|
| 1 | +--- |
| 2 | +title: Troubleshooting identity and access management |
| 3 | +intro: 'Review and resolve common troubleshooting errors for managing your organization''s SAML SSO, team synchronization, or identity provider (IdP) connection.' |
| 4 | +product: '{% data reusables.gated-features.saml-sso %}' |
| 5 | +versions: |
| 6 | + fpt: '*' |
| 7 | + ghec: '*' |
| 8 | +topics: |
| 9 | + - Organizations |
| 10 | + - Teams |
| 11 | +shortTitle: Troubleshooting access |
| 12 | +--- |
| 13 | + |
| 14 | +## Some users are not provisioned or deprovisioned by SCIM |
| 15 | + |
| 16 | +When you encounter provisioning issues with users, we recommend that you check if the users are missing SCIM metadata. If an organization member has missing SCIM metadata, then you can re-provision SCIM for the user manually through your IdP. |
| 17 | + |
| 18 | +### Auditing users for missing SCIM metadata |
| 19 | + |
| 20 | +If you suspect or notice that any users are not provisioned or deprovisioned as expected, we recommend that you audit all users in your organization. |
| 21 | + |
| 22 | +To check whether users have a SCIM identity (SCIM metadata) in their external identity, you can review SCIM metadata for one organization member at a time on {% data variables.product.prodname_dotcom %} or you can programatically check all organization members using the {% data variables.product.prodname_dotcom %} API. |
| 23 | + |
| 24 | +#### Auditing organization members on {% data variables.product.prodname_dotcom %} |
| 25 | + |
| 26 | +As an organization owner, to confirm that SCIM metadata exists for a single organization member, visit this URL, replacing `<organization>` and `<username>`: |
| 27 | + |
| 28 | +> `https://github.com/orgs/<organization>/people/<username>/sso` |
| 29 | +
|
| 30 | +If the user's external identity includes SCIM metadata, the organization owner should see a SCIM identity section on that page. If their external identity does not include any SCIM metadata, the SCIM Identity section will not exist. |
| 31 | + |
| 32 | +#### Auditing organization members through the {% data variables.product.prodname_dotcom %} API |
| 33 | + |
| 34 | +As an organization owner, you can also query the SCIM REST API or GraphQL to list all SCIM provisioned identities in an organization. |
| 35 | + |
| 36 | +#### Using the REST API |
| 37 | + |
| 38 | +The SCIM REST API will only return data for users that have SCIM metadata populated under their external identities. We recommend you compare a list of SCIM provisioned identities with a list of all your organization members. |
| 39 | + |
| 40 | +For more information, see: |
| 41 | + - "[List SCIM provisioned identities](/rest/reference/scim#list-scim-provisioned-identities)" |
| 42 | + - "[List organization members](/rest/reference/orgs#list-organization-members)" |
| 43 | + |
| 44 | +#### Using GraphQL |
| 45 | + |
| 46 | +This GraphQL query shows you the SAML `NameId`, the SCIM `UserName` and the {% data variables.product.prodname_dotcom %} username (`login`) for each user in the organization. To use this query, replace `ORG` with your organization name. |
| 47 | + |
| 48 | +```graphql |
| 49 | +{ |
| 50 | + organization(login: "ORG") { |
| 51 | + samlIdentityProvider { |
| 52 | + ssoUrl |
| 53 | + externalIdentities(first: 100) { |
| 54 | + edges { |
| 55 | + node { |
| 56 | + samlIdentity { |
| 57 | + nameId |
| 58 | + } |
| 59 | + scimIdentity { |
| 60 | + username |
| 61 | + } |
| 62 | + user { |
| 63 | + login |
| 64 | + } |
| 65 | + } |
| 66 | + } |
| 67 | + } |
| 68 | + } |
| 69 | + } |
| 70 | +} |
| 71 | +``` |
| 72 | + |
| 73 | +```shell |
| 74 | +curl -X POST -H "Authorization: Bearer <personal access token>" -H "Content-Type: application/json" -d '{ "query": "{ organization(login: \"ORG\") { samlIdentityProvider { externalIdentities(first: 100) { pageInfo { endCursor startCursor hasNextPage } edges { cursor node { samlIdentity { nameId } scimIdentity {username} user { login } } } } } } }" }' https://api.github.com/graphql |
| 75 | +``` |
| 76 | + |
| 77 | +For more information on using the GraphQL API, see: |
| 78 | + - "[GraphQL guides](/graphql/guides)" |
| 79 | + - "[GraphQL explorer](/graphql/overview/explorer)" |
| 80 | + |
| 81 | +### Re-provisioning SCIM for users through your identity provider |
| 82 | + |
| 83 | +You can re-provision SCIM for users manually through your IdP. For example, to resolve provisioning errors, in the Okta admin portal, you can unassign and reassign users to the {% data variables.product.prodname_dotcom %} app. This should trigger Okta to make an API call to populate the SCIM metadata for these users on {% data variables.product.prodname_dotcom %}. For more information, see "[Unassign users from applications](https://help.okta.com/en/prod/Content/Topics/users-groups-profiles/usgp-unassign-apps.htm)" or "[Assign users to applications](https://help.okta.com/en/prod/Content/Topics/users-groups-profiles/usgp-assign-apps.htm)" in the Okta documentation. |
| 84 | + |
| 85 | +To confirm that a user's SCIM identity is created, we recommend testing this process with a single organization member whom you have confirmed doesn't have a SCIM external identity. After manually updating the users in your IdP, you can check if the user's SCIM identity was created using the SCIM API or on {% data variables.product.prodname_dotcom %}. For more information, see "[Auditing users for missing SCIM metadata](#auditing-users-for-missing-scim-metadata)" or the REST API endpoint "[Get SCIM provisioning information for a user](/rest/reference/scim#get-scim-provisioning-information-for-a-user)." |
| 86 | + |
| 87 | +If re-provisioning SCIM for users doesn't help, please contact {% data variables.product.prodname_dotcom %} Support. |
0 commit comments