openhound-github 0.6.2__tar.gz → 0.6.4__tar.gz

{openhound_github-0.6.2 → openhound_github-0.6.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.6.2
+Version: 0.6.4
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md
@@ -53,7 +53,7 @@ identifier must be supplied together with `key_path` and `enterprise_name`.
 
 ### Enterprise SCIM and hybrid correlations
 
-When `SOURCES__GITHUB__COLLECT_ENTERPRISE_SCIM=true`, a token with enterprise SCIM access is used to collect both `/scim/v2/enterprises/{enterprise}/Users` and `/scim/v2/enterprises/{enterprise}/Groups`. The collector emits normalized `SCIM_Organization`, `SCIM_User`, and `SCIM_Group` nodes plus `SCIM_Contains`, `SCIM_MemberOf`, and `SCIM_Provisioned` relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.
+A token with enterprise SCIM access is used to collect both `/scim/v2/enterprises/{enterprise}/Users` and `/scim/v2/enterprises/{enterprise}/Groups`. The collector emits normalized `SCIM_Organization`, `SCIM_User`, and `SCIM_Group` nodes plus `SCIM_Contains`, `SCIM_MemberOf`, and `SCIM_Provisioned` relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.
 
 `SOURCES__GITHUB__EMIT_LEGACY_SCIM_CORRELATIONS=true` temporarily reproduces GitHound-style Okta-to-SCIM correlation relationships. It defaults to false because a dedicated hybrid correlator should own IdP-to-SCIM matching; GitHub remains authoritative for GitHub's SCIM resources and target-system provisioning relationships.
 

{openhound_github-0.6.2 → openhound_github-0.6.4}/README.md

@@ -42,7 +42,7 @@ identifier must be supplied together with `key_path` and `enterprise_name`.
 
 ### Enterprise SCIM and hybrid correlations
 
-When `SOURCES__GITHUB__COLLECT_ENTERPRISE_SCIM=true`, a token with enterprise SCIM access is used to collect both `/scim/v2/enterprises/{enterprise}/Users` and `/scim/v2/enterprises/{enterprise}/Groups`. The collector emits normalized `SCIM_Organization`, `SCIM_User`, and `SCIM_Group` nodes plus `SCIM_Contains`, `SCIM_MemberOf`, and `SCIM_Provisioned` relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.
+A token with enterprise SCIM access is used to collect both `/scim/v2/enterprises/{enterprise}/Users` and `/scim/v2/enterprises/{enterprise}/Groups`. The collector emits normalized `SCIM_Organization`, `SCIM_User`, and `SCIM_Group` nodes plus `SCIM_Contains`, `SCIM_MemberOf`, and `SCIM_Provisioned` relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.
 
 `SOURCES__GITHUB__EMIT_LEGACY_SCIM_CORRELATIONS=true` temporarily reproduces GitHound-style Okta-to-SCIM correlation relationships. It defaults to false because a dedicated hybrid correlator should own IdP-to-SCIM matching; GitHub remains authoritative for GitHub's SCIM resources and target-system provisioning relationships.
 

{openhound_github-0.6.2 → openhound_github-0.6.4}/src/openhound_github/helpers.py

@@ -20,6 +20,19 @@ class GraphQLPaginationError(RuntimeError):
     pass
 
 
+def scim_skip_reason(exception: BaseException) -> str | None:
+    """Return a user-facing reason for expected SCIM API unavailability."""
+    if not isinstance(exception, requests.HTTPError) or exception.response is None:
+        return None
+
+    status_code = exception.response.status_code
+    if status_code in (401, 403):
+        return "the configured credentials do not have SCIM access"
+    if status_code == 404:
+        return "the GitHub scope does not expose SCIM endpoints"
+    return None
+
+
 class GraphQLCursorPaginator(JSONResponseCursorPaginator):
     def __init__(
         self,

{openhound_github-0.6.2 → openhound_github-0.6.4}/src/openhound_github/kinds/edges.py

@@ -39,7 +39,6 @@ RESTRICTIONS_CAN_PUSH = "GH_RestrictionsCanPush"
 HAS_EXTERNAL_IDENTITY = "GH_HasExternalIdentity"
 HAS_SAML_IDENTITY_PROVIDER = "GH_HasSamlIdentityProvider"
 MAPS_TO_USER = "GH_MapsToUser"
-SYNCED_TO_GH_USER = "GH_SyncedTo"
 
 # Normalized OpenGraph-SCIM edges
 SCIM_CONTAINS = "SCIM_Contains"

{openhound_github-0.6.2 → openhound_github-0.6.4}/src/openhound_github/kinds/nodes.py

