Access Control via IdP

[mountainraptor]

Hello GitHub Community,

We're working on more tightly integrating our corporate accesses with a centralized IdP to quickly terminate and control accesses.

As far as I can tell the following hold true:

• There is no way to set token expiration to anything other than 24 hours. The IdP can send over info (Google SAML doesn't have this), and the hardcoded default if the IdP doesn't send it for GitHub is 24 hours. Not ideal for bot accounts or users.
• No accounts can have "exceptions" - we are using OIDC deployments to AWS and also integrating with a centralized bot account user. Bot accounts need to authorize as well. It seems that it would be ideal to have a SAML group in Google Workspace that doesn't need to SAML authenticate

There seems to be a gap between what GitHub and Google Workspace integrate as in the following areas and I'm hoping that there are solutions or somebody at GitHub can reach out and work with us on solving this problem. We recently migrated from GitLab to utilize Actions and other features and have invested heavily in building apparatus to automate our production CI/CD pipelines.