GitLab

The GitLab integration uses a Personal Access Token (PAT) from a dedicated account to give Trustle insight into over-privileged and unused accounts and to enable just-in-time access management.

Prerequisites

Trustle supports two account types for the integration. Requirements depend on which one you use.

• Group Service Account (GitLab Premium or Ultimate only): requires the Owner role in a top-level group on GitLab.com. For self-hosted GitLab, requires Administrator status, or the Owner role with appropriate permissions. Does not consume a seat license.
• Dedicated User Account (all GitLab tiers): requires a GitLab administrator to create the account. Consumes a seat license.

Use a Group Service Account when available. Otherwise, use a Dedicated User Account.

Configure GitLab

Step 1: Create a service account

Choose one of the following options.

Option A: Group service account (recommended, GitLab Premium/Ultimate only)

1. Go to your top-level group’s service accounts page: https://gitlab.com/groups/{your-group}/-/settings/service_accounts.

2. Click Add service account.

3. Enter a name, for example trustle-integration. GitLab auto-generates a username like service_account_group_{id}_{random}, but you can edit it.

4. Click Create service account.

   Caution

   Service accounts do not automatically have access. You must add them explicitly.

5. Go to Group → Members: https://gitlab.com/groups/{your-group}/-/group_members.

6. Click Invite members.

7. Search for the service account username.

8. Assign the Owner role. This is recommended for full access. The service account inherits access to subgroups and projects.

Note

Service accounts do not use a seat license. They cannot access the GitLab UI; they support API and Git operations only. Maximum token expiration is 365 days (400 days in GitLab 17.6 and later).

Option B: Dedicated user account (GitLab Free, or self-hosted without the service account feature)

Use this option if you don’t have access to Premium or Ultimate, or if you prefer a manual approach.

1. Have a GitLab administrator create a new user account. Use a username such as trustle-service or trustle-integration, and a service account email such as trustle-service@company.com.

2. Configure the account. Set a strong password; it is only needed for initial setup. Mark the account as an External user if it should not access internal projects. For full access to all GitLab users, groups, and projects, grant the Administrator role.

   Caution

   Add the user account as a member of every group or project you want to extract data from.

3. Go to each group’s Group → Members → Invite members page.

4. Search for the user account username.

5. Assign the Owner role. This is recommended for full access.

Note

A dedicated user account consumes a seat license, unlike a service account. It can access the GitLab UI unless you restrict it separately, and it is subject to user-related policies and access controls.

Step 2: Generate a personal access token

These steps apply to a Group Service Account on GitLab Premium or Ultimate.

1. Go to Group Settings → Service Accounts.

2. Select the service account.

3. Open the Access Tokens tab.

4. Click Add new token.

5. Configure the token:

   1. Token name: enter a name, for example Trustle Acme Integration.
   2. Expiration date: set a date according to your security policy. The maximum is 365 days.
   3. Scopes: select api.

6. Click Create personal access token.

   Caution

   Copy the token immediately. GitLab will not show it again.

Connect in Trustle

1. Go to the Connections page in Trustle from the left menu.
2. Under SaaS Applications, find the GitLab logo and click Connect.
3. Enter the connection details and the Personal Access Token you created above.
4. Click Test Connection.
5. After the connection test succeeds, click Save Connection.