Add github_organization_credential_authorization table by Kanthi-Hegde · Pull Request #552 · turbot/steampipe-plugin-github

Kanthi-Hegde · 2026-06-30T13:35:52Z

Description

The plugin currently has no way to query classic personal access tokens (PATs) that members have authorized against an organization. This PR adds a new github_organization_credential_authorization table to close that gap.

It wraps GitHub's List SAML SSO authorizations for an organization REST API (GET /orgs/{org}/credential-authorizations), which is the only API GitHub exposes for classic PATs at the org level. The same endpoint also returns authorized SSH keys, distinguishable via the credential_type column.

What's included

New table: github_organization_credential_authorization
Registration in plugin.go
Docs page with usage guide, required permissions, and example queries

Columns

login, credential_id, token_last_eight, scopes, credential_type, credential_authorized_at, credential_accessed_at, authorized_credential_id, authorized_credential_note, authorized_credential_expires_at, authorized_credential_title, fingerprint.

Notes

The organization qualifier is required.
This endpoint requires an organization owner token (admin:org) and is only available for organizations on GitHub Enterprise Cloud with SAML SSO enabled; other orgs return no rows. A 403/404 is treated as an empty result, consistent with other org-scoped tables in this plugin.

cbruno10

@Kanthi-Hegde Thanks for raising this PR! I've left a few minor suggestions.

Also, can you please share the results of the example queries (just for postgres is fine) in a PR comment so we can see the shape of real results? Thanks!

cbruno10 · 2026-07-09T01:55:37Z

+			KeyColumns: []*plugin.KeyColumn{
+				{Name: "organization", Require: plugin.Required},
+			},
+			ShouldIgnoreError: isNotFoundError([]string{"404", "403"}),


Is there a reason we are ignoring 403 errors? I think ignoring these by default for the table is usually not desired behaviour, as the user wouldn't be aware of missing permissions.

cbruno10 · 2026-07-09T01:56:04Z

+	org := d.EqualsQuals["organization"].GetStringValue()
+
+	// Empty check
+	if org == "" {


Do we ever hit this if organization is a required qual for queries?

cbruno10 · 2026-07-09T01:57:17Z

+
+The `github_organization_credential_authorization` table provides insights into the classic personal access tokens authorized against a GitHub organization. As a security or compliance engineer, use this table to inventory the classic PATs that can reach your organization's resources, review the scopes they have been granted, and identify tokens that are stale, never used, or approaching expiration. The same endpoint also returns authorized SSH keys, which can be distinguished using the `credential_type` column.
+
+To query this table, the credential must be created under an organization owner. Classic personal access tokens require the `admin:org` scope (specifically `read:org`).


Having admin:org and read:org can't both be right, and GitHub's docs say admin:org for this endpoint.

Could you also mention it's classic PAT only (fine-grained tokens don't support it) and add the permissions block the other org tables have, e.g. github_organization_external_identity.md?

github-actions · 2026-09-07T23:32:16Z

This PR is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.

cbruno10

@Kanthi-Hegde I've left a few suggestions, can you please have a look? Thanks!

cbruno10 · 2026-09-11T16:42:32Z

+	"github.com/turbot/steampipe-plugin-sdk/v5/grpc/proto"
+	"github.com/turbot/steampipe-plugin-sdk/v5/plugin"
+	"github.com/turbot/steampipe-plugin-sdk/v5/plugin/transform"


Suggested change

"github.com/turbot/steampipe-plugin-sdk/v5/grpc/proto"

"github.com/turbot/steampipe-plugin-sdk/v5/plugin"

"github.com/turbot/steampipe-plugin-sdk/v5/plugin/transform"

"github.com/turbot/steampipe-plugin-sdk/v6/grpc/proto"

"github.com/turbot/steampipe-plugin-sdk/v6/plugin"

"github.com/turbot/steampipe-plugin-sdk/v6/plugin/transform"

main moved to SDK v6 in July, so can you please make this update so the plugin will build correctly after pulling in the latest from main?

cbruno10 · 2026-09-11T16:42:32Z

+
+	// Empty check
+	if org == "" {
+		return nil, fmt.Errorf("'organization' qual is required for the github_organization_credential_authorization table")
+	}


