mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-06 22:32:16 +00:00
chore: Service Account Naming Consistency (#11557)
# Which Problems Are Solved Inconsistent naming of service account, found in the following variations: - Machine User - machine user - Service User - Machine Account - Technical Account - User: Type Machine # How the Problems Are Solved Attentive search and replace. Localizations have been translated using Copilot # Additional Changes Some unused methods have been removed from the Go code. # Additional Context - Closes #11285
This commit is contained in:
Marco A.
@@ -0,0 +1,42 @@
|
||||
1. Go to the **Users** tab in your organization as shown below and click on the **Service Accounts** tab.
|
||||
|
||||
|
||||
|
||||
2. To add a service account, click on the **New** button.
|
||||
|
||||
|
||||
|
||||
3. Next, add the details of the service account and select either **Bearer** or **JWT** for **Access Token Type** and click on **Create**. For this example, we will select **JWT**.
|
||||
|
||||
|
||||
|
||||
4. Now you will see the saved details.
|
||||
|
||||
|
||||
|
||||
5. Next, we need to generate a private-public key pair in ZITADEL and you must get the private key to sign your JWT. Go to **Keys** and click on **New**.
|
||||
|
||||
|
||||
|
||||
6. Select type **JSON** and click **Add**.
|
||||
|
||||
|
||||
|
||||
7. Download the key by clicking **Download**. After the download, click **Close**.
|
||||
|
||||
|
||||
|
||||
8. You will see the following screen afterward.
|
||||
|
||||
|
||||
|
||||
9. The downloaded key will be of the following format:
|
||||
|
||||
```
|
||||
{
|
||||
"type":"serviceaccount",
|
||||
"keyId":"<YOUR_KEY_ID>",
|
||||
"key":"-----BEGIN RSA PRIVATE KEY-----\n<YOUR_KEY>\n-----END RSA PRIVATE KEY-----\n",
|
||||
"userId":"<YOUR_USER_ID>"
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,36 @@
|
||||
In order to access this route, you must create the role `read:messages` in your ZITADEL project and also create an authorization for the service account you created by adding the role to the user. Follow these steps to do so:
|
||||
|
||||
1. Go to your project and select **Roles**. Click **New**.
|
||||
|
||||
|
||||
|
||||
2. Add the `read:messages` role as shown below and click **Save**.
|
||||
|
||||
|
||||
|
||||
3. You will see the created role listed.
|
||||
|
||||
|
||||
|
||||
4. To assign this role to a user, click on **Authorizations**.
|
||||
|
||||
|
||||
|
||||
5. Select the user you want to assign the role to.
|
||||
|
||||
|
||||
|
||||
6. Select the project where this authorization is applicable.
|
||||
|
||||
|
||||
7. Click **Continue**.
|
||||
|
||||
|
||||
|
||||
8. Select the role **read:messages** and click **Save**.
|
||||
|
||||
|
||||
|
||||
9. You will now see the service account has been assigned the role **read:messages**.
|
||||
|
||||
|
||||
@@ -1,42 +0,0 @@
|
||||
1. Go to the **Users** tab in your organization as shown below and click on the **Service Users** tab.
|
||||
|
||||
|
||||
|
||||
2. To add a service user, click on the **New** button.
|
||||
|
||||
|
||||
|
||||
3. Next, add the details of the service user and select either **Bearer** or **JWT** for **Access Token Type** and click on **Create**. For this example, we will select **JWT**.
|
||||
|
||||
|
||||
|
||||
4. Now you will see the saved details.
|
||||
|
||||
|
||||
|
||||
5. Next, we need to generate a private-public key pair in ZITADEL and you must get the private key to sign your JWT. Go to **Keys** and click on **New**.
