Integrating SailPoint with GitLab
Use the GitLab source to manage identity and access in the GitLab application. The GitLab source connects to the GitLab application securely to load data from and provision changes.
This document is designed to give specific information about the requirements and fields needed to successfully configure an instance of the GitLab source.
The connector supports both GitLab.com and self-managed GitLab instances, including Dedicated deployments on customer domains.
Note
The GitLab connector is read-only. It aggregates and reports. It does not create, update, disable or delete anything in GitLab, and it does not manage entitlement assignments. Provisioning is not supported.
Note
To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.
Supported Features
The GitLab connector supports the following features:
Account Management
- Account aggregation of GitLab users
- Membership of groups and projects, with the role held on each, reported as account attributes
Entitlement Management
- Aggregation of GitLab groups as entitlements
- Aggregation of GitLab projects as entitlements
Non-Human Identity Discovery
- Aggregation of non-human identities: project, group and personal access tokens, group and project service accounts, and security policy bots
- Derived risk indicators on every token, covering expiry, idleness, rotation age and excessive scope or role
For more information, refer to Machine Identity Security.
Refer to Discovering Potential Non-Human Accounts for more information.
Prerequisites
- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
The GitLab source authenticates with either a personal access token or a group access token. Both tokens are sent in the same request header, so one field holds the type you declare is verified against the token before every operation, and a mismatch is refused.
Token Scope
The token requires the read_api scope. The connector never writes, so no write scope is needed.
Choosing a Token Type
| Personal access token | Group access token | |
|---|---|---|
| Reach | Every group and project its owner belongs to | The single group it was issued on, and everything beneath it |
| Target groups | Required on GitLab.com, optional on self-managed | Not used, and rejected if configured |
| Best for | Governing several unrelated groups with one source | Confining a source to one group tree |
On GitLab.com a personal access token reaches every group its owner belongs to, and those groups may belong to different organizations. Target groups are therefore mandatory for that combination, so that aggregation cannot pull another organization's users into your tenant. A self-managed instance holds one organization, so the list is optional there.
Note
A project access token is not supported as a source credential and is refused.
Roles the Token Needs
What the token can see determines what the source reports. A missing role does not fail the aggregation. GitLab refuses that one listing, and the source skips it. An under-privileged token yields a partial result rather than an error.
| To aggregate | The token needs |
|---|---|
| Users, groups and projects in a group tree | At least Reporter on the groups concerned |
| A group's access tokens and its service accounts | Owner on that group |
| A project's access tokens | Maintainer or Owner on that project |
| Instance administrator, self-managed only | Instance administrator, self-managed only |
| Every personal access token on the instance | Instance administrator, self-managed only |
GitLab Tier
Service accounts and the group credentials inventory are GitLab Premium and Ultimate features. On Free, those datasets return no rows. Accounts, entitlements and access tokens are unaffected.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.