Skip to content
GitHub Forensics

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.

Glossary

SAML single sign-on (SSO)

Delegating GitHub organization or enterprise authentication to an identity provider; tokens and SSH keys must be authorized for SSO to reach resources.

With SAML single sign-on, a GitHub Enterprise Cloud organization or enterprise requires members to authenticate through an identity provider (Okta, Microsoft Entra ID, Google and others) before they can access its resources. Personal access tokens and SSH keys must also be authorized for SSO, and owners can revoke those authorizations during an incident.

Disabling SAML (org.disable_saml) or changing the provider settings (org.update_saml_provider_settings: issuer, SSO URL, certificate) can let an attacker bypass your IdP or point GitHub at one they control. See GitHub organization takeover.

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.