|
||||
|
||||
|
||||
|
||||
6. Select type **JSON** and click **Add**.
|
||||
|
||||
|
||||
|
||||
7. Download the key by clicking **Download**. After the download, click **Close**.
|
||||
|
||||
|
||||
|
||||
8. You will see the following screen afterward.
|
||||
|
||||
|
||||
|
||||
9. The downloaded key will be of the following format:
|
||||
|
||||
```
|
||||
{
|
||||
"type":"serviceaccount",
|
||||
"keyId":"<YOUR_KEY_ID>",
|
||||
"key":"-----BEGIN RSA PRIVATE KEY-----\n<YOUR_KEY>\n-----END RSA PRIVATE KEY-----\n",
|
||||
"userId":"<YOUR_USER_ID>"
|
||||
}
|
||||
```
|
||||
@@ -1,36 +0,0 @@
|
||||
In order to access this route, you must create the role `read:messages` in your ZITADEL project and also create an authorization for the service user you created by adding the role to the user. Follow these steps to do so:
|
||||
|
||||
1. Go to your project and select **Roles**. Click **New**.
|
||||
|
||||
|
||||
|
||||
2. Add the `read:messages` role as shown below and click **Save**.
|
||||
|
||||
|
||||
|
||||
3. You will see the created role listed.
|
||||
|
||||
|
||||
|
||||
4. To assign this role to a user, click on **Authorizations**.
|
||||
|
||||
|
||||
|
||||
5. Select the user you want to assign the role to.
|
||||
|
||||
|
||||
|
||||
6. Select the project where this authorization is applicable.
|
||||
|
||||
|
||||
7. Click **Continue**.
|
||||
|
||||
|
||||
|
||||
8. Select the role **read:messages** and click **Save**.
|
||||
|
||||
|
||||
|
||||
9. You will now see the service user has been assigned the role **read:messages**.
|
||||
|
||||
|
||||
@@ -59,20 +59,20 @@ To set up the needed roles for your project, navigate to your `Portal` project,
|
||||
Now in the `General` section of the Portal project, make sure to enable `Assert Roles on Authentication`.
|
||||
This makes sure that roles, which is used by the application to enable UI components, are set in your OIDC ID Token.
|
||||
|
||||
### Service User
|
||||
### Service Account
|
||||
|
||||
To make the application work you need a service user which loads granted-projects and user-grants for you.
|
||||
In the B2B-Demo organization, navigate to `Users` in navigation of Management Console, click on `Service Users` and create a new user.
|
||||
To make the application work you need a service account which loads granted-projects and user-grants for you.
|
||||
In the B2B-Demo organization, navigate to `Users` in navigation of Management Console, click on `Service Accounts` and create a new user.
|
||||
Let's set its username to `nextjs` and its name to `NextJS`. Then press `create`.
|
||||
|
||||
On the detail page of that user, navigate to "Personal Access Tokens" and add a new entry, set an optional expiration date.
|
||||
|
||||
Copy the generated Token as you will need this in your environment configuration file later.
|
||||
|
||||
Go back to the `Portal` project and add the Service User as Manager (top right).
|
||||
Go back to the `Portal` project and add the Service Account as Manager (top right).
|
||||
Make sure to select `Project Owner Viewer` as the management role.
|
||||
|
||||
To show granted projects, go to the `Demo-Vendor` organization and add the Service User as `Org Project Permission Editor` Manager.
|
||||
To show granted projects, go to the `Demo-Vendor` organization and add the Service Account as `Org Project Permission Editor` Manager.
|
||||
|
||||
## Configuration
|
||||
|
||||
@@ -104,7 +104,7 @@ Replace the values as follows
|
||||
|
||||
`ZITADEL_CLIENT_ID`: Having the project `Portal` selected, click on the Application `portal-web`. `${CLIENT_ID}` is displayed as a field in the OIDC configuration, labeled "Client ID" and has the format `12345678@portal`.
|
||||
|
||||
`SERVICE_ACCOUNT_ACCESS_TOKEN`: Set up a service user, add a Personal Access Token and copy the secret here (see below).
|
||||
`SERVICE_ACCOUNT_ACCESS_TOKEN`: Set up a service account, add a Personal Access Token and copy the secret here (see below).
|
||||
|
||||
## Install and Run
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ At the end of the guide you should have an API with a protected endpoint.
