment_method`](#payment_method-category-actions) | Contains all activities related to how your organization pays for GitHub.{% endif %}
|
||||
| [`personal_access_token`](#personal_access_token-category-actions) | Contains activities related to {% data variables.product.pat_v2 %}s in your organization. For more information, see "[Creating a {% data variables.product.pat_generic %}](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
|
||||
| [`profile_picture`](#profile_picture-category-actions) | Contains all activities related to your organization's profile picture.
|
||||
| [`project`](#project-category-actions) | Contains all activities related to project boards.
|
||||
| [`protected_branch`](#protected_branch-category-actions) | Contains all activities related to protected branches.
|
||||
@@ -209,6 +211,17 @@ An overview of some of the most common actions that are recorded as events in th
|
||||
| `destroy` | Triggered when the administrator of a security advisory removes someone from the credit section.
|
||||
{% endif %}
|
||||
|
||||
{% ifversion pat-v2 %}
|
||||
|
||||
### `auto_approve_personal_access_token_requests` category actions
|
||||
|
||||
| Action | Description
|
||||
|------------------|-------------------
|
||||
| `disable` | Triggered when the organization must approve {% data variables.product.pat_v2 %}s before the tokens can access organization resources. For more information, see "[Setting a {% data variables.product.pat_generic %} policy for your organization](/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization)."
|
||||
| `enable` | Triggered when {% data variables.product.pat_v2 %}s can access organization resources without prior approval. For more information, see "[Setting a {% data variables.product.pat_generic %} policy for your organization](/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization)."
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
### `billing` category actions
|
||||
|
||||
@@ -555,6 +568,20 @@ For more information, see "[Managing the publication of {% data variables.produc
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% ifversion pat-v2 %}
|
||||
|
||||
### `personal_access_token` category actions
|
||||
|
||||
| Action | Description
|
||||
|------------------|-------------------
|
||||
| `access_granted` | Triggered when a {% data variables.product.pat_v2 %} is granted access to organization resources. For more information, see "[Managing requests for {% data variables.product.pat_generic %} in your organization](/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization)."
|
||||
| `access_revoked` | Triggered when access to organization resources by a {% data variables.product.pat_v2 %} is revoked. The token can still read public organization resources. For more information, see "[Reviewing and revoking {% data variables.product.pat_generic %} in your organization](/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization)."
|
||||
| `request_cancelled` | Triggered when a member of the organization cancels a request for their {% data variables.product.pat_v2 %} to access organization resources.
|
||||
| `request_created` | Triggered when a member of the organization creates a {% data variables.product.pat_v2 %} to access organization resources and the organization requires approval before a {% data variables.product.pat_v2 %} can access organization resources. For more information, see "[Managing requests for {% data variables.product.pat_generic %} in your organization](/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization)."
|
||||
| `request_denied` | Triggered when a request for a {% data variables.product.pat_v2 %} to access organization resources is denied. For more information, see "[Managing requests for {% data variables.product.pat_generic %} in your organization](/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization)."
|
||||
|
||||
{% endif %}
|
||||
|
||||
### `profile_picture` category actions
|
||||
| Action | Description
|
||||
|------------------|-------------------
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
---
|
||||
title: Managing access to your organization's apps
|
||||
intro: 'As an organization owner, you can allow individual organization members to manage {% data variables.product.prodname_github_apps %} in your organization.'
|
||||
redirect_from:
|
||||
- /articles/managing-access-to-your-organization-s-apps
|
||||
- /articles/managing-access-to-your-organizations-apps
|
||||
- /github/setting-up-and-managing-organizations-and-teams/managing-access-to-your-organizations-apps
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
ghae: '*'
|
||||
ghec: '*'
|
||||
topics:
|
||||
- Organizations
|
||||
- Teams
|
||||
children:
|
||||
- /adding-github-app-managers-in-your-organization
|
||||
- /removing-github-app-managers-from-your-organization
|
||||
shortTitle: Manage access to apps
|
||||
---
|
||||
|
||||
@@ -25,7 +25,7 @@ After you add an SSH CA to your organization or enterprise account, you can use
|
||||
For example, you can build an internal system that issues a new certificate to your developers every morning. Each developer can use their daily certificate to work on your organization's repositories on {% data variables.product.product_name %}. At the end of the day, the certificate can automatically expire, protecting your repositories if the certificate is later compromised.
