このバージョンの GitHub Enterprise サーバーはこの日付をもって終了となりました: 2024-09-25. 重大なセキュリティの問題に対してであっても、パッチリリースは作成されません。 パフォーマンスの向上、セキュリティの向上、新機能の向上を図るために、最新バージョンの GitHub Enterprise サーバーにアップグレードしてください。 アップグレードに関するヘルプについては、GitHub Enterprise サポートにお問い合わせください。

CASの利用

Central Authentication Service (CAS) を使用して複数の Web アプリケーションへのアクセスを一元化する場合は、インスタンスの CAS 認証を構成することで、GitHub Enterprise Server を統合できます。

この記事の内容

About CAS authentication for GitHub Enterprise Server

CAS is a single sign-on (SSO) protocol that centralizes authentication to multiple web applications. For more information, see Central Authentication Service on Wikipedia.

After you configure CAS, people who use your GitHub Enterprise Server instance must use a personal access token to authenticate API or Git requests over HTTP(S). CAS credentials cannot be used to authenticate these requests. For more information, see Managing your personal access tokens.

If you configure CAS, people with accounts on your identity provider (IdP) do not consume a user license until the person signs into your GitHub Enterprise Server instance.

If you want to allow authentication for some people who don't have an account on your external authentication provider, you can allow fallback authentication to local accounts on your GitHub Enterprise Server instance. For more information, see Allowing built-in authentication for users outside your provider.

Username considerations with CAS

GitHub Enterprise Server normalizes a value from your external authentication provider to determine the username for each new personal account on your GitHub Enterprise Server instance. For more information, see Username considerations for external authentication.

CAS attributes

The username attribute is required and should be set to the GitHub Enterprise Server username.

No other attributes are available.

Configuring CAS

  1. From an administrative account on GitHub Enterprise Server, in the upper-right corner of any page, click .

  2. If you're not already on the "Site admin" page, in the upper-left corner, click Site admin.

  3. In the " Site admin" sidebar, click Management Console.

  4. In the "Settings" sidebar, click Authentication.

  5. Under "Authentication", select CAS.

  6. Optionally, to allow people without an account on your external authentication system to sign in with built-in authentication, select Allow built-in authentication. For more information, see Allowing built-in authentication for users outside your provider.

  7. In the Server URL field, type the full URL of your CAS server. If your CAS server uses a certificate that can't be validated by GitHub Enterprise Server, you can use the ghe-ssl-ca-certificate-install command to install it as a trusted certificate. For more information, see Command-line utilities.

  8. To apply the configuration, run the following command.

    Note

    During a configuration run, services on your GitHub Enterprise Server instance may restart, which can cause brief downtime for users.

    Shell
    ghe-config-apply

  9. Wait for the configuration run to complete.