@@ -81,6 +81,4 @@ SCIM_GROUP = "SCIM_Group"
 SCIM_ROLE = "SCIM_Role"
 
 # External node kinds used only as correlation endpoints
-AZ_USER = "AZUser"
 OKTA_USER = "Okta_User"
-PINGONE_USER = "PingOne_User"

{openhound_github-0.6.2 → openhound_github-0.6.4}/src/openhound_github/lookup.py

@@ -1,4 +1,5 @@
 import json
+import re
 from functools import lru_cache
 
 import duckdb
@@ -8,10 +9,20 @@ from openhound.core.lookup import LookupManager, logger
 from openhound_github.runner_ids import runner_group_node_id, runner_node_id
 
 
+_SCHEMA_IDENTIFIER_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+
+
+def _validate_schema_identifier(schema: str) -> str:
+    if not _SCHEMA_IDENTIFIER_RE.fullmatch(schema):
+        raise ValueError(f"Invalid DuckDB schema identifier: {schema!r}")
+    return schema
+
+
 class GithubLookup(LookupManager):
     def __init__(self, client: DuckDBPyConnection, schema: str = "github"):
-        super().__init__(client, schema)
-        self.schema = schema
+        validated_schema = _validate_schema_identifier(schema)
+        super().__init__(client, validated_schema)
+        self.schema = validated_schema
         self.client = client
 
     def _find_single_row(self, *args):
@@ -188,12 +199,21 @@ class GithubLookup(LookupManager):
         )
 
     @lru_cache
-    def projected_enterprise_team_exists(self, org_login: str, slug: str):
+    def projected_enterprise_team_id(self, org_login: str, slug: str) -> str | None:
         return self._find_single_object(
-            f"""SELECT slug FROM {self.schema}.projected_enterprise_teams WHERE org_login = ? AND slug = ?""",
+            f"""SELECT node_id FROM {self.schema}.projected_enterprise_teams WHERE org_login = ? AND slug = ?""",
             [org_login, slug],
         )
 
+    @lru_cache
+    def external_identity_id_for_guid(
+        self, guid: str, environment_slug: str
+    ) -> str | None:
+        return self._find_single_object(
+            f"""SELECT id FROM {self.schema}.external_identities WHERE guid = ? AND environment_slug = ?""",
+            [guid, environment_slug],
+        )
+
     @lru_cache
     def repository_node_ids(self):
         return self._find_all_objects(

{openhound_github-0.6.2 → openhound_github-0.6.4}/src/openhound_github/main.py

@@ -63,6 +63,7 @@ def preproc(ctx: PreProcContext):
         "teams": "teams",
         "team_members": "team_members",
         "saml_provider": "saml_provider",
+        "external_identities": "external_identities",
         "applications": "applications",
         "enterprise": "enterprise",
         "enterprise_organizations": "enterprise_organizations",

{openhound_github-0.6.2 → openhound_github-0.6.4}/src/openhound_github/models/__init__.py

@@ -53,7 +53,14 @@ from .saml_assertion_consumer_service import SamlAssertionConsumerService
 from .saml_provider import SamlProvider
 from .saml_service_provider import SamlServiceProvider
 from .saml_issuer import SamlIssuer
-from .scim_user import ScimGroup, ScimOrganization, ScimResource, ScimUser
+from .scim_user import (
+    EnterpriseScimOrganization,
+    EnterpriseScimUser,
+    ScimGroup,
+    ScimOrganization,
+    ScimResource,
+    ScimUser,
+)
 from .secret_scanning_alert import SecretScanningAlert
 from .team import Team
 from .team_member import TeamMember
@@ -117,6 +124,8 @@ __all__ = [
     "ScimUser",
     "ScimGroup",
     "ScimOrganization",
+    "EnterpriseScimUser",
+    "EnterpriseScimOrganization",
     "RepoRoleAssignment",
     "Environment",
     "EnvironmentSecret",

{openhound_github-0.6.2 → openhound_github-0.6.4}/src/openhound_github/models/enterprise_helpers.py

@@ -2,5 +2,9 @@ def enterprise_team_node_id(enterprise_id: str, team_id: str | int) -> str:
     return f"GH_EnterpriseTeam_{enterprise_id}_{team_id}"
 
 
+def projected_enterprise_team_node_id(org_id: str | None, team_node_id: str) -> str:
+    return f"GH_Team_{org_id}_{team_node_id}"
+
+
 def enterprise_role_node_id(enterprise_id: str, role_id: str | int) -> str:
     return f"GH_EnterpriseRole_{enterprise_id}_{role_id}"