|
||||
|
||||
{% ifversion ghec %}
|
||||
Organization members can use their signed certificates for authentication even if you've enforced SAML single sign-on. Unless you make SSH certificates a requirement, organization members can continue to use other means of authentication to access your organization's resources with Git, including their username and password, personal access tokens, and their own SSH keys.
|
||||
Organization members can use their signed certificates for authentication even if you've enforced SAML single sign-on. Unless you make SSH certificates a requirement, organization members can continue to use other means of authentication to access your organization's resources with Git, including their username and password, {% data variables.product.pat_generic %}s, and their own SSH keys.
|
||||
{% endif %}
|
||||
|
||||
Members will not be able to use their certificates to access forks of your repositories that are owned by their personal accounts.
|
||||
|
||||
@@ -5,6 +5,7 @@ redirect_from:
|
||||
- /articles/about-third-party-application-restrictions
|
||||
- /articles/about-oauth-app-access-restrictions
|
||||
- /github/setting-up-and-managing-organizations-and-teams/about-oauth-app-access-restrictions
|
||||
- /organizations/restricting-access-to-your-organizations-data/about-oauth-app-access-restrictions
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghec: '*'
|
||||
@@ -5,6 +5,7 @@ redirect_from:
|
||||
- /articles/approving-third-party-applications-for-your-organization
|
||||
- /articles/approving-oauth-apps-for-your-organization
|
||||
- /github/setting-up-and-managing-organizations-and-teams/approving-oauth-apps-for-your-organization
|
||||
- /organizations/restricting-access-to-your-organizations-data/approving-oauth-apps-for-your-organization
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghec: '*'
|
||||
@@ -5,6 +5,7 @@ redirect_from:
|
||||
- /articles/denying-access-to-a-previously-approved-application-for-your-organization
|
||||
- /articles/denying-access-to-a-previously-approved-oauth-app-for-your-organization
|
||||
- /github/setting-up-and-managing-organizations-and-teams/denying-access-to-a-previously-approved-oauth-app-for-your-organization
|
||||
- /organizations/restricting-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghec: '*'
|
||||
@@ -5,6 +5,7 @@ redirect_from:
|
||||
- /articles/disabling-third-party-application-restrictions-for-your-organization
|
||||
- /articles/disabling-oauth-app-access-restrictions-for-your-organization
|
||||
- /github/setting-up-and-managing-organizations-and-teams/disabling-oauth-app-access-restrictions-for-your-organization
|
||||
- /organizations/restricting-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghec: '*'
|
||||
@@ -5,6 +5,7 @@ redirect_from:
|
||||
- /articles/enabling-third-party-application-restrictions-for-your-organization
|
||||
- /articles/enabling-oauth-app-access-restrictions-for-your-organization
|
||||
- /github/setting-up-and-managing-organizations-and-teams/enabling-oauth-app-access-restrictions-for-your-organization
|
||||
- /organizations/restricting-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghec: '*'
|
||||
@@ -1,10 +1,11 @@
|
||||
---
|
||||
title: Restricting access to your organization's data
|
||||
title: Managing OAuth access to your organization's data
|
||||
intro: '{% data variables.product.prodname_oauth_app %} access restrictions allow organization owners to restrict an untrusted app''s access to the organization''s data. Organization members can then use {% data variables.product.prodname_oauth_apps %} for their personal accounts while keeping organization data safe.'
