GitHub

Overview

The Veza integration for GitHub enables automated user lifecycle management, with support for user provisioning, team membership management, and account deprovisioning.

This document includes steps to enable the GitHub integration for use in Lifecycle Management, along with supported actions and notes. See Supported Actions for more details.

Enabling Lifecycle Management for GitHub

Prerequisites

1. You will need administrative access in Veza to configure the integration and site administrator privileges in GitHub Enterprise Server.

2. Ensure you have an existing GitHub integration in Veza or add a new one for use with Lifecycle Management.

3. Verify your GitHub integration has completed at least one successful extraction

4. The GitHub integration will need the additional required GitHub App permissions:

   • Organization permissions - Members (Write) - Required for managing organization memberships

   • Organization permissions - Administration (Write) - Required for administrative operations

   • Repository permissions - Administration (Write) - Required for managing team memberships

Important: GitHub LCM operations use Admin API endpoints that require site administrator privileges. These operations are typically available in GitHub Enterprise Server environments, not GitHub.com.

Configuration Steps

To enable the integration:

1. In Veza, go to the Integrations overview

2. Search for or create a GitHub integration

3. Check the box to Enable usage for Lifecycle Management

Configure the extraction schedule to ensure your GitHub data remains current:

1. Go to Veza Administration > System Settings

2. In Pipeline > Extraction Interval, set your preferred interval

3. Optionally, set a custom override for GitHub in the Active Overrides section

To verify the health of the Lifecycle Management data source:

1. Use the main Veza navigation menu to open the Lifecycle Management > Integrations page or the Veza Integrations overview

2. Search for the integration and click the name to view details

3. In the Properties panel, click the magnifying glass icon under Lifecycle Management Enabled

Supported Actions

GitHub can be a target for identity management actions, based on changes in another external source of truth or as part of a workflow.

The integration supports the following lifecycle management Actions:

Sync Identities

Primary action for user management (creating or updating users):

• User login cannot be changed after creation

• GitHub usernames must be unique and follow GitHub naming rules (39 characters max, alphanumeric plus hyphens)

• Email addresses must be unique across the GitHub instance

• Requires site administrator privileges for user creation operations

The following attributes can be synchronized:

Manage Relationships

Both adding and removing memberships are supported. Organization and team memberships are automatically removed during deprovisioning.

• Add and remove organization memberships with member role

• Add and remove team memberships with member role

• Synchronize access assignments based on external identity changes

• Track membership changes for audit purposes

Deprovision Identity

When a user is deprovisioned:

• User account is suspended in GitHub Enterprise Server

• All organization and team memberships are removed automatically

• Commit history and attribution are preserved for audit and compliance

• Account can be reactivated if needed (unsuspended)

• User receives appropriate error messages when attempting to access GitHub

Workflow Examples

New Employee Onboarding

Create GitHub accounts and assign appropriate access for new developers:

1. Identity Sync: Create user account with basic profile information

2. Organization Access: Add user to primary GitHub organization

3. Team Assignment: Assign to development teams based on department

4. Profile Setup: Configure public email and display name

Role Change Management

Update GitHub access when employees change departments or roles:

1. Relationship Updates: Remove existing team memberships

2. New Access: Add memberships for new role requirements

3. Audit Trail: Track all membership changes for compliance

Employee Offboarding

Securely remove access while preserving development history:

1. Account Suspension: Suspend GitHub account to prevent access

2. Membership Removal: Remove all organization and team memberships

3. History Preservation: Maintain commit attribution and repository history

4. Compliance: Generate audit trail of all access removal actions