What is the best approach to integrate GitHub with IIQ

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

SailPoin IIQ v8.4p2

Please share any images or screenshots, if relevant.

[Please insert images here, otherwise delete this section]

Please share any other relevant files that may be required (for example, logs).

[Please insert files here, otherwise delete this section]

Share all details about your problem, including any error messages you may have received.

What is the best approach to integrate GitHub with SailPoint IIQ.

  1. Manage GitHub Teams and Repo access via Entra groups. Currently GitHub SSO is managed via Entra ID group.
  2. Manage GitHub Teams and Repo access via AD groups
  3. Webservice connector using GitHub REST APIs
  4. Webservice connector using GitHub REST APIs for Aggregation and integrate with SNOW for Provisioning tickets.

There are around 1400 Repos and 32 Teams in GitHub. Repo access is granted via Teams and few exceptions are there were direct Repo access is given.

2

Hello @mirnalini_centrica ,

I had a similar requirement to integrate GitHub with SailPoint ISC and chose to use the Web Services Connector instead of the out-of-the-box GitHub connector.

Using GitHub REST APIs, I was able to successfully aggregate:

  • GitHub Organizations and Organization Members
  • GitHub Repositories
  • GitHub Teams and Team Memberships

From a provisioning perspective, GitHub has some limitations. There is no API available to directly add a user as an active organization member. To work around this, we leveraged the GitHub Organization Invitation API to send an invitation to the user. The user must accept the invitation before becoming an active member of the organization. Once the invitation is accepted and the next aggregation is completed, the user is reflected as an organization member in SailPoint ISC.

For deprovisioning, we used the Remove Organization Member API to remove users from the GitHub organization.

We were also able to automate the provisioning and deprovisioning of GitHub Team memberships, allowing users to be added to or removed from Teams through the API integration.

However, we encountered limitations with GitHub REST APIs for certain access management scenarios. Specifically:

  • Direct provisioning or deprovisioning of users to individual repositories was not implemented through our integration.
  • Managing repository-level exceptions (where access is granted directly rather than through Teams) required additional customization.
  • Provisioning or deprovisioning of organization-level roles through the REST APIs was not supported in our implementation.

Since repository access in our environment was primarily managed through Team memberships, controlling Team membership provided effective governance for most repository access requirements.

3

Welcome to the community, Mirnalini.

@vamgada’s Web Services approach is valid for IIQ 8.4p2.

I would suggest:

  • If GitHub Teams are synced with Entra groups, keep IIQ → Entra → GitHub Teams for provisioning. GitHub blocks API membership changes for IdP-synced Teams: Team Members API.
  • If Entra is only used for SSO, use the IIQ Web Services connector + GitHub REST APIs for Team membership provisioning and aggregation.
  • Treat direct repository access as an exception and move it to Teams where possible: Collaborators API.

With 1400 repositories and 32 Teams, I would govern the Teams in IIQ and handle direct repository grants separately. Use ServiceNow only where manual fulfillment is required.