Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhance error reporting when organization use SAML SSO #1145

Open
sileht opened this issue Jun 1, 2020 · 1 comment
Open

Enhance error reporting when organization use SAML SSO #1145

sileht opened this issue Jun 1, 2020 · 1 comment

Comments

@sileht
Copy link
Member

sileht commented Jun 1, 2020

Currently, we log that and just report a generic auth failure.

authentification failure, will retry another token: remote: The `xxxxx' organization has enabled or enforced SAML SSO. To access
remote: this repository, you must re-authorize the GitHub App `Mergify`.
fatal: unable to access 'https://github.com/xxxx/xxxx/': The requested URL returned error: 403

I have no idea how the github SAML SSO works, but I'm sure we can do better to make them aware they have to do something on their side to make rebase and backport working.

@jd
Copy link
Member

jd commented Jun 1, 2020

There's a button in your GitHub interface to authorize the app with your SSO access.
I know you can do that for personal tokens as described here: https://help.github.com/en/github/authenticating-to-github/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on

We should link to the GitHub doc if we can find it for apps.
Maybe https://help.github.com/en/github/authenticating-to-github/authorizing-oauth-apps#oauth-apps-and-organizations

I think it might as simpler as relogging to Mergify and/or renewing their token.

https://help.github.com/en/github/authenticating-to-github/about-authentication-with-saml-single-sign-on says:

To use the API or Git on the command line to access protected content in an organization that uses SAML SSO, you will need to use an authorized personal access token over HTTPS or an authorized SSH key. OAuth App access tokens are authorized by default.

So it should work by default, except maybe if SAML was added after Mergify was enabled?

mergify bot pushed a commit that referenced this issue Jun 3, 2020
Currently this is catched as AuthentificationFailure making Mergify
retrying for ever. This change mark the SAML message as fatal. So
the error message coming from Github is reported on the PullRequest.

Related #1145
Fixes MERGIFY-ENGINE-1MG
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants