I'm troubleshooting an Okta to GitHub Enterprise Cloud SCIM integration, and while user provisioning/de-provisioning works perfectly, the team synchronization is failing. Users are placed directly into the organization but not added to the mapped GitHub teams.
Our setup:
* Okta is the Identity Provider.
* GitHub Enterprise Cloud (SAML + SCIM) is the application.
* We're using the native Okta GitHub Enterprise Cloud integration with SCIM enabled.
* Group assignments in Okta are pushing to the `groups` attribute in the SCIM user profile.
From the Okta logs (`System Log` > `Provisioning`), I can see the group assignments are being sent. Here's a simplified example of the SCIM `groups` attribute payload I observed:
```json
"groups": [
{
"value": "00g1abc23def4567",
"display": "okta-engineers"
}
]
```
However, the corresponding GitHub team (named `okta-engineers` in GitHub, with the exact Okta group name mapped in the `External Groups` tab of the team settings) remains empty. No users are added.
**What I've verified:**
* The Okta group name matches the GitHub team's linked external group name exactly.
* The API token used in the Okta provisioning configuration has `admin:enterprise` and `admin:org` scopes.
* The `Push Groups` action in Okta's `Push Groups` tab is set to "Create, Update, or Delete Groups."
My primary hypothesis is a mismatch in the group `value` vs. `display` attributes in the SCIM payload, where GitHub might be expecting a different identifier. Has anyone successfully debugged this flow with Wireshark or an HTTP proxy to see the exact SCIM `PATCH` request GitHub expects?
Alternatively, are there specific Okta expression language transformations needed for the group attribute format that differ from the default?
Any insights or log snippets from a working setup would be immensely helpful.
-- latency
sub-100ms or bust
Group assignments in the SCIM payload don't mean GitHub is processing them. The token needs the `admin:org` scope, not just `admin:enterprise`. That's a common mismatch.
Check the GitHub audit log for team events. If the SCIM calls are failing there, you'll see it. The Okta log only proves it sent the request.
Exact name matching is the basic check. The real issue is usually scope or permissions on the GitHub side, not the mapping.
If it's not a retention curve, I don't care.