|
||||
redirect_from:
|
||||
- /articles/restricting-access-to-your-organization-s-data
|
||||
- /articles/restricting-access-to-your-organizations-data
|
||||
- /github/setting-up-and-managing-organizations-and-teams/restricting-access-to-your-organizations-data
|
||||
- /organizations/restricting-access-to-your-organizations-data
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghec: '*'
|
||||
@@ -17,6 +18,6 @@ children:
|
||||
- /disabling-oauth-app-access-restrictions-for-your-organization
|
||||
- /approving-oauth-apps-for-your-organization
|
||||
- /denying-access-to-a-previously-approved-oauth-app-for-your-organization
|
||||
shortTitle: Restrict access to organization data
|
||||
shortTitle: Manage OAuth access
|
||||
---
|
||||
|
||||
@@ -4,6 +4,7 @@ intro: 'Organization owners can grant users the ability to manage some or all {%
|
||||
redirect_from:
|
||||
- /articles/adding-github-app-managers-in-your-organization
|
||||
- /github/setting-up-and-managing-organizations-and-teams/adding-github-app-managers-in-your-organization
|
||||
- /organizations/managing-access-to-your-organizations-apps/adding-github-app-managers-in-your-organization
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
@@ -0,0 +1,26 @@
|
||||
---
|
||||
title: Managing programmatic access to your organization
|
||||
intro: 'As an organization owner, you can control access by apps and {% data variables.product.pat_generic %}s to your organization.'
|
||||
redirect_from:
|
||||
- /articles/managing-access-to-your-organization-s-apps
|
||||
- /articles/managing-access-to-your-organizations-apps
|
||||
- /github/setting-up-and-managing-organizations-and-teams/managing-access-to-your-organizations-apps
|
||||
- /organizations/managing-access-to-your-organizations-apps
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
ghae: '*'
|
||||
ghec: '*'
|
||||
topics:
|
||||
- Organizations
|
||||
- Teams
|
||||
children:
|
||||
- /adding-github-app-managers-in-your-organization
|
||||
- /removing-github-app-managers-from-your-organization
|
||||
- /reviewing-your-organizations-installed-integrations
|
||||
- /setting-a-personal-access-token-policy-for-your-organization
|
||||
- /managing-requests-for-personal-access-tokens-in-your-organization
|
||||
- /reviewing-and-revoking-personal-access-tokens-in-your-organization
|
||||
shortTitle: Manage programmatic access
|
||||
---
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
---
|
||||
title: Managing requests for personal access tokens in your organization
|
||||
intro: Organization owners can approve or deny {% data variables.product.pat_v2 %}s that request access to their organization.
|
||||
versions:
|
||||
feature: pat-v2
|
||||
shortTitle: Manage token requests
|
||||
---
|
||||
|
||||
{% data reusables.user-settings.pat-v2-org-opt-in %}
|
||||
|
||||
## About {% data variables.product.pat_v2 %} requests
|
||||
|
||||
When organization members create a {% data variables.product.pat_v2 %} to access resources owned by the organization, if the organization requires approval for {% data variables.product.pat_v2 %}s, then an organization owner must approve the token before it can be used to access any resources that are not public. For more information, see "[Setting a {% data variables.product.pat_generic %} policy for your organization](/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization)."
|
||||
|
||||
{% data variables.product.company_short %} will notify organization owners with a daily email about all {% data variables.product.pat_v2 %}s that are awaiting approval. When a token is denied or approved, the user who created the token will receive an email notification.
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**: Only {% data variables.product.pat_v2 %}s, not {% data variables.product.pat_v1_plural %}, are subject to approval. Unless the organization has restricted access by {% data variables.product.pat_v1_plural %}, any {% data variables.product.pat_v1 %} can access organization resources without prior approval. For more information, see "[Setting a {% data variables.product.pat_generic %} policy for your organization](/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
## Managing {% data variables.product.pat_v2 %} requests
|
||||
|
||||
{% data reusables.profile.access_org %}
|
||||
{% data reusables.profile.org_settings %}
|
||||
1. In the left sidebar, under **{% octicon "key" aria-label="The key icon" %} {% data variables.product.pat_generic_caps %}s**, click **Pending requests**. If any tokens are pending approval for your organization, they will be displayed.
|
||||
1. Click the name of the token that you want to approve or deny.
|
||||
1. Review the access and permissions that the token is requesting.
|
||||
1. To grant the token access to the organization, click **Approve**. To deny the token access to the organization, click **Deny**.
