mergify icon indicating copy to clipboard operation
mergify copied to clipboard

Enhance error reporting when organization use SAML SSO

Open sileht opened this issue 5 years ago • 1 comments

Currently, we log that and just report a generic auth failure.

authentification failure, will retry another token: remote: The `xxxxx' organization has enabled or enforced SAML SSO. To access
remote: this repository, you must re-authorize the GitHub App `Mergify`.
fatal: unable to access 'https://github.com/xxxx/xxxx/': The requested URL returned error: 403

I have no idea how the github SAML SSO works, but I'm sure we can do better to make them aware they have to do something on their side to make rebase and backport working.

sileht avatar Jun 01 '20 12:06 sileht

There's a button in your GitHub interface to authorize the app with your SSO access. I know you can do that for personal tokens as described here: https://help.github.com/en/github/authenticating-to-github/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on

We should link to the GitHub doc if we can find it for apps. Maybe https://help.github.com/en/github/authenticating-to-github/authorizing-oauth-apps#oauth-apps-and-organizations

I think it might as simpler as relogging to Mergify and/or renewing their token.

https://help.github.com/en/github/authenticating-to-github/about-authentication-with-saml-single-sign-on says:

To use the API or Git on the command line to access protected content in an organization that uses SAML SSO, you will need to use an authorized personal access token over HTTPS or an authorized SSH key. OAuth App access tokens are authorized by default.

So it should work by default, except maybe if SAML was added after Mergify was enabled?

jd avatar Jun 01 '20 12:06 jd