Multi-Factor Authentication (MFA/2FA) for GitHub

Last updated on October 16, 2024

Overview

The purpose of this document is to enable Rublon Two-Factor Authentication (2FA) for users logging in to a GitHub organization. In order to achieve that, you have to use Rublon Access Gateway. All required steps will be described in this document.

Note

The SAML single sign-on page is only available in GitHub Enterprise.

Supported Authentication Methods

Authentication Method	Supported	Comments
Mobile Push	✔	N/A
WebAuthn/U2F Security Key	✔	N/A
Passcode	✔	N/A
SMS Passcode	✔	N/A
SMS Link	✔	N/A
Phone Call	✔	N/A
QR Code	✔	N/A
Email Link	✔	N/A
YubiKey OTP Security Key	✔	N/A

Before you start

You need to install and configure Rublon Access Gateway itself before configuring GitHub to work with it. Please read the Rublon Access Gateway documentation and follow the steps in Installation and Configuration sections. Afterwards, follow the Configuration section in this document.

We assume you already have an organization in GitHub.

Configuration

Follow these steps to enable Rublon 2FA on GitHub.

Rublon Access Gateway

1. In Rublon Access Gateway, go to Applications → Add application.

2. Fill in the form and click SAVE to add a new application. Refer to the following image and table.

Application name	Enter a name for the application, e.g. GitHub. The name will be displayed during Rublon 2FA.
Entity ID	https://github.com/orgs/example Note: Replace example with the name of your organization.
Assertion Consumer Service	https://github.com/orgs/example/saml/consume Note: Replace example with the name of your organization.
Single Logout Service	https://github.com/
NameID format	urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
NameID attribute	mail
Send Attributes	NameID
Signature algorithm	sha-256
Validate Authn Request	Uncheck.
Sign response	Check.
Certificate for signing	Select the certificate you have downloaded from Applications → Information for configuring applications with Rublon Access Gateway → DOWNLOAD CERTIFICATE.

GitHub Enterprise

1. Log in to GitHub as administrator.

2. Select Organization security from the left pane and then check Enable SAML authentication.

3. Fill in the form. Refer to the following image and table.

Sign on URL	Enter the value of SSO URL from Rublon Access Gateway (Applications → Information for configuring applications with Rublon Access Gateway).
Issuer	Enter the value of Entity ID from Rublon Access Gateway (Applications → Information for configuring applications with Rublon Access Gateway).
Public certificate	Download the certificate from Applications → Information for configuring applications with Rublon Access Gateway → DOWNLOAD CERTIFICATE. Open the downloaded certificate in a text editor. Copy the entire contents and paste it into the text field.
Require SAML SSO authentication for all members of the Example organization.	Keep this option unchecked at least until you tested logging in to GitHub using Rublon 2FA.

3. Click Test SAML Configuration. GitHub will redirect you to the Rublon Access Gateway login page and Rublon 2FA will start. In case of any errors, GitHub will redirect you back to the SAML single sign-on page and display the error encountered while logging in.

Log in to GitHub with Rublon 2FA

1, Go to https://github.com/example to log in to your organization. Replace example with the name of your organization.

2. If you have not already logged in to your GitHub account, you will be asked to.

3. You will be asked to authenticate your account. Click Continue.

4. You will be redirected to the Rublon Access Gateway login page.

5. Provide your username and password. Click SIGN IN. A window will appear with a selection of various 2FA options from Rublon. Let’s choose Mobile Push.