|
||||
1. If you denied the request, in the confirmation box, optionally enter the reason that you denied the token. This reason will be shared in the notification that is sent to the token owner. Then, click **Deny**.
|
||||
|
||||
Alternatively, you can approve or deny multiple tokens at once:
|
||||
|
||||
{% data reusables.profile.access_org %}
|
||||
{% data reusables.profile.org_settings %}
|
||||
1. In the left sidebar, under **{% octicon "key" aria-label="The key icon" %} {% data variables.product.pat_generic_caps %}s**, click **Pending requests**. If any tokens are pending approval for your organization, they will be displayed.
|
||||
1. Optionally, use the **Owner** and **Repository** dropdown menus to filter the requests by the member making the request.
|
||||
1. Select each token that you want to approve or reject.
|
||||
1. Select the **request selected...** dropdown menu and click **Approve...** or **Deny...**.
|
||||
@@ -4,6 +4,7 @@ intro: 'Organization owners can revoke {% data variables.product.prodname_github
|
||||
redirect_from:
|
||||
- /articles/removing-github-app-managers-from-your-organization
|
||||
- /github/setting-up-and-managing-organizations-and-teams/removing-github-app-managers-from-your-organization
|
||||
- /organizations/managing-access-to-your-organizations-apps/removing-github-app-managers-from-your-organization
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
@@ -0,0 +1,37 @@
|
||||
---
|
||||
title: Reviewing and revoking personal access tokens in your organization
|
||||
intro: Organization owners can review the {% data variables.product.pat_v2 %}s that can access their organization. They can also revoke access of specific {% data variables.product.pat_v2 %}s.
|
||||
versions:
|
||||
feature: pat-v2
|
||||
shortTitle: Review token access
|
||||
---
|
||||
|
||||
{% data reusables.user-settings.pat-v2-org-opt-in %}
|
||||
|
||||
## About reviewing and revoking {% data variables.product.pat_v2 %}s
|
||||
|
||||
Organization owners can view all {% data variables.product.pat_v2 %}s that can access resources owned by the organization. Organization owners can also revoke access by {% data variables.product.pat_v2 %}s. When a {% data variables.product.pat_v2 %} is revoked, SSH keys created by the token will continue to work and the token will still be able to read public resources within the organization.
|
||||
|
||||
When a token is revoked, the user who created the token will receive an email notification.
|
||||
|
||||
Organization owners can only view and revoke {% data variables.product.pat_v2 %}s, not {% data variables.product.pat_v1_plural %}. Unless the organization {% ifversion ghec or ghes or ghae %}or enterprise {% endif %}has restricted access by {% data variables.product.pat_v1_plural %}, any {% data variables.product.pat_v1 %} can access organization resources until the token expires. For more information about restricting access by {% data variables.product.pat_v1_plural %}, see "[Setting a {% data variables.product.pat_generic %} policy for your organization](/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization)"{% ifversion ghec or ghes or ghae %} and "[Enforcing policies for {% data variables.product.pat_generic %}s in your enterprise](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-personal-access-tokens-in-your-enterprise)"{% endif %}.
|
||||
|
||||
{% ifversion ghec %} Organization owners can also view and revoke {% data variables.product.pat_v1_plural %} if their organization requires SAML single-sign on. For more information, see "[Viewing and managing a user's SAML access to your enterprise](/admin/user-management/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise#viewing-and-revoking-authorized-credentials)". For more information about using the REST API to do this, see "[List SAML SSO authorizations for an organization](/rest/orgs/orgs#list-saml-sso-authorizations-for-an-organization)" and "[Remove a SAML SSO authorization for an organization](/rest/orgs/orgs#remove-a-saml-sso-authorization-for-an-organization)."{% endif %}
|
||||
|
||||
## Reviewing and revoking {% data variables.product.pat_v2 %}s
|
||||
|
||||
{% data reusables.profile.access_org %}
|
||||
{% data reusables.profile.org_settings %}
|
||||
1. In the left sidebar, under **{% octicon "key" aria-label="The key icon" %} {% data variables.product.pat_generic_caps %}s**, click **Active tokens**. Any {% data variables.product.pat_v2 %}s that can access your organization will be displayed.
