зеркало из https://github.com/github/docs.git
Enterprise bug fix hour for the week of April 10, 2023 (#36399)
This commit is contained in:
Rachael Rose Renk
GitHub
Родитель
136df2884f
Коммит
83098b0b4d
|
|
@ -54,13 +54,13 @@ $ base64 --decode ENCODED_OUTPUT
|
|||
|
||||
## Error: "Another user already owns the account"
|
||||
|
||||
When a user signs into {% data variables.location.product_location %} for the first time with SAML authentication, {% data variables.product.product_name %} creates a user account on the instance and maps the SAML `NameID` to the account.
|
||||
When a user signs into {% data variables.location.product_location %} for the first time with SAML authentication, {% data variables.product.product_name %} creates a user account on the instance and maps the SAML `NameID` and `nameid-format` to the account.
|
||||
|
||||
When the user signs in again, {% data variables.product.prodname_ghe_server %} compares the account's `NameID` mapping to the IdP's response. If the `NameID` in the IdP's response no longer matches the `NameID` that {% data variables.product.product_name %} expects for the user, the sign-in will fail. The user will see the following message.
|
||||
When the user signs in again, {% data variables.product.prodname_ghe_server %} compares the account's `NameID` and `nameid-format` mapping to the IdP's response. If the `NameID` or `nameid-format` in the IdP's response no longer matches the values that {% data variables.product.product_name %} expects for the user, the sign-in will fail. The user will see the following message.
|
||||
|
||||
> Another user already owns the account. Please have your administrator check the authentication log.
|
||||
|
||||
The message typically indicates that the person's username or email address has changed on the IdP. Ensure that the `NameID` mapping for the user account on {% data variables.product.prodname_ghe_server %} matches the user's `NameID` on your IdP. For more information, see "[AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/updating-a-users-saml-nameid)."
|
||||
The message typically indicates that the person's username or email address has changed on the IdP. Ensure that the `NameID` and `nameid-format` mapping for the user account on {% data variables.product.prodname_ghe_server %} matches the user's `NameID` and `nameid-format` on your IdP. For more information, see "[AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/updating-a-users-saml-nameid)."
|
||||
|
||||
## Error: Recipient in SAML response was blank or not valid
|
||||
|
||||
|
|
|
|||
|
|
@ -69,19 +69,18 @@ You can set up streaming to S3 with access keys or, to avoid storing long-lived
|
|||
#### Setting up streaming to S3 with access keys
|
||||
{% endif %}
|
||||
|
||||
To stream audit logs to Amazon's S3 endpoint, you must have a bucket and access keys. For more information, see [Creating, configuring, and working with Amazon S3 buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-buckets-s3.html) in the AWS documentation. Make sure to block public access to the bucket to protect your audit log information.
|
||||
|
||||
To set up audit log streaming from {% data variables.product.prodname_dotcom %} you will need:
|
||||
* The name of your Amazon S3 bucket
|
||||
* Your AWS access key ID
|
||||
* Your AWS secret key
|
||||
|
||||
For information on creating or accessing your access key ID and secret key, see [Understanding and getting your AWS credentials](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html) in the AWS documentation.
|
||||
|
||||
{% data reusables.audit_log.create-s3-bucket %}
|
||||
{% data reusables.audit_log.create-s3-policy %}
|
||||
{% data reusables.enterprise.navigate-to-log-streaming-tab %}
|
||||
{% data reusables.audit_log.streaming-choose-s3 %}{% ifversion streaming-oidc-s3 %}
|
||||
1. Under "Authentication", click **Access keys**.{% endif %}
|
||||
1. Configure the stream settings.
|
||||
2. Configure the stream settings.
|
||||
|
||||
- Under "Bucket", type the name of the bucket you want to stream to. For example, `auditlog-streaming-test`.
|
||||
- Under "Access Key ID", type your access key ID. For example, `ABCAIOSFODNN7EXAMPLE1`.
|
||||
|
|
@ -96,6 +95,8 @@ For information on creating or accessing your access key ID and secret key, see
|
|||
|
||||
- For the provider URL, use `https://oidc-configuration.audit-log.githubusercontent.com`.
|
||||
- For "Audience", use `sts.amazonaws.com`.