|
||||
## Prerequisites
|
||||
|
||||
This will handle the OAuth 2.0 introspection request including authentication using JWT with Private Key using our [Go SDK](https://github.com/zitadel/zitadel-go).
|
||||
All that is required, is to create your API, create a private key and a personal access token for a service user.
|
||||
All that is required, is to create your API, create a private key and a personal access token for a service account.
|
||||
|
||||
### Set up application and obtain keys
|
||||
|
||||
@@ -54,15 +54,15 @@ And make sure to download it, as you won't be able to retrieve it again.
|
||||
|
||||
Now we need to create a *Personal Access Token* to authenticate the application requests.
|
||||
|
||||
On the user view, switch to *Service Users* and create a new one.
|
||||
On the user view, switch to *Service Accounts* and create a new one.
|
||||
|
||||
|
||||
|
||||
Give the service user a name and a username. Select `Bearer` as *Access Token Type*.
|
||||
Give the service account a name and a username. Select `Bearer` as *Access Token Type*.
|
||||
|
||||
|
||||
|
||||
### Create service user and personal access token (PAT)
|
||||
### Create service account and personal access token (PAT)
|
||||
|
||||
Once done, from the left panel of the user management, click on Personal Access Token and create a new one.
|
||||
|
||||
|
||||
@@ -4,8 +4,8 @@ sidebar_label: Pylon
|
||||
---
|
||||
|
||||
import AppJWT from "../imports/_app_jwt.mdx";
|
||||
import ServiceuserJWT from "../imports/_serviceuser_jwt.mdx";
|
||||
import ServiceuserRole from "../imports/_serviceuser_role.mdx";
|
||||
import ServiceAccountJWT from "../imports/_serviceaccount_jwt.mdx";
|
||||
import ServiceAccountRole from "../imports/_serviceaccount_role.mdx";
|
||||
|
||||
This integration guide demonstrates the recommended way to incorporate ZITADEL into your [Pylon](https://pylon.cronit.io) service.
|
||||
It explains how to check the token validity in the API and how to check for permissions.
|
||||
@@ -20,13 +20,13 @@ Before we can start building our application, we have to do a few configuration
|
||||
|
||||
<AppJWT components={props.components} />
|
||||
|
||||
### Create Serviceuser
|
||||
### Create Service Account
|
||||
|
||||
<ServiceuserJWT components={props.components} />
|
||||
<ServiceAccountJWT components={props.components} />
|
||||
|
||||
### Give Serviceuser an authorization
|
||||
### Give Service Account an authorization
|
||||
|
||||
<ServiceuserRole components={props.components} />
|
||||
<ServiceAccountRole components={props.components} />
|
||||
|
||||
### Prerequisites
|
||||
|
||||
@@ -36,9 +36,9 @@ At the end you should have the following for the API:
|
||||
- `.json`-key-file for the API, from the application
|
||||
- ID of the project
|
||||
|
||||
And the following from the Serviceuser:
|
||||
And the following from the Service Account:
|
||||
|
||||
- `.json`-key-file from the serviceuser
|
||||
- `.json`-key-file from the service account
|
||||
|
||||
## Setup new Pylon service
|
||||
|
||||
@@ -263,7 +263,7 @@ To call the API you need an access token, which is then verified by ZITADEL.
|
||||
Please follow [this guide here](/guides/integrate/token-introspection/private-key-jwt), ignoring the first step as we already have the `.json`-key-file from the serviceaccount.
|
||||
|
||||
<Callout>
|
||||
You can also create a PAT for the serviceuser and use it to test the API. For this, follow [this guide](/guides/integrate/service-accounts/personal-access-token#create-a-service-user-with-a-pat).
|
||||
You can also create a PAT for the service account and use it to test the API. For this, follow [this guide](/guides/integrate/service-accounts/personal-access-token#create-a-service-account-with-a-pat).
