GitHub Organizations

WARNING

IF YOU ARE NOT CAREFUL you can configure spinnaker to allow ANY github user, not just the ones in your organization access to spinnaker. As such, please make sure to set the restrictions as appropriate for your org! Specifically spring.security.oauth2.client.registration.github.provider-requirements restriction to limit access to a specific github org! Failure to set this places your spinnaker installation at risk of unintended access! See Restrict access to an organization .

It’s recommended to use something like keycloak to terminate and control access and federate access than directly using github authentication via spinnaker. OR an alternative SSO provider!

Setup

Get Client ID and Secret

Consult the GitHub OAuth 2.0 documentation and register a new OAuth 2.0 application to obtain a client ID and client secret.

Note: While registering the application in github, under “Authorized redirect URIs”, add https://localhost:8084/login/oauth2/code/github (For Spinnaker below v2025.2.0, it should be https://localhost:8084/login)

Configure Gate

Add to gate-local.yml the following configuration

spring:
  security:
    oauth2:
      client:
        registration:
          userInfoMapping:
            email: email
            firstName: ''
            lastName: name
            username: login
          github:
            client-secret: client-secret
            scope: user:email
            client-id: client-id
        provider:
          github:
            user-info-uri: https://api.github.com/user
            authorization-uri: https://github.com/login/oauth/authorize
            token-uri: https://github.com/login/oauth/access_token

Restrict access to an organization

To only let members of a GitHub organization log in, set the organization provider requirement and add the read:org scope in gate-local.yml:

spring:
  security:
    oauth2:
      client:
        registration:
          github:
            scope: user:email,read:org
            provider-requirements:
              organization: my-org

Gate checks the user’s membership with the private GET <user-info-uri>/memberships/orgs/my-org endpoint, where <user-info-uri> is the user-info-uri of the github provider, and only lets the user in if the membership is active. GitHub only answers this request when:

• the token has the read:org scope, and
• the organization has approved the OAuth app, if it restricts OAuth app access . An organization owner can approve it, or a member can request approval when authorizing the app.

Otherwise the lookup fails and every user is rejected.

Before 2026.4.0, Gate checks the public organizations_url from GitHub’s /user response instead, which only lists memberships the user has made public, so users must make their membership of the organization public to log in.

For spinnaker before 2025.2.0

For older versions of spinnaker you’d have this configuration in gate-local.yml:

security:
  authn:
    oauth2:
      enabled: true
      client:
        clientId: # client ID from above
        clientSecret: # client secret from above
        accessTokenUri: https://github.com/login/oauth/access_token
        userAuthorizationUri: https://github.com/login/oauth/authorize
        scope: user:email
      resource:
        userInfoUri: https://api.github.com/user
      # You almost certainly want to restrict access to your Spinnaker by adding
      # userInfoRequirements; otherwise any user with a GitHub account will be
      # able to access it.
      userInfoRequirements: {}
      userInfoMapping:
        email: email
        firstName: ''
        lastName: name
        username: login
      provider: GITHUB