|
| 1 | + |
| 2 | +## Background |
| 3 | + |
| 4 | +This is applicable to GitHub Enterprise Cloud enterprises that are enabled for [enterprise managed users (EMUs) and using Azure AD/Entra OIDC authentication](https://docs.github.com/en/enterprise-cloud@latest/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-oidc-for-enterprise-managed-users). |
| 5 | + |
| 6 | +[You can adjust the lifetime of a session, and how often a managed user account needs to reauthenticate with your IdP, by changing the lifetime policy property of the ID tokens issued for GitHub from your IdP. The default lifetime is one hour](https://docs.github.com/enterprise-cloud@latest/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-oidc-for-enterprise-managed-users#about-oidc-for-enterprise-managed-users). Our GitHub public documentation currently links [to this Microsoft article](https://learn.microsoft.com/en-us/entra/identity-platform/configure-token-lifetimes) for configuring this ID token lifetime policy; however, the PowerShell steps in that Microsoft article will not allow you to assign a token lifetime policy to the GitHub Enterprise Managed User (OIDC) app based on `ServicePrincipal Id` rather than application object `Id`. The token lifetime policy needs to be assigned to the `ServicePrincipal Id` of the app because this is the local representation of this multi-tenant app in your Azure AD/Entra tenant. It does not appear that the current PowerShell `cmdlets` will allow you to do this for a multi-tenant app, however the [MS Graph API](https://learn.microsoft.com/en-us/graph/use-the-api) will allow you to do this. |
| 7 | + |
| 8 | +## MS Graph Explorer steps for creating a `tokenLifetimePolicy` and assigning it to the GitHub Enterprise Managed User (OIDC) app in Azure AD/Entra |
| 9 | + |
| 10 | +Here is an example of the steps for creating a `tokenLifetimePolicy` in your tenant and assigning it to the `ServicePrincipal Id` of the GitHub Enterprise Managed User (OIDC) app using [Microsoft Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer). |
| 11 | + |
| 12 | +[You can have multiple `tokenLifetimePolicy` policies in a tenant but can only assign one `tokenLifetimePolicy` per application](https://learn.microsoft.com/en-us/graph/api/application-post-tokenlifetimepolicies?view=graph-rest-1.0&tabs=http). If you need assistance using MS Graph Explorer, these example commands, or configuring/applying a token lifetime policy in Azure AD/Entra using MS Graph, please reach out to Microsoft Support. |
| 13 | + |
| 14 | +1. Sign in to MS Graph Explorer using the admin account for your Azure AD/Entra tenant: https://developer.microsoft.com/en-us/graph/graph-explorer |
| 15 | + |
| 16 | +1. Set the **Request Header** in MS Graph Explorer to a key of `content-type` and a value of `application/json`. |
| 17 | + |
| 18 | +1. Run the query below to get the `id` of the `servicePrincipal` for the GitHub EMU OIDC app: |
| 19 | + |
| 20 | + - Request Method: `GET` |
| 21 | + |
| 22 | + - URL: |
| 23 | + |
| 24 | + ```text |
| 25 | + https://graph.microsoft.com/v1.0/servicePrincipals?$filter=displayName eq 'GitHub+Enterprise+Managed+User+(OIDC)'&$select=id |
| 26 | + ``` |
| 27 | +
|
| 28 | + - Example Response: |
| 29 | +
|
| 30 | + ```json |
| 31 | + { |
| 32 | + "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals(id)", |
| 33 | + "value": [ |
| 34 | + { |
| 35 | + "id": "abcdefgh-ijkl-1234-mnop-qrstuvwxyz56" |
| 36 | + } |
| 37 | + ] |
| 38 | + } |