|
||||
{% data reusables.audit_log.create-s3-bucket %}
|
||||
{% data reusables.audit_log.create-s3-policy %}
|
||||
1. Create a bucket, and block public access to the bucket. For more information, see [Creating, configuring, and working with Amazon S3 buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-buckets-s3.html) in the AWS documentation.
|
||||
1. Create a policy that allows {% data variables.product.company_short %} to write to the bucket by copying the following JSON and replacing `EXAMPLE-BUCKET` with the name of your bucket. {% data variables.product.prodname_dotcom %} requires only the permissions in this JSON.
|
||||
|
||||
|
|
@ -115,7 +116,7 @@ For information on creating or accessing your access key ID and secret key, see
|
|||
}
|
||||
```
|
||||
For more information, see [Creating IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the AWS documentation.
|
||||
1. Configure the role and trust policy for the {% data variables.product.prodname_dotcom %} IdP. For more information, see [Creating a role for web identity or OpenID Connect Federation (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html) in the AWS documentation.
|
||||
4. Configure the role and trust policy for the {% data variables.product.prodname_dotcom %} IdP. For more information, see [Creating a role for web identity or OpenID Connect Federation (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html) in the AWS documentation.
|
||||
|
||||
- Add the permissions policy you created above to allow writes to the bucket.
|
||||
- Edit the trust relationship to add the `sub` field to the validation conditions, replacing `ENTERPRISE` with the name of your enterprise.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Using the audit log API for your enterprise
|
||||
intro: You can programmatically retrieve enterprise events with the REST or GraphQL API.
|
||||
intro: You can programmatically retrieve enterprise events with the REST API.
|
||||
shortTitle: Audit log API
|
||||
permissions: 'Enterprise owners {% ifversion ghes %}and site administrators {% endif %}can use the audit log API.'
|
||||
versions:
|
||||
|
|
@ -17,96 +17,10 @@ topics:
|
|||
|
||||
## Using the audit log API
|
||||
|
||||
You can interact with the audit log using the GraphQL API or the REST API.{% ifversion read-audit-scope %} You can use the `read:audit_log` scope to access the audit log via the APIs.{% endif %}
|
||||
You can interact with the audit log using the REST API.{% ifversion read-audit-scope %} You can use the `read:audit_log` scope to access the audit log via the API.{% endif %}
|
||||
|
||||
Timestamps and date fields in the API response are measured in [UTC epoch milliseconds](http://en.wikipedia.org/wiki/Unix_time).
|
||||
|
||||
## Querying the audit log GraphQL API
|
||||
|
||||
To ensure your intellectual property is secure, and you maintain compliance for your enterprise, you can use the audit log GraphQL API to keep copies of your audit log data and monitor:
|
||||
{% data reusables.audit_log.audit-log-api-info %}
|
||||
|
||||
Note that you can't retrieve Git events using the {% ifversion not ghec %}audit log API.{% else %}GraphQL API. To retrieve Git events, use the REST API instead. For more information, see `git` category actions in "[AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#git-category-actions)", and also the "[AUTOTITLE](/rest/enterprise-admin#audit-log)" and "[AUTOTITLE](/rest/orgs#get-the-audit-log-for-an-organization) audit log endpoints in the REST API documentation."{% endif %}
|
||||
|
||||
The GraphQL response can include data for up to 90 to 120 days.
|
||||
|
||||
### Example 1: Members added to or removed from organizations in an enterprise
|
||||
|
||||
The query below fetches the audit logs for the `avocado-corp` enterprise and returns the first 10 organizations in the enterprise, where the only actions performed were adding or removing a member from an organization. The first 20 audit log entries for each organization are returned.
|
||||
|
||||
This query uses the [auditlog](/graphql/reference/objects) field from the Organization object, and the [OrgAddMemberAuditEntry](/graphql/reference/objects#orgaddmemberauditentry) and [OrgRemoveMemberAuditEntry](/graphql/reference/objects#orgremovememberauditentry) objects. The {% data variables.product.prodname_dotcom %} account querying the enterprise audit log must be an organization owner for each organization within the enterprise.
