You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
By default, authorized users can access your enterprise from any IP address. Enterprise owners can restrict access to assets owned by organizations in an enterprise account by configuring an allow list for specific IP addresses. {% data reusables.identity-and-permissions.ip-allow-lists-example-and-restrictions %}
19
20
20
21
{% data reusables.identity-and-permissions.ip-allow-lists-cidr-notation %}
21
22
22
-
{% data reusables.identity-and-permissions.ip-allow-lists-enable %}
23
+
{% data reusables.identity-and-permissions.ip-allow-lists-enable %} {% data reusables.identity-and-permissions.ip-allow-lists-enterprise %}
23
24
24
25
You can also configure allowed IP addresses for an individual organization. For more information, see "[Managing allowed IP addresses for your organization](/organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization)."
25
26
@@ -36,6 +37,10 @@ For instance-level restrictions using Azure NSGs, contact {% data variables.cont
36
37
{% data reusables.identity-and-permissions.ip-allow-lists-add-description %}
37
38
{% data reusables.identity-and-permissions.ip-allow-lists-add-entry %}
38
39
40
+
### Allowing access by {% data variables.product.prodname_github_apps %}
41
+
42
+
{% data reusables.identity-and-permissions.ip-allow-lists-githubapps-enterprise %}
43
+
39
44
### Enabling allowed IP addresses
40
45
41
46
{% data reusables.enterprise-accounts.access-enterprise %}
Copy file name to clipboardExpand all lines: content/developers/apps/building-github-apps/creating-a-github-app.md
+16-16
Original file line number
Diff line number
Diff line change
@@ -23,38 +23,38 @@ topics:
23
23
{% endnote %}
24
24
{% endif %}
25
25
26
-
{% data reusables.user-settings.access_settings %}
26
+
{% data reusables.apps.settings-step %}
27
27
{% data reusables.user-settings.developer_settings %}
28
28
{% data reusables.user-settings.github_apps %}
29
-
4. Click **New GitHub App**.
29
+
1. Click **New GitHub App**.
30
30
31
-
5. In "GitHub App name", type the name of your app.
31
+
1. In "GitHub App name", type the name of your app.
32
32
33
33
34
34
Give your app a clear and succinct name. Your app cannot have the same name as an existing GitHub account, unless it is your own user or organization name. A slugged version of your app's name will be shown in the user interface when your integration takes an action.
35
35
36
-
6. Optionally, in "Description", type a description of your app that users will see.
36
+
1. Optionally, in "Description", type a description of your app that users will see.
37
37
38
-
7. In "Homepage URL", type the full URL to your app's website.
38
+
1. In "Homepage URL", type the full URL to your app's website.
39
39
40
40
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "[email protected]" %}
41
-
8. In "Callback URL", type the full URL to redirect to after a user authorizes the installation. This URL is used if your app needs to identify and authorize user-to-server requests.
41
+
1. In "Callback URL", type the full URL to redirect to after a user authorizes the installation. This URL is used if your app needs to identify and authorize user-to-server requests.
42
42
43
43
You can use **Add callback URL** to provide additional callback URLs, up to a maximum of 10.
44
44
45
45
46
46
{% else %}
47
-
8. In "User authorization callback URL", type the full URL to redirect to after a user authorizes an installation. This URL is used if your app needs to identify and authorize user-to-server requests.
47
+
1. In "User authorization callback URL", type the full URL to redirect to after a user authorizes an installation. This URL is used if your app needs to identify and authorize user-to-server requests.
48
48
49
49
50
50
{% endif %}
51
51
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "[email protected]" or currentVersion == "github-ae@latest" %}
52
-
9. By default, to improve your app's security, your app will use expiring user authorization tokens. To opt-out of using expiring user tokens, you must deselect "Expire user authorization tokens". To learn more about setting up a refresh token flow and the benefits of expiring user tokens, see "[Refreshing user-to-server access tokens](/apps/building-github-apps/refreshing-user-to-server-access-tokens/)."