Suggested change

// Empty check

if org == "" {

return nil, fmt.Errorf("'organization' qual is required for the github_organization_credential_authorization table")

}

See comment above please

cbruno10 · 2026-09-11T16:42:32Z

+	for {
+		creds, resp, err := client.Organizations.ListCredentialAuthorizations(ctx, org, opts)
+		if err != nil {
+			plugin.Logger(ctx).Error("github_organization_credential_authorization", "api_error", err)


Suggested change

plugin.Logger(ctx).Error("github_organization_credential_authorization", "api_error", err)

plugin.Logger(ctx).Error("github_organization_credential_authorization.tableGitHubOrganizationCredentialAuthorizationList", "api_error", err)

Minor one, we usually use table.function for the log key

cbruno10 · 2026-09-11T16:42:32Z

+
+**Important Notes**
+- You must specify the `organization` column in the `where` or `join` clause to query the table.
+- This table is only available for organizations on **GitHub Enterprise Cloud** that have **SAML single sign-on (SSO)** enabled. Organizations without SAML SSO return no rows.


This is only true because of the 403 in ShouldIgnoreError. Once that's out, this should say the query errors if the token isn't an org owner or SAML isn't enabled.

cbruno10 · 2026-09-11T16:42:32Z

+			"github_my_star":                               tableGitHubMyStar(),
+			"github_my_team":                               tableGitHubMyTeam(),
+			"github_organization":                          tableGitHubOrganization(),
+			"github_organization_credential_authorization": tableGitHubOrganizationCredentialAuthorization(),


This is where the merge conflict comes from. The new key is the longest in the map, so gofmt shifted every line and anything added on main since collides. Can you please take main's plugin.go, add just this one line, and then run gofmt.

Kanthi Hegde added 2 commits June 30, 2026 18:41

Add github_organization_credential_authorization table

4f2ea19

Return error when org is empty

e36fd21

cbruno10 requested changes Jul 9, 2026

View reviewed changes

github-actions Bot added the stale No recent activity has been detected on this issue/PR and it will be closed label Sep 7, 2026

cbruno10 requested changes Sep 11, 2026

View reviewed changes

github-actions Bot removed the stale No recent activity has been detected on this issue/PR and it will be closed label Sep 11, 2026

Navigation Menu

Add github_organization_credential_authorization table - #552

Add github_organization_credential_authorization table#552
Kanthi-Hegde wants to merge 2 commits into
turbot:mainfrom
Kanthi-Hegde:add-org-credential-authorization-table

Kanthi-Hegde commented Jun 30, 2026

Uh oh!

cbruno10 left a comment

Uh oh!

cbruno10 Jul 9, 2026

Uh oh!

cbruno10 Jul 9, 2026

Uh oh!

cbruno10 Jul 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 7, 2026

Uh oh!

cbruno10 left a comment

Uh oh!

cbruno10 Sep 11, 2026

Uh oh!

cbruno10 Sep 11, 2026

Uh oh!

cbruno10 Sep 11, 2026

Uh oh!

cbruno10 Sep 11, 2026

Uh oh!

cbruno10 Sep 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		The `github_organization_credential_authorization` table provides insights into the classic personal access tokens authorized against a GitHub organization. As a security or compliance engineer, use this table to inventory the classic PATs that can reach your organization's resources, review the scopes they have been granted, and identify tokens that are stale, never used, or approaching expiration. The same endpoint also returns authorized SSH keys, which can be distinguished using the `credential_type` column.

		To query this table, the credential must be created under an organization owner. Classic personal access tokens require the `admin:org` scope (specifically `read:org`).

	plugin.Logger(ctx).Error("github_organization_credential_authorization", "api_error", err)
	plugin.Logger(ctx).Error("github_organization_credential_authorization.tableGitHubOrganizationCredentialAuthorizationList", "api_error", err)

Conversation

Kanthi-Hegde commented Jun 30, 2026

Uh oh!

cbruno10 left a comment

Choose a reason for hiding this comment

Uh oh!

cbruno10 Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

cbruno10 Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

cbruno10 Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Sep 7, 2026

Uh oh!

cbruno10 left a comment

Choose a reason for hiding this comment

Uh oh!

cbruno10 Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

cbruno10 Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

cbruno10 Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

cbruno10 Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

cbruno10 Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cbruno10 Jul 9, 2026 •

edited

Loading