|
||||
1. Click the name of the token that you want review or revoke.
|
||||
1. Review the access and permissions that the token has.
|
||||
1. To revoke access by the token to the organization, click **Revoke**.
|
||||
|
||||
Alternatively, you can revoke multiple tokens at once:
|
||||
|
||||
{% data reusables.profile.access_org %}
|
||||
{% data reusables.profile.org_settings %}
|
||||
1. In the left sidebar, under **{% octicon "key" aria-label="The key icon" %} {% data variables.product.pat_generic_caps %}s**, click **Active tokens**. Any {% data variables.product.pat_v2 %}s that can access your organization will be displayed.
|
||||
1. Optionally, use the **Owner** dropdown to filter the tokens by the member who created the token.
|
||||
1. Select each token that you want to revoke.
|
||||
1. Select the **tokens selected...** dropdown menu and click **Revoke...**.
|
||||
@@ -6,6 +6,7 @@ redirect_from:
|
||||
- /articles/reviewing-your-organizations-installed-integrations
|
||||
- /github/setting-up-and-managing-organizations-and-teams/reviewing-your-organizations-installed-integrations
|
||||
- /organizations/keeping-your-organization-secure/reviewing-your-organizations-installed-integrations
|
||||
- /organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-your-organizations-installed-integrations
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
@@ -0,0 +1,57 @@
|
||||
---
|
||||
title: Setting a personal access token policy for your organization
|
||||
intro: "Organization owners can control whether to allow {% data variables.product.pat_v2 %}s and {% data variables.product.pat_v1_plural %}, and can require approval for {% data variables.product.pat_v2 %}s."
|
||||
versions:
|
||||
feature: pat-v2
|
||||
shortTitle: Set a token policy
|
||||
---
|
||||
|
||||
{% data reusables.user-settings.pat-v2-org-opt-in %}
|
||||
|
||||
## Restricting access by {% data variables.product.pat_v2 %}s
|
||||
|
||||
Organization owners can prevent {% data variables.product.pat_v2 %}s from accessing resources owned by the organization. {% data variables.product.pat_v2_caps %}s will still be able to read public resources within the organization. This setting only controls access by {% data variables.product.pat_v2 %}s, not {% data variables.product.pat_v1_plural %}. For more information about restricting access by {% data variables.product.pat_v1_plural %}, see "[Restricting access by {% data variables.product.pat_v1_plural %}](#restricting-access-by-personal-access-tokens-classic)" on this page.
|
||||
|
||||
{% ifversion ghec or ghes or ghae %} If your organization is owned by an enterprise, and your enterprise owner has restricted access by {% data variables.product.pat_v2 %}s, then you cannot override the policy in your organization. For more information, see "[Enforcing policies for {% data variables.product.pat_generic %}s in your enterprise](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-personal-access-tokens-in-your-enterprise)."{% endif %}
|
||||
|
||||
{% data reusables.profile.access_org %}
|
||||
{% data reusables.profile.org_settings %}
|
||||
1. In the left sidebar, under **{% octicon "key" aria-label="The key icon" %} {% data variables.product.pat_generic_caps %}s**, click **Settings**.
|
||||
1. Under **{% data variables.product.pat_v2_caps %}s**, select the option that meets your needs:
|
||||
- **Allow access via {% data variables.product.pat_v2 %}s**: {% data variables.product.pat_v2_caps %}s can access resources owned by the organization.
|
||||
- **Restrict access via {% data variables.product.pat_v2 %}s**: {% data variables.product.pat_v2_caps %}s cannot access resources owned by the organization. SSH keys created by {% data variables.product.pat_v2 %}s will continue to work.
|
||||
1. Click **Save**.
|
||||
|
||||
## Enforcing an approval policy for {% data variables.product.pat_v2 %}s
|
||||
|
||||
Organization owners can require approval for each {% data variables.product.pat_v2 %} that can access the organization. {% data variables.product.pat_v2_caps %}s will still be able to read public resources within the organization without approval. {% data variables.product.pat_v2_caps %}s created by organization owners will not need approval.