|
||||
</Callout>
|
||||
|
||||
Optionally set the token as an environment variable:
|
||||
|
||||
@@ -4,8 +4,8 @@ sidebar_label: Django
|
||||
---
|
||||
|
||||
import AppJWT from '../imports/_app_jwt.mdx';
|
||||
import ServiceuserJWT from '../imports/_serviceuser_jwt.mdx';
|
||||
import ServiceuserRole from '../imports/_serviceuser_role.mdx';
|
||||
import ServiceAccountJWT from '../imports/_serviceaccount_jwt.mdx';
|
||||
import ServiceAccountRole from '../imports/_serviceaccount_role.mdx';
|
||||
import SetupPython from '../imports/_setup_python.mdx';
|
||||
|
||||
This integration guide demonstrates the recommended way to incorporate ZITADEL into your Django Python application.
|
||||
@@ -25,13 +25,13 @@ Before we can start building our application, we have to do a few configuration
|
||||
|
||||
<AppJWT components={props.components} />
|
||||
|
||||
### Create Serviceuser
|
||||
### Create Service Account
|
||||
|
||||
<ServiceuserJWT components={props.components} />
|
||||
<ServiceAccountJWT components={props.components} />
|
||||
|
||||
### Give Serviceuser an authorization
|
||||
### Give Service Account an authorization
|
||||
|
||||
<ServiceuserRole components={props.components} />
|
||||
<ServiceAccountRole components={props.components} />
|
||||
|
||||
### Prerequisites
|
||||
|
||||
@@ -42,8 +42,8 @@ At the end you should have the following for the API:
|
||||
- `.json`-key-file for the API, from the application
|
||||
- ID of the project
|
||||
|
||||
And the following from the Serviceuser:
|
||||
- `.json`-key-file from the serviceuser
|
||||
And the following from the Service Account:
|
||||
- `.json`-key-file from the service account
|
||||
|
||||
## Setup new Django application
|
||||
|
||||
|
||||
@@ -182,13 +182,13 @@ CLIENT_ID = "197....@projectname"
|
||||
CLIENT_SECRET = "NVAp70IqiGmJldbS...."
|
||||
```
|
||||
|
||||
### ZITADEL configuration to create a service user
|
||||
### ZITADEL configuration to create a service account
|
||||
|
||||
|
||||
|
||||
1. Create a service user and a Personal Access Token (PAT) for that user by following [this guide](/guides/integrate/service-accounts/personal-access-token#create-a-service-user-with-a-pat).
|
||||
1. Create a service account and a Personal Access Token (PAT) for that user by following [this guide](/guides/integrate/service-accounts/personal-access-token#create-a-service-account-with-a-pat).
|
||||
2. To enable authorization, follow [this guide](/guides/manage/console/roles) to create a role `read:messages` on your project.
|
||||
3. Next, create an authorization for the service user you created by adding the role `read:messages` to the user. Follow this [guide](/guides/manage/console/roles#authorizations) for more information on creating an authorization.
|
||||
3. Next, create an authorization for the service account you created by adding the role `read:messages` to the user. Follow this [guide](/guides/manage/console/roles#authorizations) for more information on creating an authorization.
|
||||
|
||||
### Run the API
|
||||
|
||||
@@ -222,7 +222,7 @@ curl --request GET \
|
||||
|
||||
You should get a response with Status Code 401 and an error message.
|
||||
|
||||
Now let's add an authorization header to your request. Save the personal access token for your service user to a variable by running the following command. Replace the value with the PAT you obtained earlier.
|
||||
Now let's add an authorization header to your request. Save the personal access token for your service account to a variable by running the following command. Replace the value with the PAT you obtained earlier.
|
||||
|
||||
`PAT=nr9vnUTkQkn4rxWk...`
|
||||
|
||||
@@ -252,4 +252,4 @@ You should get a response with Status Code 200 and the following message.
|
||||
|
||||
`{"message":"Private, scoped route - You need to be authenticated and have the role read:messages to see this."}`
|
||||
|
||||
You can remove the role from the service user in ZITADEL and try again. You should then get a Status Code 403, Forbidden error.
|
||||
You can remove the role from the service account in ZITADEL and try again. You should then get a Status Code 403, Forbidden error.
|
||||
|
||||
Reference in New Issue
Block a user