{openhound_github-0.6.2 → openhound_github-0.6.4}/src/openhound_github/models/enterprise_team_organization.py

@@ -1,16 +1,17 @@
 from openhound.core.asset import BaseAsset, EdgeDef
 from openhound.core.models.entries_dataclass import (
-    ConditionalEdgePath,
     Edge,
     EdgePath,
     EdgeProperties,
-    PropertyMatch,
 )
 
 from openhound_github.kinds import edges as ek
 from openhound_github.kinds import nodes as nk
 from openhound_github.main import app
-from openhound_github.models.enterprise_helpers import enterprise_team_node_id
+from openhound_github.models.enterprise_helpers import (
+    enterprise_team_node_id,
+    projected_enterprise_team_node_id,
+)
 
 
 @app.asset(
@@ -59,18 +60,20 @@ class EnterpriseTeamOrganization(BaseAsset):
     @property
     def member_of_team_edges(self):
         org_login = self.login or self._lookup.org_login_for_id(self.node_id)
-        if org_login and self._lookup.projected_enterprise_team_exists(
-            org_login, self.projected_slug
-        ):
+        projected_team_id = (
+            self._lookup.projected_enterprise_team_id(org_login, self.projected_slug)
+            if org_login
+            else None
+        )
+        if projected_team_id:
             yield Edge(
                 kind=ek.MEMBER_OF,
                 start=EdgePath(value=self.enterprise_team_node_id, match_by="id"),
-                end=ConditionalEdgePath(
-                    kind=nk.TEAM,
-                    property_matchers=[
-                        PropertyMatch(key="environmentid", value=self.node_id),
-                        PropertyMatch(key="slug", value=self.projected_slug),
-                    ],
+                end=EdgePath(
+                    value=projected_enterprise_team_node_id(
+                        self.node_id, projected_team_id
+                    ),
+                    match_by="id",
                 ),
                 properties=EdgeProperties(traversable=True),
             )

{openhound_github-0.6.2 → openhound_github-0.6.4}/src/openhound_github/models/external_identity.py

@@ -2,14 +2,13 @@ from dataclasses import dataclass, field
 
 from openhound.core.asset import BaseAsset, EdgeDef, NodeDef
 from openhound.core.models.entries_dataclass import (
-    ConditionalEdgePath,
     Edge,
     EdgePath,
     EdgeProperties,
 )
 from pydantic import BaseModel, ConfigDict, Field
 
-from openhound_github.graph import GHEdgeProperties, GHNode, GHNodeProperties
+from openhound_github.graph import GHNode, GHNodeProperties
 from openhound_github.kinds import edges as ek
 from openhound_github.kinds import nodes as nk
 from openhound_github.main import app
@@ -18,9 +17,6 @@ from .saml_helpers import (
     DEFAULT_GITHUB_DEPLOYMENT_ID,
     ENTRA_OBJECT_ID_CLAIM,
     SAML_CONTRACT_VERSION,
-    detect_foreign_idp,
-    foreign_user_kind,
-    foreign_user_matchers,
     github_saml_service_provider_id,
     saml_account_match_values,
     saml_attribute_match_values,
@@ -113,13 +109,6 @@ class User(BaseModel):
             description="External identity maps to a user",
             traversable=False,
         ),
-        EdgeDef(
-            start=nk.EXTERNAL_IDENTITY,
-            end=nk.USER,
-            kind=ek.SYNCED_TO_GH_USER,
-            description="Foreign IdP user is synced to a GitHub user",
-            traversable=True,
-        ),
         EdgeDef(
             start=nk.SAML_SERVICE_PROVIDER,
             end=nk.USER,
@@ -150,12 +139,19 @@ class ExternalIdentity(BaseAsset):
 
     @property
     def as_node(self) -> GHNode:
+        display_name = (
+            self.saml_identity.username
+            if self.saml_identity and self.saml_identity.username
+            else self.scim_identity.username
+            if self.scim_identity and self.scim_identity.username
+            else self.guid or self.node_id
+        )
 
         return GHNode(
             kinds=[nk.EXTERNAL_IDENTITY],
             properties=GHExternalIdentityProperties(
-                name=self.guid or self.node_id,
-                displayname=self.guid or self.node_id,
+                name=display_name,
+                displayname=display_name,
                 node_id=self.node_id,
                 guid=self.guid,
                 saml_identity_username=self.saml_identity.username
@@ -209,66 +205,6 @@ class ExternalIdentity(BaseAsset):
             "environment_type": environment_type,
         }
 
