Feature
Access provisioning
Bind a directory group to a team, repo, project or group path, and a reconciler turns membership into grants on GitHub, Azure DevOps or GitLab.
An access binding says that members of a directory group get a role on an external target of an access target. A pull reconciler computes the desired set, compares it with the platform and records each access change.
A new or changed binding produces only previews until an admin confirms it. Enforcement is per target: report_only changes nothing, additive (the default) applies grants only, and full also applies revokes. A protected principal is never revoked.
Members without an external identity for the platform are reported as unmapped users; admins import external identities from CSV. Departed users and Zitadel denials are screened out of the desired set.
More features
All features →- 01
Directory lookups
The LDAP Sync Cache contract: find a directory user by any of five identifiers, search, list, and get groups with nested groups expanded.
- 02
SSH keys lookup
Fetch the public SSH keys of one directory user, or of every member of a directory group, by name.
- 03
Directory sync
Sync sources feed the directory. Each sync run upserts users and groups and keeps users who left as inactive tombstones.