PingOne

Creating a GitHub EMU connection

Use a GitHub Enterprise Managed Users (EMU) connection to enable provisioning from PingOne to the GitHub EMU user directory.

Before you begin

Make sure that you have:

Steps

  1. In the PingOne admin console, go to Integrations > Provisioning.

  2. Click and then click New Connection.

  3. On the Identity Store line, click Select.

  4. On the GitHub EMU tile, click Select. Click Next.

  5. Enter a name and description for the provisioning connection.

    Result:

    The connection name appears in the provisioning list after you save the connection.

  6. Click Next.

  7. In the Configure Authentication section, enter the values for the following fields:

    Field Value

    Base URL

    The fully qualified URL to use for the connected application, such as https://api.github.com/scim/v2/enterprises/<enterprise_slug>. Learn more in Creating an enterprise account in the GitHub documentation.

    Access Token

    The access token from GitHub EMU for the connected application. Learn more in Getting a GitHub EMU access token.

  8. Click Test Connection to verify that PingOne can establish a connection to GitHub EMU.

    Result:

    If there are any issues with the connection, a Test Connection Failed modal opens. Click Next to resume the setup with an invalid connection.

    You can’t use the connection for provisioning until you’ve established a valid connection to GitHub EMU. To retry, click Cancel in the Test Connection Failed modal and repeat step 7.

    Troubleshooting:

    Learn more about troubleshooting your connection in Troubleshooting test connection failure.

  9. In the Configure Preferences and Users Actions sections, configure the following:

    Field Description

    Group Membership Handling

    Determines whether to update or replace target groups with PingOne memberships. Select Merge or Overwrite.

    Merging or overwriting memberships only applies to SCIM, Slack, and GitHub EMU provisioning connections.

    Enable users creation

    Determines whether to create a user in the target identity store when the user is created in the source identity store.

    Enable users updation

    Determines whether to update user attributes in the target identity store when the user is updated in the source identity store.

    If Enable users updation is selected, you can choose to select Enable users disable which determines whether to disable a user in the target identity store when the user is disabled in the source identity store.

    Enable users deprovision

    Determines whether to deprovision a user in the target identity store when the user is deprovisioned in the source identity store.

    If Enable users deprovision is selected, the following configurations appear.

    • Remove Action: Determines whether to remove or disable a user in the target identity store when the user is deleted in the source identity store. Select Delete or Disable.

      Remove Action is only available if you select Enable users disable.

    • Deprovision on rule deletion: Determines whether to deprovision users if the associated provisioning rule is deleted.

    Users who are disabled in PingOne are marked as suspended in the GitHub EMU identity store.

  10. Click Save.

  11. To enable the connection, click the toggle at the top of the details panel to the right (blue).

    You can disable the connection by clicking the toggle to the left (gray).

Result

The GitHub EMU provisioning connection is complete and added to the list of provisioning connections on the Provisioning page.

Next steps

Sync group members out of PingOne into a software as a service (SaaS) application. Learn more in Configuring outbound group provisioning.

GitHub EMU provisioning features

The GitHub EMU provisioner offers the following features.

  • Provision users from the PingOne identity store to GitHub EMU:

    • Create users

    • Update users

    • Deprovision users

  • Customize provisioning options:

    • Deprovision users with a disable or delete action

  • Outbound group provisioning

Getting a GitHub EMU access token

Go to the GitHub EMU admin console and get an access token. Ensure that you have administrator privileges for the GitHub EMU admin console.

Steps

  1. Go to the GitHub EMU admin console at https://api.github.com/scim/v2/enterprises/<enterprise_slug>, where <enterprise_slug> is your tenant name.

  2. In the upper right, click your profile photo and then click Settings.

  3. On the left, click Developer settings.

  4. On the left, click Personal access tokens.

  5. Click Generate new token. Select the admin:enterprise scope for the token. Click Generate token. Copy the token to a secure location. You’ll enter this value in PingOne when you create the GitHub EMU provisioning connection.

GitHub EMU attribute mapping

The following table lists common GitHub EMU attributes that can be mapped for user provisioning.

Attribute Description

Username (required)

The user’s GitHub EMU username. According to GitHub, a username, including underscore and short code, must not exceed 39 characters. For more information, see About usernames for managed user accounts in the GitHub documentation.

Email (required)

The user’s email address.

External ID (required)

Associates a user ID with a user account in the GitHub EMU user directory.

First Name

The user’s first name.

Last Name

The user’s last name.

Active

The status of the user account in the GitHub EMU user directory.

Formatted Name

The user’s full name, including all middle names, titles and suffixes, formatted for display.

Display Name

A human-readable name for a user.

Roles

A list of the user’s roles. For example, you could map the Roles attribute to billing_manager or enterprise_owner.

For more information about role values, see Provision a SCIM enterprise user in the GitHub documentation.

If a user doesn’t have any roles assigned, they will be listed under the Unaffiliated section in GitHub EMU.

GitHub EMU provisioning known limitations

The following are known issues or limitations with GitHub EMU user provisioning.

  • GitHub does not support provisioning a user with an initial disabled state.

  • GitHub might enforce rate limiting for large numbers of users, such as more than 7000 users being provisioned at one time. For more information, see Rate limiting in the GitHub documentation.

  • If a group exists in Github with the same group name from provisioning, then syncing fails.