| 39 | + ``` |
| 40 | +
|
| 41 | +1. You can verify that you're able to get this `servicePrincipal` object using this `id` with the query below: |
| 42 | +
|
| 43 | + - Request Method: `GET` |
| 44 | +
|
| 45 | + - URL: |
| 46 | +
|
| 47 | + > Replace the `SERVICE_PRICIPAL_ID` with the `id` of the `servicePrincipal` for the GitHub EMU OIDC app (from step 3) |
| 48 | +
|
| 49 | + ```text |
| 50 | + https://graph.microsoft.com/v1.0/servicePrincipals/SERVICE_PRICIPAL_ID?$select=id,appDisplayName,appId,displayName,tags |
| 51 | + ``` |
| 52 | +
|
| 53 | +1. Run the command below to create a new `tokenlifetimepolicy`. In the following example, the token lifetime policy is being set to 12 hours: |
| 54 | +
|
| 55 | + - Request Method: `POST` |
| 56 | +
|
| 57 | + - URL: |
| 58 | +
|
| 59 | + ```text |
| 60 | + https://graph.microsoft.com/v1.0/policies/tokenLifetimePolicies |
| 61 | + ``` |
| 62 | +
|
| 63 | + - Request Body: |
| 64 | +
|
| 65 | + ```json |
| 66 | + { |
| 67 | + "definition": [ |
| 68 | + "{\"TokenLifetimePolicy\":{\"Version\":1,\"AccessTokenLifetime\":\"12:00:00\"}}" |
| 69 | + ], |
| 70 | + "displayName": "12-hour policy", |
| 71 | + "isOrganizationDefault": false |
| 72 | + } |
| 73 | + ``` |
| 74 | +
|
| 75 | + The policy `id` will be listed in the results. |
| 76 | +
|
| 77 | +1. You can run the query below to list this new policy: |
| 78 | +
|
| 79 | + - Request Method: `GET` |
| 80 | +
|
| 81 | + - URL: |
| 82 | + > Replace the `NEW_TOKENLIFETIMEPOLICY_ID` with the `id` of the new token lifetime policy (from step 5). |
| 83 | +
|
| 84 | + ```text |
| 85 | + https://graph.microsoft.com/v1.0/policies/tokenLifetimePolicies/NEW_TOKENLIFETIMEPOLICY_ID |
| 86 | + ``` |
| 87 | +
|
| 88 | +1. Run the command below to assign this new policy to the `servicePrincipal` of the GitHub EMU OIDC app: |
| 89 | +
|
| 90 | + - Request Method: `POST` |
| 91 | +
|
| 92 | + - URL: |
| 93 | +
|
| 94 | + > Replace the `SERVICE_PRICIPAL_ID` with the `id` of the `servicePrincipal` for the GitHub EMU OIDC app (from step 3) |
| 95 | +
|
| 96 | + ```text |
| 97 | + https://graph.microsoft.com/v1.0/servicePrincipals/SERVICE_PRICIPAL_ID/tokenLifetimePolicies/$ref |
| 98 | + ``` |
| 99 | +
|
| 100 | + - Request body: |
| 101 | +
|
| 102 | + > Replace the `NEW_TOKENLIFETIMEPOLICY_ID` with the `id` of the new token lifetime policy from step 5. |
| 103 | +
|
| 104 | + ```json |
| 105 | + { |
| 106 | + "@odata.id": "https://graph.microsoft.com/v1.0/policies/tokenLifetimePolicies/NEW_TOKENLIFETIMEPOLICY_ID" |
| 107 | + } |
| 108 | + ``` |
| 109 | +
|
| 110 | +1. The query below will show the display name of the `tokenLifetimePolicy` assigned to this app based on the `servicePrincipal` of the app: |
| 111 | +
|
| 112 | + - Request Method: `GET` |
| 113 | +
|
| 114 | + - URL: |
| 115 | +
|
| 116 | + > Replace the `SERVICE_PRICIPAL_ID` with the `servicePrincipal Id` of the GitHub EMU OIDC app (from step 3). |
| 117 | +
|
| 118 | + ```text |
| 119 | + https://graph.microsoft.com/v1.0/servicePrincipals/SERVICE_PRICIPAL_ID/tokenLifetimePolicies?$select=displayName |
| 120 | + ``` |
| 121 | +
|
| 122 | + - Example Response: |
| 123 | +
|
| 124 | + ```json |
| 125 | + { |
| 126 | + "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#Collection(microsoft.graph.tokenLifetimePolicy)", |
| 127 | + "value": [ |
| 128 | + { |
| 129 | + "displayName": "12-hour policy" |
| 130 | + } |
| 131 | + ] |
| 132 | + } |
| 133 | + ``` |
0 commit comments