FEATURES / ENTERPRISE SSO

SCIM 2.0 provisioning and a real org graph — tested, not hand-waved

Enterprise identity that's actually implemented. Gitrevio ships an RFC 7644-compliant SCIM 2.0 provider (Users + Groups CRUD), IdP-group → role mapping, an org_unit closure-table graph with SCD-2 membership history, quarterly access-review CSV export, and a server-side separation-of-duties workflow. SAML SP support is in progress.

Provisioning IdPs

Each IdP carries a documented setup guide for the SCIM 2.0 provisioning path and an IdP-group → role mapping configuration. SAML SP login is in progress — reach out if it's on your critical path.

Okta
SCIM 2.0 provisioning + group → role mapping. SAML SP in progress.
Azure AD
SCIM 2.0 provisioning + group → role mapping. SAML SP in progress.
Ping Identity
SCIM 2.0 provisioning + group → role mapping. SAML SP in progress.
OneLogin
SCIM 2.0 provisioning + group → role mapping. SAML SP in progress.

SCIM 2.0 — Users + Groups

RFC 7644-compliant Users and Groups endpoints. User records are provisioned by your IdP's SCIM sync; IdP-group → Gitrevio-role mapping configurable per customer.

Provisioning creates the user record on the SCIM POST from your IdP. Default role from the IdP-group mapping; no out-of-band invitation flow.

Deprovisioning is a SCIM DELETE — the user is deactivated and the action is written to the audit log.

Group → role mapping supports many-to-one and one-to-many. Conflicts are logged and resolved by an explicit precedence table.

# SCIM Users POST
POST /scim/v2/Users
{
"userName": "alice@acme.io",
"name": {"givenName": "Alice"},
"emails": [{"value": "..."}],
"groups": [{"value": "eng-leads"}],
"active": true
}
→ 201 Created
→ role: engineering_manager
→ org_unit: engineering / platform

Org graph: closure-table + SCD-2

org_unit lives in a closure-table schema — every ancestor/descendant pair materialised so the rollup queries are O(rows) instead of recursive CTEs. team_membership is SCD-2 so historical reports are reproducible.

org_unit + closure-table
Hierarchical org schema with materialised ancestor/descendant pairs. Rollups in a single join.
team_membership_history (SCD-2)
Effective_from / effective_to per membership row. Historical reports reproduce exactly even after re-orgs.
org_drift_detector
Flags discrepancies between the IdP-provided org graph and the activity-inferred graph.
org_rollup_scorecard
Aggregated metric scorecard per org_unit at any depth.
Quarterly access review export
CSV export of all role + group memberships, suitable for SOC 2 / ISO 27001 evidence.
Separation-of-duties workflow
Sensitive operations (skill install, role grant, key rotation) require a second approver. Enforced server-side.
Canonical identity resolution
One person, one canonical contributor — resolved across GitHub, GitLab, and Jira aliases via the id_mapping bridge with confidence scoring. Analytics and access reviews key on the real human, not scattered vendor logins.

Ready to See Your Engineering work clearly?

Get Onboarded