My (U.S., R1) academic institution uses CAS (Central Authentication Service) to authenticate almost all our web services.
However, they don't use CAS for our GitHub Enterprise instance. Instead they use LDAP, so the login page says "GitHub Enterprise", and there is nothing to indicate it's an official page of our institution except that the URL is under our .edu domain.
Beyond the fact that this bypasses our Duo 2FA deployment, I'm concerned that presenting users with a login page that expects their CAS password but isn't the normal CAS login page encourages phishing attacks by diluting the message of only putting your password into clearly official, institutionally-affiliated websites.
Is this valid, and is it worth raising with our campus IT department? (I'm a graduate student.)