GitHub

When you connect a GitHub organization to Oblique, Oblique will automatically sync the organization, its members, its repositories, and its teams.

As you make changes in GitHub, these changes are automatically synced to Oblique. If connected in read-write mode, Oblique can also change organization, repository, and team membership.

You can add multiple GitHub organizations to Oblique. Each is a separate integration, identified by its organization name.

Supported options

Oblique syncs the following from your GitHub organization. In read-write mode, Oblique can also change organization, repository, and team membership.

GitHub object	Oblique object	Capability
Members	Accounts	Read-only
Outside collaborators	Accounts	Read-only
Organization	Resources	Read-only
Repositories	Resources	Read-only
Teams	Resources	Read-only
Roles	Roles	Read-only
Organization membership	Entitlements	Read-write
Repository access for accounts	Entitlements	Read-write
Repository access for teams	Entitlements	Read-only
Team membership	Entitlements	Read-write
Team nesting	Entitlements	Read-only

Accounts

Oblique syncs each member of the GitHub organization as an Oblique account. Outside collaborators, who have access to some of your organization’s repositories without being members of the organization, are included.

GitHub accounts are matched to Oblique users by their SAML identity or their email. Oblique only reads SAML identities if your organization has SAML single sign-on configured. A member whose SAML identity doesn’t match a user, or who has none, is matched by the email on their public GitHub profile instead, if there is one. Oblique can’t match members who have no SAML identity and no public email, or outside collaborators.

Account matching

Resources

Oblique syncs the following from GitHub as resources:

• The GitHub organization you connected
• Each repository the Oblique GitHub App has access to
• Each team in the organization

When you install the GitHub App, you choose whether it has access to all the organization’s repositories, or only the repositories you select.

Tip

Archived repositories are read-only in GitHub, so Oblique doesn’t sync them. Archiving a repository removes it from Oblique, and unarchiving it restores it.

Team nesting

In GitHub, where a team is nested under a parent team, Oblique represents this as the child team having an entitlement to the parent team. In Oblique, you can see the access that members of the child team have through the parent team.

Roles

Oblique syncs the following roles, as defined in GitHub, as Oblique roles:

• Organization roles
• Repository roles
• Team roles

Required permissions

The Oblique GitHub App requests the following permissions for your GitHub organization:

• Read and write access to organization members
• Read access to organization administration
• Read access to custom organization roles
• Read access to repository metadata
• Read and write access to repository administration

Since the app requests write access, GitHub doesn’t let you install it with only read access, so the app always has these permissions. If you connect a read-only integration, Oblique respects that setting and only reads from GitHub.

Add GitHub integration

You must be an admin to add an integration.

If you aren’t a GitHub organization owner or GitHub App manager, create an install link and send it to someone who is. An install link lets someone who isn’t an Oblique admin connect an integration. They then become an owner of the integration.

Oblique connects to GitHub through the Oblique GitHub App. You must be an organization owner or GitHub App manager to install the GitHub App for your organization.

Oblique supports GitHub Apps based on your tenant’s region: US and EU.

To add a GitHub integration, navigate to the Integrations page:

1. Select Add integration.
2. Select GitHub.
3. Under Connect, select Read-write to let Oblique manage access in GitHub, or Read-only to only let Oblique read it. By default, this is read-write.
4. Select Connect GitHub. This opens GitHub in a new window.
5. Select the organization for which you wish to install the GitHub App.
6. Confirm the organization is the one you want to sync, and review the permissions Oblique requests.
7. Under Repository access, select All repositories to sync every repository in the organization, or Only select repositories to choose which repositories to sync.
8. Select Install & Authorize.
9. If GitHub asks you to Confirm access, reauthenticate to GitHub with your passkey, security key, or authenticator app.

You will be returned to the integration detail page, and Oblique will immediately start syncing the organization’s members, repositories, and teams.

Note

If you don’t have sufficient permissions to install the app in your GitHub organization, GitHub will send a request to your organization owner.

Change which repositories are synced

You can’t change which repositories the GitHub App has access to from Oblique. Instead, change them in GitHub, and Oblique will sync the change automatically.

To change the repositories the GitHub App has access to, in GitHub, navigate to your organization’s Settings > Third-party Access > GitHub Apps:

1. Next to the Oblique GitHub App, select Configure.
2. Under Repository access, select All repositories, or select Only select repositories and choose which repositories to sync.
3. Select Save.

On its next sync, Oblique adds resources for repositories the app gained access to, and removes resources for repositories it lost access to.

Change GitHub integration’s authorizations

You must be an admin to change an integration’s authorizations.

To give a read-only integration write access, from the integration’s detail page:

1. Navigate to the Settings tab.
2. Under Permissions, select Upgrade to read-write.

A read-write integration can’t be changed back to read-only. Instead, remove the integration and add it again.

Manage entitlements

In read-write mode, the GitHub integration lets Oblique manage access in your GitHub organization. Oblique does this by updating organization, repository, and team membership in GitHub. An entitlement for an Oblique group or team to a GitHub organization, repository, or team is flattened and written in GitHub as an individual entitlement for each member’s account.

Grant access

Manage GitHub organization membership

Oblique can change a member’s organization role.

Oblique can’t currently invite someone to your organization, remove a member from it, or grant a custom organization role. Make these changes in GitHub directly, and Oblique will automatically sync them.

Manage GitHub repository access

Oblique can grant a user or account access to a repository, change their repository role, and withdraw their access.

Oblique can’t change the access a team has to a repository.

Manage GitHub team membership

Oblique can add a user or account to a team, change their team role, and remove them from the team.

Oblique can’t change which teams are nested under a team.

Note

GitHub doesn’t allow changes to the membership of a team that is synchronized with an identity provider, so Oblique can’t manage it.

Remove GitHub integration

You must be an admin to remove an integration.

To remove a GitHub integration, from the integration’s detail page:

1. Navigate to the Settings tab.
2. At the bottom of the page, under Delete integration, select Delete integration….
3. In the confirmation dialog, type the text to confirm, then select Delete integration.

This will immediately stop all syncing and remove all resources from the integration. Access that Oblique granted in GitHub isn’t changed when the integration is removed. Oblique also automatically uninstalls the Oblique GitHub App from your organization.