This Python script helps detect drifts in SCIM provisioning within a GitHub organization by comparing organization members against SCIM-provisioned identities.

This script can only be used in enterprise organizations where Single Sign-On (SSO) and SCIM are enabled.

The script uses a GitHub App to authenticate against both GitHub REST and GraphQL APIs. It:

1. Retrieves all organization members and their verified emails via GraphQL
2. Gets all SCIM-provisioned identities via REST API
3. Compares both lists to identify any discrepancies

To mitigate identity drifts between your Identity Provider (IdP) and GitHub that can lead to security issues and access management problems.

This script helps you:

• Identify users without SCIM provisioning
• Find users without verified organization emails
• Maintain alignment between your IdP and GitHub user base

1. Create a GitHub App in your organization with these permissions:
   • Organization permissions:
     • members: read-only
     • administration: read-only
2. Generate a private key for the GitHub App
3. Install the GitHub App in your organization
4. Note down:
   • App ID
   • Installation ID
   • Private key (base64 encoded or as a file)

• GH_ORG: GitHub organization name
• GH_APP_ID: GitHub App ID
• GH_INSTALL_ID: GitHub App Installation ID
• Either:
  • GH_PEM_KEY: private key as plain text or base64 encoded
  • GH_PEM_KEY_PATH: Path to private key file

• -o, --out-format: Output format (table or txt). Default: table
• --no-color: Disable colored output

python compare-org-scim-users.py [-o {table,txt}] [--no-color]]

- name: Compare SCIM Identities
        uses: tentwentyone/github-org-members-verify-scim-identities@v1.0.2
        with:
          # GitHub App credentials
          gh_app_id: ${{ secrets.GH_APP_ORG_READ_ID }}
          gh_pem_key: ${{ secrets.GH_APP_ORG_READ_PEM_KEY }}
          gh_install_id: ${{ secrets.GH_APP_ORG_READ_INSTALL_ID }}

The script generates a report showing:

• Users without SCIM IDs
• Users without verified organization emails

When run in a GitHub Action, results are added to the workflow summary.

Output when drifts or unverified emails are detected:

Output when no drifts / unverified emails are detected:

We welcome contributions! Please check our contribution guidelines for details.

Please see our guidelines for details on our security policy and reporting security vulnerabilities.

This project is released under the MIT License.