[HELP] Cannot create github sync groups with some teams

[Apollorion]

90% of our teams will sync with our IDP (Okta), but 3 of them will not, and they fail with the following error:

PATCH https://api.github.com/orgs/xxx/teams/xxx/team-sync/group-mappings: 403 This team is not externally managed. Learn more at https://docs.github.com/articles/synchronizing-teams-between-your-identity-provider-and-github []

Im not sure whats wrong, since its working for majority of our groups. Here is our implementation via a module:

resource "github_team_sync_group_mapping" "okta" {
  count = length(var.sync_groups) > 0 ? 1 : 0

  team_slug = github_team.main.slug

  dynamic "group" {
    for_each = var.sync_groups

    content {
      group_id          = group.value.id
      group_name        = group.value.name
      group_description = group.value.description
    }
  }
}

The only thing I can see is that the 3 teams that arent syncing have child teams. If the team is a base team it works, but if it has children under it I get the above error.

[Apollorion]

My child team hunch was correct, you cannot sync teams with okta if they have a child team under them. Is there any work around for this? Is this documented anywhere? I struggled to find any information.

[kfcampbell]

@Apollorion I apologize, you are the first person to report such an issue! I unfortunately don't have access to a test Okta instance (is that free?) to validate this with.

If you're interested in opening up a PR to document or tackle this behavior, please feel free!

[Apollorion]

@kfcampbell Dont actually need okta to test with. I think this is a feature (or bug perhaps) of github itself.

In the github UI; If you enable team sync in your org, you'll notice that teams with a nested team under it cannot sync to any sort of user management tool. The option just doesnt exist.

[kfcampbell]

Ohh I see! Would you mind reporting the issue to GitHub Support? I don't know a better way to go about it.

[github-actions[bot]]

👋 Hey Friends, this issue has been automatically marked as stale because it has no recent activity. It will be closed if no further activity occurs. Please add the Status: Pinned label if you feel that this issue needs to remain open/active. Thank you for your contributions and help in keeping things tidy!

[Apollorion]

IMO, the "fix" for this is just documenting the way this works. Since its a github limitation.