52
+
1. By default, to improve your app's security, your app will use expiring user authorization tokens. To opt-out of using expiring user tokens, you must deselect "Expire user authorization tokens". To learn more about setting up a refresh token flow and the benefits of expiring user tokens, see "[Refreshing user-to-server access tokens](/apps/building-github-apps/refreshing-user-to-server-access-tokens/)."
53
53
54
54
{% endif %}
55
-
9. If your app authorizes users using the OAuth flow, you can select **Request user authorization (OAuth) during installation** to allow people to authorize the app when they install it, saving a step. If you select this option, the "Setup URL" becomes unavailable and users will be redirected to your "User authorization callback URL" after installing the app. See "[Authorizing users during installation](/apps/installing-github-apps/#authorizing-users-during-installation)" for more information.
55
+
1. If your app authorizes users using the OAuth flow, you can select **Request user authorization (OAuth) during installation** to allow people to authorize the app when they install it, saving a step. If you select this option, the "Setup URL" becomes unavailable and users will be redirected to your "User authorization callback URL" after installing the app. See "[Authorizing users during installation](/apps/installing-github-apps/#authorizing-users-during-installation)" for more information.
56
56
57
-
10. If additional setup is required after installation, add a "Setup URL" to redirect users to after they install your app.
57
+
1. If additional setup is required after installation, add a "Setup URL" to redirect users to after they install your app.
58
58
59
59
60
60
{% note %}
@@ -63,10 +63,10 @@ topics:
63
63
64
64
{% endnote %}
65
65
66
-
11. In "Webhook URL", type the URL that events will POST to. Each app receives its own webhook which will notify you every time the app is installed or modified, as well as any other events the app subscribes to.
66
+
1. In "Webhook URL", type the URL that events will POST to. Each app receives its own webhook which will notify you every time the app is installed or modified, as well as any other events the app subscribes to.
67
67
68
68
69
-
12. Optionally, in "Webhook Secret", type an optional secret token used to secure your webhooks.
69
+
1. Optionally, in "Webhook Secret", type an optional secret token used to secure your webhooks.
70
70
71
71
72
72
{% note %}
@@ -75,10 +75,10 @@ topics:
75
75
76
76
{% endnote %}
77
77
78
-
13. In "Permissions", choose the permissions your app will request. For each type of permission, use the drop-down menu and click **Read-only**, **Read & write**, or **No access**.
78
+
1. In "Permissions", choose the permissions your app will request. For each type of permission, use the drop-down menu and click **Read-only**, **Read & write**, or **No access**.
79
79
80
-
14. In "Subscribe to events", choose the events you want your app to receive.
81
-
15. To choose where the app can be installed, select either **Only on this account** or **Any account**. For more information on installation options, see "[Making a GitHub App public or private](/apps/managing-github-apps/making-a-github-app-public-or-private/)."
80
+
1. In "Subscribe to events", choose the events you want your app to receive.
81
+
1. To choose where the app can be installed, select either **Only on this account** or **Any account**. For more information on installation options, see "[Making a GitHub App public or private](/apps/managing-github-apps/making-a-github-app-public-or-private/)."
82
82
83
-
16. Click **Create GitHub App**.
83
+
1. Click **Create GitHub App**.
84
84
title: Managing allowed IP addresses for a GitHub App
3
+
intro: You can add an IP allow list to your {% data variables.product.prodname_github_app %} to prevent your app from being blocked by an organization's own allow list.
4
+
versions:
5
+
free-pro-team: '*'
6
+
github-ae: '*'
7
+
topics:
8
+
- GitHub Apps
9
+
---
10
+
11
+
### About IP address allow lists for {% data variables.product.prodname_github_apps %}
12
+
13
+
Enterprise and organization owners can restrict access to assets by configuring an IP address allow list. This list specifies the IP addresses that are allowed to connect. For more information, see "[Managing allowed IP addresses for your organization](/organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization#enabling-allowed-ip-addresses)" and {% if currentVersion == "github-ae@latest" %}"[Restricting network traffic to your enterprise](/admin/configuration/configuring-your-enterprise/restricting-network-traffic-to-your-enterprise)." {% else %}"[Enforcing security settings in your enterprise account](/github/setting-up-and-managing-your-enterprise/setting-policies-for-organizations-in-your-enterprise-account/enforcing-security-settings-in-your-enterprise-account#managing-allowed-ip-addresses-for-organizations-in-your-enterprise-account)." {% endif %}
14
+
15
+
When an organization has an allow list, third-party applications that connect via a {% data variables.product.prodname_github_app %} will be denied access unless both of the following are true:
16
+
17
+
* The creator of the {% data variables.product.prodname_github_app %} has configured an allow list for the application that specifies the IP addresses at which their application runs. See below for details of how to do this.
