Set up a GitHub Enterprise Cloud connector

C1 provides identity governance and just-in-time provisioning for GitHub Enterprise Cloud. Integrate your GitHub Enterprise Cloud instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.

Capabilities

Resource	Sync	Provision
Enterprise
Organizations
Users
Teams
Repositories

Additional functionality: The GitHub Enterprise Cloud connector supports account provisioning by inviting new users to a configured default organization.

Gather GitHub Enterprise Cloud credentials

Use a GitHub App, not a personal access token. The app must be installed on the enterprise and on each organization and repository set that C1 will sync or manage. Enterprise installation alone does not grant organization or repository API access.

1. Copy the GitHub Enterprise Cloud enterprise slug.

2. Create or select a GitHub App that is installed on the enterprise.

3. Grant the enterprise installation read access for enterprise members and organizations. If C1 should discover organization installations, also grant read access for enterprise organization installations.

4. Install the same GitHub App on each organization that C1 should sync. Grant Members read access for sync, or Members write access if C1 should invite users or manage organization and team membership.

5. Grant repository Metadata read access and Administration read access for repository access sync. Use Administration write access if C1 should manage repository collaborators or team repository access.

6. Copy the GitHub App ID.

7. Download the GitHub App private key.

8. Copy the enterprise installation ID for the GitHub App.

9. If you plan to invite new users through C1, choose the default organization that should receive account invitations.

Configuration fields

Field	Required	Description
enterprise-slug	Yes	The slug of the GitHub Enterprise Cloud enterprise.
app-id	Yes	The App ID of the GitHub App.
app-privatekey-path	Yes	The GitHub App private key file.
installation-id	Yes	The GitHub App installation ID on the enterprise.
default-org	No	The organization used for new-user invitations. Required for account provisioning.
instance-url	No	GitHub API base URL override. Leave blank for https://api.github.com.

Synced resource types

• Enterprise: the configured enterprise, with member and owner grants.
• Organizations: organizations in the enterprise, with member and admin grants.
• Users: organization members discovered across synced organizations.
• Teams: organization teams, with member and maintainer grants.
• Repositories: organization repositories, with pull, triage, push, maintain, and admin grants for users and teams.

Special notes

• Team maintainers are also emitted as team members.
• Repository team grants are expandable through the corresponding team member and maintainer entitlements.
• Organization provisioning currently supports revocation. Revoking an organization member removes that user from the organization; revoking an organization admin demotes the user to member.
• Account provisioning requires default-org or an organization value in the account profile so GitHub has an organization to receive the invitation.

Configure the GitHub Enterprise Cloud connector

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for GitHub Enterprise Cloud and click Add.

3. Choose how to set up the new GitHub Enterprise Cloud connector.

4. Set the owner for this connector.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Paste the GitHub Enterprise Cloud credentials into the relevant fields:

   • Enterprise slug: The GitHub enterprise slug.
   • GitHub App ID: The GitHub App ID.
   • GitHub App private key: The private key file for the GitHub App.
   • GitHub App installation ID: The enterprise installation ID.
   • Default organization: Optional organization used for account provisioning.
   • GitHub base URL: Optional API URL override.
8. Click Save.

9. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your GitHub Enterprise Cloud connector is now pulling access data into C1.

Self-hosted

Follow these instructions to run the GitHub Enterprise Cloud connector in your own environment.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for Baton and click Add.

3. Choose how to set up the new GitHub Enterprise Cloud connector, set the owner, and click Next.

4. In the Settings area, click Edit, then click Rotate to generate a new Client ID and Client Secret. Store these values securely for your deployment.

5. Configure C1 credentials and GitHub Enterprise Cloud settings as environment variables:

   BATON_CLIENT_ID=<C1 client ID>
   BATON_CLIENT_SECRET=<C1 client secret>
   BATON_HOST_ID=baton-github-enterprise-cloud
   BATON_ENTERPRISE_SLUG=<GitHub enterprise slug>
   BATON_APP_ID=<GitHub App ID>
   BATON_INSTALLATION_ID=<GitHub App enterprise installation ID>
   BATON_APP_PRIVATEKEY_PATH=/var/run/secrets/github-app-private-key.pem
   BATON_DEFAULT_ORG=<Optional default organization for account provisioning>
   BATON_INSTANCE_URL=<Optional GitHub API base URL>
   

   Mount the GitHub App private key at the path configured in BATON_APP_PRIVATEKEY_PATH.

6. Deploy the connector using the Public ECR image:

   public.ecr.aws/conductorone/baton-github-enterprise-cloud:<version>
   

   Use a version tag without the leading v, such as 0.0.3.

Done. Your GitHub Enterprise Cloud connector is now pulling access data into C1.