Gitfence
Start free

SCIM provisioning

Connect Okta or Microsoft Entra ID over SCIM, map IdP groups to access groups and see how deprovisioning and GitHub renames behave.

Short answer: SCIM lets your identity provider create, update and remove people and groups in Gitfence. You map an IdP group to an access group in each repository, and Gitfence applies the access. SCIM is part of Enterprise.

Steps

  1. Open Provisioning. Go to Settings → Integrations → Provisioning.
  2. Copy the SCIM base URL: https://gitfence.dev/o/<organization-slug>/scim/v2.
  3. Generate a token. Choose Generate token; Your new SCIM token shows it once. Send it as Authorization: Bearer gfscim_.... Replace token and Revoke stop the old token at once.
  4. Connect the provider.
    • Okta: Applications → your Gitfence app → Provisioning → Integration. Set SCIM connector base URL, Unique identifier field to userName, and Authentication to HTTP Header with this token.
    • Microsoft Entra ID: Enterprise application → Provisioning → Automatic. Set Tenant URL and Secret Token.
  5. Map groups. Under Group mapping, set an IdP group name (for example Contractors), the Access group it means, and Repositories. Choose Add row for more, then Save. The access group must already exist in every repository named. Matching ignores case, and the first matching row wins per repository.
  6. Check the people. IdP groups and people shows IdP groups and People. A person is waiting for first SSO sign-in, Linked, or Deactivated. Mapped access starts after their first SSO sign-in and their GitHub confirmation.

What is synced

  • Users: userName, externalId, displayName, name, emails and active. Emails are lowercased and deduplicated, primary first.
  • Groups: displayName, externalId and member IDs.
  • The enterprise extension, title and phone numbers are accepted and ignored. A user's groups attribute is read-only.

Deprovisioning

Setting active: false or deleting the user through SCIM performs a full offboarding: every repository membership ends, tokens and agent tokens are revoked, pending requests close, and the organization role is removed. In hosted mode the last owner keeps the owner role but loses repository access. Reactivating re-applies current mapped access; revoked tokens do not return.

GitHub login renames

A GitHub login rename is detected on GitHub sign-in through the stable numeric GitHub ID. The IdP link, SCIM-managed memberships and the deprovisioned marker follow the new login. A conflict with an existing account is rejected, not merged.

Gotchas

  • An admin cannot link a person. The person completes SSO and confirms GitHub. An admin can Unlink, which removes mapped access and leaves access granted by hand.
  • A group rename carries the mapping. Deleting a group recomputes its former members' access.
  • The Provisioning page has setup steps for Okta and Microsoft Entra ID only, not Google Workspace.

Next: Single sign-on and offboarding.

Related guides