Skip to content

User Access Management#

Gaining access to GitHub.com is managed by the GitHub Org Owners for each CESI unit. Teams can request to onboard by submitting the GHEC: Onboard a New Team request; a list of group owners is required as a part of the onboarding process. GitHub Org Owners will have access to Grouper to manage both GitHub Org Owners and GitHub Org Members.

User Accounts#

Accounts for GitHub Enterprise Cloud (GHEC) are github.com accounts. Whichever github.com account you use must be tied to your internetid@umn.edu email account. It is recommended to use your University account for the enterprise separately to keep personal and professional projects separated. However, any GitHub account may be used as long as your UofM email is added to your profile settings. There are no superuser accounts for GitHub.com.

Accounts are invited to the University of Minnesota GitHub.com Enterprise organizations, generally organized by ITAC/CESI groups. Access to GHEC is controlled by Grouper under OIT Identity and Access Management (IAM)'s main "app" stem. If your unit already has a group in Grouper they'd like to leverage for GitHub Enterprise Cloud, feel free to communicate this to Devex so we can enable your group to manage its users easier.

Roles and Privileges#

A user can belong to multiple organizations in the Enterprise just as they can belong to multiple ITAC units. GitHub Enterprise Cloud is structured with three levels of privilege:

Organization Members#

  • Organization Members have...
    • Access to repositories in the organization(s) they are added to according to the permission sets configured by organization owners
    • University of Minnesota accounts
      • Organization owners can add new org members by adding them to the proper group in Grouper (see Adding Users below) or submit a request in TeamDynamics.
      • In order to be a full member, the user must already exist in Entra ID (Azure AD)

Organization Owners#

Organization Owners are members with permissions to manage the organization's settings and add or remove members of the organization.

  • Organization Owners will...
    • Manage memberships of org admins, members, teams
    • Maintain their teams or delegation of team maintenance
    • Manage repos, including appropriate visibility (private/public)
    • Initiate request process for outside collaborators
    • Be initial contact for user support in Org
    • Manage Org Settings/policies where defined as owned by the organization (not overridden by Enterprise)

Teams#

Every organization in GitHub Enterprise Cloud corresponds with a CESI/ITAC department, and that does not always correspond with how groups are organized. Organize your groups in a way that allows you to customize repository access and messaging in GitHub using teams.

Simplify team management with Azure Entra ID groups#

You can create teams by synchronizing Entra ID to your organization. In order to do this you will need a Grouper group that syncs to Azure Entra ID.

Work with IAM to create a Grouper group and place it in the GHEC membership group#
  • Submit the Grouper Service request form to get started
  • In the Additional Information field at the bottom, include a request to add this group to the GitHub Members group for your CESI/ITAC unit
    • The GHEC Members group path will look like this, where both instances of CESI are replaced by your unit's CESI shortname: app:itac:ref:CESI:github:ad_hoc_umn_CESI_github_members
    • The CESI shortname should match the unit found in your GitHub Enterprise Cloud Organization name
    • If this step doesn't happen, feel free to email devex@umn.edu and we'll work with IAM to add the group
Configure your teams to sync to Entra ID group#

NOTE: This is easiest to configure when member base privileges are more restricted, so permissions are controlled per repository. Ensure the Member Privileges dropdown in your Organization Settings is set to No permissions or Read. Org Owners will be responsible for creating new repos and assigning teams access.

  1. Navigate to the New Team creation page (Organization Home > Teams > New Team).
  2. Fill in each field for the team you are creating.
  3. Under Identity Provider Groups, search for the Entra ID group name and select it.

Outside Collaborators#

Anyone added to a repository directly will be added as an "outside collaborator". These users consume Enterprise licenses on github.com but do not have the ability to navigate outside of the permissions set they are allocated to the repository in which they are added. They cannot view other repositories in the Enterprise unless they have been added to them.

  • Outside Collaborators can...

GitHub Apps for Cross-Repository Access#

If you need to access multiple repositories across multiple organizations (for example, to automate workflows or synchronize data), we recommend using a GitHub App rather than personal access tokens or service accounts.

GitHub Apps provide: - Fine-grained access controls - Better audit trails - Scoped permissions to specific repositories and organizations - Authentication that doesn't depend on individual user accounts

See the GitHub Apps documentation for more information on creating and using GitHub Apps.

Adding Users#

  1. Login to Grouper

  2. Navigate to the ref stem (Root>app>IT Access Catalog>ref), locate your CESI unit, then to GitHub Cloud.

  3. Open either the adhoc - umn-[unit] GitHub Org Members or adhoc - umn-[unit] GitHub Org Owners groups. It is up to each team to determine who will be owners versus members for their team.

  4. To add a member, click the orange +Add Members button in the upper right corner, enter their username and click the orange Add button. No start or end date is required unless your team requires it. Attestation of group members will be required every 180 days.

a. To add multiple members at the same time, click on the import a list of members link.

Removing Users#

Users need to be removed from organizations and access revoked when they leave the University.

Organization Owners are responsible for making sure membership is current and will receive emails once a year to remind them to review it.

Outside collaborators will only lose access to the repositories they are added to when an Owner removes them. It is important that Org Owners limit and track who they have added to repositories as outside collaborators.

Once deprovisioned, UMN account users will no longer have access to non-public repositories they did, unless they retain access as an "Outside Collaborator".

  1. Login to Grouper

  2. Navigate to the ref stem (Root>app>IT Access Catalog>ref), locate your CESI unit, then to GitHub Cloud.

  3. Open either the adhoc - umn-[unit] GitHub Org Members or adhoc - umn-[unit] GitHub Org Owners groups.

  4. To remove members, check the checkbox next to the member's name and click Remove selected members

Default CESI Namespace#

This structure represents the groups associated with a standard CESI unit.

Text Only
app
└── IT Access Catalog
  └── ref
    └── [Unit Short ID]
      └── GitHub Cloud
        └── adhoc - umn-[unit] GitHub Org Members
        └── adhoc - umn-[unit] GitHub Org Owners
  • GitHub Org Owners adhoc - umn-[unit] GitHub Org Owners - These individuals have access to manage the Owners and Members groups in grouper. They are responsible for bi-annual attestation within Grouper and to remove team members who should no longer have access.
  • GitHub Org Members adhoc - umn-[unit] GitHub Org Members - These individuals do not have access to update grouper groups but have access to github.com.