18
+
* The organization owner has chosen to permit the addresses in the {% data variables.product.prodname_github_app %}'s allow list to be added to their own allow list. For more information, see "[Managing allowed IP addresses for your organization](/organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization#allowing-access-by-github-apps)."
19
+
20
+
{% data reusables.apps.ip-allow-list-only-apps %}
21
+
22
+
### Adding an IP address allow list to a {% data variables.product.prodname_github_app %}
23
+
24
+
{% data reusables.apps.settings-step %}
25
+
{% data reusables.user-settings.developer_settings %}
26
+
{% data reusables.user-settings.github_apps %}
27
+
{% data reusables.user-settings.modify_github_app %}
28
+
1. Scroll down to the "IP allow list" section.
29
+
30
+
{% data reusables.identity-and-permissions.ip-allow-lists-add-ip %}
31
+
{% data reusables.identity-and-permissions.ip-allow-lists-add-description %}
32
+
The description is for your reference and is not used in the allow list of organizations where the {% data variables.product.prodname_github_app %} is installed. Instead, organization allow lists will include "Managed by the NAME GitHub App" as the description.
33
+
{% data reusables.identity-and-permissions.ip-allow-lists-add-entry %}
Copy file name to clipboardExpand all lines: content/github/setting-up-and-managing-your-enterprise/setting-policies-for-organizations-in-your-enterprise-account/enforcing-security-settings-in-your-enterprise-account.md
+5-1
Original file line number
Diff line number
Diff line change
@@ -49,7 +49,7 @@ Enterprise owners can restrict access to assets owned by organizations in an ent
49
49
50
50
{% data reusables.identity-and-permissions.ip-allow-lists-cidr-notation %}
51
51
52
-
{% data reusables.identity-and-permissions.ip-allow-lists-enable %}
52
+
{% data reusables.identity-and-permissions.ip-allow-lists-enable %} {% data reusables.identity-and-permissions.ip-allow-lists-enterprise %}
53
53
54
54
You can also configure allowed IP addresses for an individual organization. For more information, see "[Managing allowed IP addresses for your organization](/organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization)."
55
55
@@ -62,6 +62,10 @@ You can also configure allowed IP addresses for an individual organization. For
62
62
{% data reusables.identity-and-permissions.ip-allow-lists-add-description %}
63
63
{% data reusables.identity-and-permissions.ip-allow-lists-add-entry %}
64
64
65
+
#### Allowing access by {% data variables.product.prodname_github_apps %}
66
+
67
+
{% data reusables.identity-and-permissions.ip-allow-lists-githubapps-enterprise %}
68
+
65
69
#### Enabling allowed IP addresses
66
70
67
71
{% data reusables.enterprise-accounts.access-enterprise %}
Copy file name to clipboardExpand all lines: content/organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization.md
+22-3
Original file line number
Diff line number
Diff line change
@@ -22,6 +22,8 @@ You can restrict access to organization assets by configuring an allow list for
22
22
23
23
{% data reusables.identity-and-permissions.ip-allow-lists-enable %}
24
24
25
+
If you set up an allow list you can also choose to automatically add to your allow list any IP addresses configured for {% data variables.product.prodname_github_apps %} that you install in your organization. The creator of a {% data variables.product.prodname_github_app %} can configure an allow list for their application, specifying the IP addresses at which the application runs. By inheriting their allow list into yours, you avoid connection requests from the application being refused. For more information, see "[Allowing access by {% data variables.product.prodname_github_apps %}](#allowing-access-by-github-apps)."
