GitHub: organization SAML single sign-on

Problem

A GitHub organization on Enterprise Cloud can require SAML single sign-on: its entity ID is https://github.com/orgs/ORGANIZATION, the IdP posts to https://github.com/orgs/ORGANIZATION/saml/consume, sign-in starts at .../sso, and GitHub requires a signed assertion with the organization as audience and the ACS URL as recipient, then keeps the SAML session for 24 hours unless the assertion sets SessionNotOnOrAfter (https://docs.github.com/en/enterprise-cloud@latest/admin/managing-iam/iam-configuration-reference/saml-configuration-reference). A different external identity for an already linked account prompts a relink warning (https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/about-authentication-with-saml-single-sign-on). The GitHub emulator has no SAML, so an app or a test relying on organization SSO cannot run against it.

Proposal

• Organization SAML configuration in seed config (sign-on URL, issuer, public certificate), the organization's SP metadata, GET /orgs/:org/sso sending an AuthnRequest for a signed-in user, and POST /orgs/:org/saml/consume validating the response as documented (signature by the configured certificate, Destination, Recipient, Audience, validity window, InResponseTo).
• Link the NameID to the personal account on first sign-in, warn and relink on confirmation when it changes, and keep a SAML session for 24 hours or until SessionNotOnOrAfter. Enforcement on API credentials is left to a follow-up.

Implementation

A working version with tests and docs is on a fork branch: https://github.com/Unchallenged-com/emulate/tree/github-org-saml. Happy to open a pull request for it.