|
||||
|
||||
{% ifversion ghec or ghes or ghae %} If your organization is owned by an enterprise, and your enterprise owner has set an approval policy for {% data variables.product.pat_v2 %}s, then you cannot override the policy in your organization. For more information, see "[Enforcing policies for {% data variables.product.pat_generic %}s in your enterprise](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-personal-access-tokens-in-your-enterprise)."{% endif %}
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**: Only {% data variables.product.pat_v2 %}s, not {% data variables.product.pat_v1_plural %}, are subject to approval. Unless the organization has restricted access by {% data variables.product.pat_v1_plural %}, any {% data variables.product.pat_v1 %} can access organization resources without prior approval. For more information, see "[Restricting access by {% data variables.product.pat_v1_plural %}](#restricting-access-by-personal-access-tokens-classic)" on this page.
|
||||
|
||||
{% endnote %}
|
||||
|
||||
{% data reusables.profile.access_org %}
|
||||
{% data reusables.profile.org_settings %}
|
||||
1. In the left sidebar, under **{% octicon "key" aria-label="The key icon" %} {% data variables.product.pat_generic_caps %}s**, click **Settings**.
|
||||
1. Under **Require approval of {% data variables.product.pat_v2 %}s**, select the option that meets your needs:
|
||||
- **Require administrator approval**: An organization owner must approve each {% data variables.product.pat_v2 %} that can access the organization. {% data variables.product.pat_v2_caps %}s created by organization owners will not need approval.
|
||||
- **Do not require administrator approval**: {% data variables.product.pat_v2_caps %}s created by organization members can access resources in the organization without prior approval.
|
||||
1. Click **Save**.
|
||||
|
||||
## Restricting access by {% data variables.product.pat_v1_plural %}
|
||||
|
||||
Organization owners can prevent {% data variables.product.pat_v1_plural %} from accessing resources owned by the organization. {% data variables.product.pat_v1_caps_plural %} will still be able to read public resources within the organization. This setting only controls access by {% data variables.product.pat_v1_plural %}, not {% data variables.product.pat_v2 %}s. For more information about restricting access by {% data variables.product.pat_v2 %}s, see "[Restricting access by {% data variables.product.pat_v2 %}s](#restricting-access-by-fine-grained-personal-access-tokens)" on this page.
|
||||
|
||||
{% ifversion ghec or ghes or ghae %} If your organization is owned by an enterprise, and your enterprise owner has restricted access by {% data variables.product.pat_v1_plural %}, then you cannot override the policy in your organization. For more information, see "[Enforcing policies for {% data variables.product.pat_generic %}s in your enterprise](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-personal-access-tokens-in-your-enterprise)."{% endif %}
|
||||
|
||||
{% data reusables.profile.access_org %}
|
||||
{% data reusables.profile.org_settings %}
|
||||
1. In the left sidebar, under **{% octicon "key" aria-label="The key icon" %} {% data variables.product.pat_generic_caps %}s**, click **Settings**.
|
||||
1. Under **{% data variables.product.pat_v1_caps %}**, select the option that meets your needs:
|
||||
- **Allow access via {% data variables.product.pat_v1_plural %}**: {% data variables.product.pat_v1_caps_plural %} can access resources owned by the organization.
|
||||
- **Restrict access via {% data variables.product.pat_v1_plural %}**: {% data variables.product.pat_v1_caps_plural %} cannot access resources owned by the organization. SSH keys created by {% data variables.product.pat_v1_plural %} will continue to work.
|
||||
1. Click **Save**.
|
||||
@@ -30,7 +30,7 @@ For an organization, SAML SSO can be disabled, enabled but not enforced, or enab
|
||||
|
||||
Members must periodically authenticate with your IdP to authenticate and gain access to your organization's resources. The duration of this login period is specified by your IdP and is generally 24 hours. This periodic login requirement limits the length of access and requires users to re-identify themselves to continue.