26
+
25
27
You can also configure allowed IP addresses for the organizations in an enterprise account. For more information, see {% if currentVersion == "github-ae@latest" %}"[Restricting network traffic to your enterprise](/admin/configuration/restricting-network-traffic-to-your-enterprise)." {% else %}"[Enforcing security settings in your enterprise account](/github/setting-up-and-managing-your-enterprise/enforcing-security-settings-in-your-enterprise-account#managing-allowed-ip-addresses-for-organizations-in-your-enterprise-account)."{% endif %}
26
28
27
29
### Adding an allowed IP address
@@ -38,9 +40,26 @@ You can also configure allowed IP addresses for the organizations in an enterpri
38
40
{% data reusables.profile.access_org %}
39
41
{% data reusables.profile.org_settings %}
40
42
{% data reusables.organizations.security %}
41
-
3. Under "IP allow list", select **Enable IP allow list**.
43
+
1. Under "IP allow list", select **Enable IP allow list**.
42
44
43
-
4. Click **Save**.
45
+
1. Click **Save**.
46
+
47
+
### Allowing access by {% data variables.product.prodname_github_apps %}
48
+
49
+
If you're using an allow list, you can also choose to automatically add to your allow list any IP addresses configured for {% data variables.product.prodname_github_apps %} that you install in your organization.
50
+
51
+
{% data reusables.identity-and-permissions.ip-allow-lists-address-inheritance %}
52
+
53
+
{% data reusables.apps.ip-allow-list-only-apps %}
54
+
55
+
For more information about how to create an allow list for a {% data variables.product.prodname_github_app %} you have created, see "[Managing allowed IP addresses for a GitHub App](/developers/apps/building-github-apps/managing-allowed-ip-addresses-for-a-github-app)."
56
+
57
+
{% data reusables.profile.access_org %}
58
+
{% data reusables.profile.org_settings %}
59
+
{% data reusables.organizations.security %}
60
+
1. Under "IP allow list", select **Enable IP allow list configuration for installed GitHub Apps**.
61
+
62
+
1. Click **Save**.
44
63
45
64
### Editing an allowed IP address
46
65
@@ -50,7 +69,7 @@ You can also configure allowed IP addresses for the organizations in an enterpri
50
69
{% data reusables.identity-and-permissions.ip-allow-lists-edit-entry %}
51
70
{% data reusables.identity-and-permissions.ip-allow-lists-edit-ip %}
52
71
{% data reusables.identity-and-permissions.ip-allow-lists-edit-description %}
**Note:** The addresses in the IP allow list of a {% data variables.product.prodname_github_app %} only affect requests made by installations of the {% data variables.product.prodname_github_app %}. The automatic addition of a {% data variables.product.prodname_github_app %}'s IP address to an organization's allow list does not allow access to a {% data variables.product.product_name %} user who connects from that IP address.
- For a {% data variables.product.prodname_github_app %} owned by a user account, in the upper-right corner of any page, click your profile photo, then click **Settings**.
3
+
4
+
- For a {% data variables.product.prodname_github_app %} owned by an organization, in the upper-right corner of any page, click your profile photo, then click **Your organizations**. Then, to the right of the organization, click **Settings**.
5
+
If you select **Enable IP allow list configuration for installed GitHub Apps** in your allow list settings, then IP addresses from installed {% data variables.product.prodname_github_apps %} are added to your allow list. This happens irrespective of whether your allow list is currently enabled. If you install a {% data variables.product.prodname_github_app %} and then the creator of that application changes the addresses in its allow list, your allow list is automatically updated with those changes.
2
+
3
+
You can identify the IP addresses that have been automatically added from {% data variables.product.prodname_github_apps %} by reviewing the description field. The description for these IP addresses is: "Managed by the NAME GitHub App." Unlike addresses you add manually, you cannot edit, delete, or disable IP addresses that are automatically added from {% data variables.product.prodname_github_apps %}.
0 commit comments