-    @property
-    def _maps_to_user_edges(self):
-        foreign_idp_type, foreign_env_id = detect_foreign_idp(
-            issuer=self.idp["issuer"],
-            sso_url=self.idp["sso_url"],
-        )
-        foreign_kind = foreign_user_kind(foreign_idp_type)
-
-        foreign_username = None
-        if self.saml_identity and self.saml_identity.username:
-            foreign_username = self.saml_identity.username
-        elif self.scim_identity and self.scim_identity.username:
-            foreign_username = self.scim_identity.username
-
-        matchers = foreign_user_matchers(
-            foreign_kind,
-            foreign_env_id,
-            foreign_username,
-            self.saml_identity.attributes if self.saml_identity else [],
-        )
-        if foreign_kind and matchers:
-            yield Edge(
-                kind=ek.MAPS_TO_USER,
-                start=EdgePath(value=self.node_id, match_by="id"),
-                end=ConditionalEdgePath(
-                    kind=foreign_kind,
-                    property_matchers=matchers,
-                ),
-                properties=EdgeProperties(traversable=False),
-            )
-
-        # SyncedToGHUser: foreign IdP user → GitHub user (traversable, with composition)
-        if matchers and self.user and self.user.id:
-            composition_matchers = [
-                matcher for matcher in matchers if matcher.key in {"name", "objectid"}
-            ]
-            composition_predicates = " OR ".join(
-                f"n.{matcher.key} = '{matcher.value}'"
-                for matcher in composition_matchers
-            )
-            q = (
-                f"MATCH p=()<-[:GH_SyncedToEnvironment]-(:GH_SamlIdentityProvider)"
-                f"-[:GH_HasExternalIdentity]->(:GH_ExternalIdentity)"
-                f"-[:GH_MapsToUser]->(n) "
-                f"WHERE {composition_predicates} RETURN p"
-            )
-            yield Edge(
-                kind=ek.SYNCED_TO_GH_USER,
-                start=ConditionalEdgePath(
-                    kind=foreign_kind,
-                    property_matchers=matchers,
-                ),
-                end=EdgePath(value=self.user.id, match_by="id"),
-                properties=GHEdgeProperties(
-                    traversable=True,
-                    composed=True,
-                    query_composition=q,
-                ),
-            )
-
     @property
     def service_provider_node_id(self) -> str | None:
         return github_saml_service_provider_id(
@@ -363,5 +299,3 @@ class ExternalIdentity(BaseAsset):
                 end=EdgePath(value=self.user.id, match_by="id"),
                 properties=EdgeProperties(traversable=False),
             )
-
-        yield from self._maps_to_user_edges

{openhound_github-0.6.2 → openhound_github-0.6.4}/src/openhound_github/models/projected_enterprise_team.py

@@ -7,6 +7,7 @@ from pydantic import ConfigDict, Field
 from openhound_github.graph import GHNode
 from openhound_github.kinds import nodes as nk
 from openhound_github.main import app
+from openhound_github.models.enterprise_helpers import projected_enterprise_team_node_id
 from openhound_github.models.team import GHTeamProperties
 
 
@@ -43,7 +44,7 @@ class ProjectedEnterpriseTeam(BaseAsset):
             properties=GHTeamProperties(
                 name=self.name,
                 displayname=self.name,
-                node_id=f"GH_Team_{self.org_node_id}_{self.node_id}",
+                node_id=projected_enterprise_team_node_id(self.org_node_id, self.node_id),
                 github_team_id=self.node_id,
                 collected=False,
                 slug=self.slug,

{openhound_github-0.6.2 → openhound_github-0.6.4}/src/openhound_github/models/saml_helpers.py

@@ -3,27 +3,14 @@ from dataclasses import dataclass
 from typing import Any
 from urllib.parse import quote, urlparse
 
-from openhound.core.models.entries_dataclass import EdgeProperties, PropertyMatch
-
-from openhound_github.kinds import nodes as nk
+from openhound.core.models.entries_dataclass import EdgeProperties
 
 
 SAML_CONTRACT_VERSION = "opengraph-saml-v0.3.0"
 ENTRA_OBJECT_ID_CLAIM = "http://schemas.microsoft.com/identity/claims/objectidentifier"
-ENTRA_TENANT_ID_CLAIM = "http://schemas.microsoft.com/identity/claims/tenantid"
 DEFAULT_GITHUB_DEPLOYMENT_ID = "github.com"
 DEFAULT_GITHUB_WEB_ORIGIN = "https://github.com"
 
