/
Penn GitLab integration

Penn GitLab integration

Jul 01, 2026

Overview

Penn GitLab is deprovisioned by Grouper.

Originally we explored using SCIM but it was not sufficient for various reasons.  The APIs have access to do more things and what we needed to do could not be done by SCIM at the time (details not known).

If a user does not use GitLab for a while, they will be a delicensed user. 

Get access to GitLab

There are two types of users who need new access to GitLab

  1. New user: is a user who has never been in Penn GitLab or a user who was deprovisioned due to eligibility (e.g. left ISC or Penn), and then returned.

  2. Delicensed user: is a user who had a license and lost their license due to inactivity.  If they do not use GitLab for 60 days they will lose your license.  Privileges will be stored so they can be restored when they return.

Instructions:

  1. (New user): You need a https://gitlab.com account.  You can use an existing one or use a new one.  Note your email address in your account.

  2. (All users): Penn GitLab users must be eligible.  You must be in the IT department or explicitly allowed in Grouper by a GitLab admin.  If you are in the gitlabEligibilityGroup, you will be able to see it

  3. (All users): Go to the GitLab license app (custom template) and claim a license


     

  4. (All users): Go to https://gitlab.com (not the Penn url), and sign in with your gitlab username and password.

  5. (All users): Wait a minute, and go to https://gitlab.com/tenant-name, sign in with SAML.  If it says page not found, try signing out of GitLab and signing back in, and going to that URL.


     

    1. (Delicensed user): Usually you do not need to do this, but if you have a problem, you can go to gitlab, preferences, account, "Disconnect SAML for tenant-name", then link it again by logging in: https://gitlab.com/tenant-name.  Note, if you do this, you need to wait 10 minutes before re-linking.


       

  6. (New user): Let a privileged ISC GitLab user grant privileges to your GitLab email address

  7. (Delicensed user): Go to GitLab license app (custom template) and populate privileges.  This will copy our privileges back that were lost when you were delicensed.


     

  8. (Delicensed user): If you have OpenShift roles which are not restored in the above step, an OpenShift admin needs to "refresh those roles" for the user so they get assigned in GitLab

 

 
 

Description

The rest of this document describes the technical details of how self-claimed licenses work in PennGroups.

 

  1. The PennGroups loader pulls authorizations from GitLab

  2. Syncs the data to the PennGroups database

  3. The PennGroups deprovisioner determines which authorizations are invalid

  4. Removes authorizations from GitLab

 
 

Groups

Group name

Description

penn:isc:ait:apps:gitlab:service:ref:gitlabEligibilityGroup

People must be in this group to be able
to be in ISC GitLab.  Include all ISC people, and 
others who are explicitly put in this group.  
The eligibility criteria for this group is: memberOfPenn, 
the user should work at Penn or a related organization.

penn:isc:ait:apps:gitlab:service:policy:iscGitlabFrontDoor

Can log in to GitLab with Penn SSO.  If not in this group,
will redirect to the error page.  Consists of eligible and
recent users to GitLab, or the user could add themselves
to the "claimed license" group

penn:isc:ait:apps:gitlab:service:policy:iscGitlabRecentAndEligibleUsers

Has used GitLab in the last 60 days (iscGitlabUsersRecentSamlOrActivity), 
and is eligible for GitLab (gitlabEligibilityGroup)

penn:isc:ait:apps:gitlab:service:policy:iscGitlabClaimedAndEligibleUsers

People who have claimed a license 
and are eligible for GitLab.  Any membership
added to this group will get a default disabled
date 7 days in the future (since they are GitLab
users by then).

penn:isc:ait:apps:gitlab:service:policy:iscGitlabUsersRecentSamlOrActivity

Has authenticated through SSO or has used
GitLab recently

penn:isc:ait:apps:gitlab:service:policy:iscGitlabSamlLast60days

Loaded group (configured via recent WebLogin provisioner)
of users who have authenticated to this entity ID in last 60 days:
https://gitlab.com/groups/tenant-name

penn:isc:ait:apps:gitlab:service:policy:iscGitlabUsersRecentSigninOrActivity

Loaded group from the user table loaded from GitLab.
Consists of matched users who have logged in or
have activity in GitLab in last 60 days

penn:isc:ait:apps:gitlab:service:policy:iscGitlabUsersWithPrivileges

Loaded group from the user table loaded from GitLab.
Consists of matched users who have some role in some
group or folder in GitLab.

penn:isc:ait:apps:gitlab:service:policy:iscGitlabUsersNotRelinked

Users who have lost their license due to inactivity

penn:isc:ait:apps:gitlab:service:policy:iscGitlabUsers

Users in GitLab

penn:isc:ait:apps:gitlab:service:policy:iscGitlabUserClaimLicense

Users in this group have claimed a license so they can get through the front door

penn:community:employeeOrContractorIncludingUphsInTwoStep

Workforce in Two-Step.  Front door reference group for this service.