|
||||
|
||||
```shell
|
||||
{
|
||||
enterprise(slug: "avocado-corp") {
|
||||
organizations(first: 10, orderBy: {field: LOGIN, direction: DESC}) {
|
||||
nodes {
|
||||
name
|
||||
auditLog(first: 20) {
|
||||
edges {
|
||||
node {
|
||||
... on OrgAddMemberAuditEntry {
|
||||
action
|
||||
actorLogin
|
||||
createdAt
|
||||
}
|
||||
... on OrgRemoveMemberAuditEntry {
|
||||
action
|
||||
actorLogin
|
||||
createdAt
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
pageInfo {
|
||||
hasNextPage
|
||||
endCursor
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
The GraphQL API will return at most 100 nodes per query. To retrieve additional results, you'll need to implement pagination. For more information, see "[AUTOTITLE](/graphql/overview/resource-limitations#node-limit)" in the GraphQL API documentation and [Pagination](https://graphql.org/learn/pagination/) in the official GraphQL documentation.
|
||||
### Example 2: Events in an organization, for a specific date and actor
|
||||
|
||||
You can specify multiple search phrases, such as `created` and `actor`, by separating them in your query string with a space.
|
||||
|
||||
The query below fetches all the audit logs for the `avocado-corp` enterprise that relate to the `octo-org` organization, where the actions were performed by the `octocat` user on or after the 1 Jan, 2022. The first 20 audit log entries are returned, with the newest log entry appearing first.
|
||||
|
||||
This query uses the [AuditEntry](/graphql/reference/interfaces#auditentry) interface. The {% data variables.product.prodname_dotcom %} account querying the enterprise audit log must be an owner of the `octo-org` organization.
|
||||
|
||||
```shell
|
||||
{
|
||||
enterprise(slug: "avocado-corp") {
|
||||
organizations(first: 1, query: "octo-org") {
|
||||
nodes {
|
||||
name
|
||||
auditLog(first: 20, query: "actor:octocat created:>=2022-01-01T00:00:00.000Z", orderBy: {field: CREATED_AT, direction: DESC}) {
|
||||
edges {
|
||||
node {
|
||||
... on AuditEntry {
|
||||
action
|
||||
actorLogin
|
||||
createdAt
|
||||
user {
|
||||
name
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
For more query examples, see the [platform-samples repository](https://github.com/github/platform-samples/blob/master/graphql/queries).
|
||||
|
||||
## Querying the audit log REST API
|
||||
|
||||
To ensure your intellectual property is secure, and you maintain compliance for your enterprise, you can use the audit log REST API to keep copies of your audit log data and monitor:
|
||||
{% data reusables.audit_log.audited-data-list %}
|
||||
|
||||
|
|
@ -114,7 +28,7 @@ To ensure your intellectual property is secure, and you maintain compliance for
|
|||
|
||||
For more information about the audit log REST API, see "[AUTOTITLE](/rest/enterprise-admin#audit-log)" and "[AUTOTITLE](/rest/orgs#get-the-audit-log-for-an-organization)."
|
||||
|
||||
### Example 1: All events in an enterprise, for a specific date, with pagination
|
||||
## Example 1: All events in an enterprise, for a specific date, with pagination
|
||||
|
||||
You can use {% ifversion ghes %}page-based{% else %}cursor based{% endif %} pagination. For more information about pagination, see "[AUTOTITLE](/rest/guides/using-pagination-in-the-rest-api)."
|
||||
|
||||
|
|
@ -156,7 +70,7 @@ curl -I -H "Authorization: Bearer TOKEN" \
|
|||
|
||||
{% endif %}
|
||||
|
||||
### Example 2: Events for pull requests in an enterprise, for a specific date and actor
|
||||
## Example 2: Events for pull requests in an enterprise, for a specific date and actor
|
||||
|
||||
You can specify multiple search phrases, such as `created` and `actor`, by separating them in your formed URL with the `+` symbol or ASCII character code `%20`.
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1 @@
|
|||
1. In AWS, create a bucket, and block public access to the bucket. For more information, see [Creating, configuring, and working with Amazon S3 buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-buckets-s3.html) in the AWS documentation.
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
1. In AWS, create a policy that allows {% data variables.product.company_short %} to write to the bucket by copying the following JSON and replacing `EXAMPLE-BUCKET` with the name of your bucket. {% data variables.product.prodname_dotcom %} requires only the permissions in this JSON.
|
||||
|
||||
```
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "VisualEditor0",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"s3:PutObject"
|
||||
],
|
||||
"Resource": "arn:aws:s3:::EXAMPLE-BUCKET/*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
For more information, see [Creating IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the AWS documentation.
|
||||
Загрузка…
Ссылка в новой задаче