-_FOREIGN_USER_KIND = {
-    "entra": nk.AZ_USER,
-    "okta": nk.OKTA_USER,
-    "pingone": nk.PINGONE_USER,
-}
-_FOREIGN_USER_ENVIRONMENT_PROPERTY = {
-    nk.OKTA_USER: "tenant_domain",
-    nk.PINGONE_USER: "environmentid",
-}
-
 
 @dataclass
 class SAMLRelationshipEdgeProperties(EdgeProperties):
@@ -67,47 +54,6 @@ def detect_foreign_idp(
 
     return None, None
 
-def foreign_user_kind(foreign_idp_type: str | None) -> str:
-    return _FOREIGN_USER_KIND.get(foreign_idp_type or "", "")
-
-
-def foreign_user_matchers(
-    foreign_kind: str | None,
-    foreign_environment_id: str | None,
-    foreign_username: str | None,
-    saml_attributes: list[Any] | None = None,
-) -> list[PropertyMatch]:
-    """Return tenant-scoped matchers for foreign IdP user correlation."""
-    if foreign_kind == nk.AZ_USER:
-        tenant_ids = saml_attribute_match_values(
-            saml_attributes or [],
-            ENTRA_TENANT_ID_CLAIM,
-        )
-        object_ids = saml_attribute_match_values(
-            saml_attributes or [],
-            ENTRA_OBJECT_ID_CLAIM,
-        )
-        if (
-            not foreign_environment_id
-            or len(tenant_ids) != 1
-            or len(object_ids) != 1
-            or tenant_ids[0].casefold() != foreign_environment_id.casefold()
-        ):
-            return []
-        return [
-            PropertyMatch(key="tenantid", value=tenant_ids[0].upper()),
-            PropertyMatch(key="objectid", value=object_ids[0].upper()),
-        ]
-
-    environment_property = _FOREIGN_USER_ENVIRONMENT_PROPERTY.get(foreign_kind or "")
-    if not environment_property or not foreign_environment_id or not foreign_username:
-        return []
-    return [
-        PropertyMatch(key=environment_property, value=foreign_environment_id),
-        PropertyMatch(key="name", value=foreign_username.upper()),
-    ]
-
-
 def github_deployment_context(host: str) -> tuple[str, str]:
     """Return a stable deployment ID and browser origin for a GitHub API host."""
     parsed = urlparse(host)

{openhound_github-0.6.2 → openhound_github-0.6.4}/src/openhound_github/models/scim_user.py

@@ -137,6 +137,15 @@ class ScimOrganization(ScimScopeAsset):
         return []
 
 
+@app.asset()
+class EnterpriseScimOrganization(ScimOrganization):
+    """Enterprise-scoped SCIM organization input model.
+
+    This remains a distinct asset class so the converter can map enterprise and
+    organization SCIM tables independently while emitting the same graph kind.
+    """
+
+
 @app.asset(
     node=NodeDef(
         kind=nk.SCIM_USER,
@@ -189,7 +198,7 @@ class ScimUser(ScimScopeAsset):
             id=self.id,
             kinds=[nk.SCIM_USER],
             properties=ScimNodeProperties(
-                name=self.id,
+                name=self.user_name or self.id,
                 displayname=display_name,
                 environmentid=self.scope_node_id,
                 external_id=self.external_id,
@@ -213,15 +222,16 @@ class ScimUser(ScimScopeAsset):
             end=EdgePath(value=self.id, match_by="id"),
             properties=EdgeProperties(traversable=True),
         )
-        yield Edge(
-            kind=ek.SCIM_PROVISIONED,
-            start=EdgePath(value=self.id, match_by="id"),
-            end=ConditionalEdgePath(
-                kind=nk.EXTERNAL_IDENTITY,
-                property_matchers=[PropertyMatch(key="guid", value=self.id)],
-            ),
-            properties=EdgeProperties(traversable=True),
+        external_identity_id = self._lookup.external_identity_id_for_guid(
+            self.id, self.scope_name
         )
+        if external_identity_id:
+            yield Edge(
+                kind=ek.SCIM_PROVISIONED,
+                start=EdgePath(value=self.id, match_by="id"),
+                end=EdgePath(value=external_identity_id, match_by="id"),
+                properties=EdgeProperties(traversable=True),
+            )
         if self.emit_legacy_correlation and self.external_id:
             yield Edge(
                 kind=ek.SCIM_PROVISIONED,
@@ -231,6 +241,11 @@ class ScimUser(ScimScopeAsset):
             )
 
 
+@app.asset()
+class EnterpriseScimUser(ScimUser):
+    """Enterprise-scoped SCIM user input model."""
+
+
 @app.asset(
     node=NodeDef(
         kind=nk.SCIM_GROUP,