|
||||
|
||||
To access the organization's protected resources using the API and Git on the command line, members must authorize and authenticate with a personal access token or SSH key. For more information, see "[Authorizing a personal access token for use with SAML single sign-on](/github/authenticating-to-github/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on)" and "[Authorizing an SSH key for use with SAML single sign-on](/github/authenticating-to-github/authorizing-an-ssh-key-for-use-with-saml-single-sign-on)."
|
||||
To access the organization's protected resources using the API and Git on the command line, members must authorize and authenticate with a {% data variables.product.pat_generic %} or SSH key. For more information, see "[Authorizing a {% data variables.product.pat_generic %} for use with SAML single sign-on](/github/authenticating-to-github/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on)" and "[Authorizing an SSH key for use with SAML single sign-on](/github/authenticating-to-github/authorizing-an-ssh-key-for-use-with-saml-single-sign-on)."
|
||||
|
||||
The first time a member uses SAML SSO to access your organization, {% data variables.product.prodname_dotcom %} automatically creates a record that links your organization, the member's account on {% data variables.location.product_location %}, and the member's account on your IdP. You can view and revoke the linked SAML identity, active sessions, and authorized credentials for members of your organization or enterprise account. For more information, see "[Viewing and managing a member's SAML access to your organization](/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization)" and "[Viewing and managing a user's SAML access to your enterprise account](/enterprise-cloud@latest/admin/user-management/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise)."
|
||||
|
||||
|
||||
@@ -79,7 +79,7 @@ This GraphQL query shows you the SAML `NameId`, the SCIM `UserName` and the {% d
|
||||
```
|
||||
|
||||
```shell
|
||||
curl -X POST -H "Authorization: Bearer <personal access token>" -H "Content-Type: application/json" -d '{ "query": "{ organization(login: \"ORG\") { samlIdentityProvider { externalIdentities(first: 100) { pageInfo { endCursor startCursor hasNextPage } edges { cursor node { samlIdentity { nameId } scimIdentity {username} user { login } } } } } } }" }' https://api.github.com/graphql
|
||||
curl -X POST -H "Authorization: Bearer YOUR_TOKEN" -H "Content-Type: application/json" -d '{ "query": "{ organization(login: \"ORG\") { samlIdentityProvider { externalIdentities(first: 100) { pageInfo { endCursor startCursor hasNextPage } edges { cursor node { samlIdentity { nameId } scimIdentity {username} user { login } } } } } } }" }' https://api.github.com/graphql
|
||||
```
|
||||
|
||||
For more information on using the GraphQL API, see:
|
||||
|
||||
@@ -4,6 +4,7 @@ intro: You can allow people who aren't members of your organization to access re
|
||||
redirect_from:
|
||||
- /articles/adding-outside-collaborators-to-repositories-in-your-organization
|
||||
- /github/setting-up-and-managing-organizations-and-teams/adding-outside-collaborators-to-repositories-in-your-organization
|
||||
- /organizations/managing-access-to-your-organizations-repositories/adding-outside-collaborators-to-repositories-in-your-organization
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
@@ -4,6 +4,7 @@ intro: You can cancel all invitations for a person to become an outside collabor
|
||||
permissions: Organization owners can cancel an invitation to become an outside collaborator in the organization.
|
||||
redirect_from:
|
||||
- /github/setting-up-and-managing-organizations-and-teams/canceling-an-invitation-to-become-an-outside-collaborator-in-your-organization
|
||||
- /organizations/managing-access-to-your-organizations-repositories/canceling-an-invitation-to-become-an-outside-collaborator-in-your-organization
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghec: '*'
|
||||
@@ -1,10 +1,11 @@
|
||||
---
|
||||
title: Converting an organization member to an outside collaborator
|
||||
intro: 'If a current member of your organization only needs access to certain repositories, such as consultants or temporary employees, you can convert them to an outside collaborator.'
|
||||
permissions: 'Organization owners can convert an organization member to an outside collaborator.'
|
||||
permissions: Organization owners can convert an organization member to an outside collaborator.
|
||||
redirect_from:
|
||||
- /articles/converting-an-organization-member-to-an-outside-collaborator
|
||||
- /github/setting-up-and-managing-organizations-and-teams/converting-an-organization-member-to-an-outside-collaborator
|
||||
- /organizations/managing-access-to-your-organizations-repositories/converting-an-organization-member-to-an-outside-collaborator
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
@@ -4,6 +4,7 @@ intro: 'If you would like to give an outside collaborator on your organization''
|
||||
redirect_from:
|
||||
- /articles/converting-an-outside-collaborator-to-an-organization-member
|
||||
- /github/setting-up-and-managing-organizations-and-teams/converting-an-outside-collaborator-to-an-organization-member
|
||||
- /organizations/managing-access-to-your-organizations-repositories/converting-an-outside-collaborator-to-an-organization-member
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
@@ -1,11 +1,12 @@
|
||||
---
|
||||
title: Managing access to your organization's repositories
|
||||
title: Managing user access to your organization's repositories
|
||||
intro: Organization owners can manage individual and team access to the organization's repositories. Team maintainers can also manage a team's repository access.
|
||||
redirect_from:
|
||||
- /articles/permission-levels-for-an-organization-repository
|
||||
- /articles/managing-access-to-your-organization-s-repositories
|
||||
- /articles/managing-access-to-your-organizations-repositories
|
||||
- /github/setting-up-and-managing-organizations-and-teams/managing-access-to-your-organizations-repositories
|
||||
- /organizations/managing-access-to-your-organizations-repositories
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
@@ -26,6 +27,6 @@ children:
|
||||
- /converting-an-organization-member-to-an-outside-collaborator
|
||||
- /converting-an-outside-collaborator-to-an-organization-member
|
||||
- /reinstating-a-former-outside-collaborators-access-to-your-organization
|
||||
shortTitle: Manage access to repositories
|
||||
shortTitle: Manage user access to repos
|
||||
---
|
||||
|
||||
@@ -6,6 +6,7 @@ redirect_from:
|
||||
- /articles/managing-an-individual-s-access-to-an-organization-repository
|
||||
- /articles/managing-an-individuals-access-to-an-organization-repository
|
||||
- /github/setting-up-and-managing-organizations-and-teams/managing-an-individuals-access-to-an-organization-repository
|
||||
- /organizations/managing-access-to-your-organizations-repositories/managing-an-individuals-access-to-an-organization-repository
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
@@ -5,6 +5,7 @@ redirect_from:
|
||||
- /articles/managing-team-access-to-an-organization-repository-early-access-program
|
||||
- /articles/managing-team-access-to-an-organization-repository
|
||||
- /github/setting-up-and-managing-organizations-and-teams/managing-team-access-to-an-organization-repository
|
||||
- /organizations/managing-access-to-your-organizations-repositories/managing-team-access-to-an-organization-repository
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
@@ -5,6 +5,7 @@ redirect_from:
|
||||
- /articles/reinstating-a-former-outside-collaborator-s-access-to-your-organization
|
||||
- /articles/reinstating-a-former-outside-collaborators-access-to-your-organization
|
||||
- /github/setting-up-and-managing-organizations-and-teams/reinstating-a-former-outside-collaborators-access-to-your-organization
|
||||
- /organizations/managing-access-to-your-organizations-repositories/reinstating-a-former-outside-collaborators-access-to-your-organization
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
@@ -4,6 +4,7 @@ intro: Owners and repository admins can remove an outside collaborator's access
|
||||
redirect_from:
|
||||
- /articles/removing-an-outside-collaborator-from-an-organization-repository
|
||||
- /github/setting-up-and-managing-organizations-and-teams/removing-an-outside-collaborator-from-an-organization-repository
|
||||
- /organizations/managing-access-to-your-organizations-repositories/removing-an-outside-collaborator-from-an-organization-repository
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
@@ -7,6 +7,7 @@ redirect_from:
|
||||
- /articles/repository-permission-levels-for-an-organization
|
||||
- /github/setting-up-and-managing-organizations-and-teams/repository-permission-levels-for-an-organization
|
||||
- /organizations/managing-access-to-your-organizations-repositories/repository-permission-levels-for-an-organization
|
||||
- /organizations/managing-access-to-your-organizations-repositories/repository-roles-for-an-organization
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user