Service Accounts

Authorization Clients and Service Accounts

Applications that need a point of entry to interact with IAP APIs in order to perform tasks are created as Service Accounts in IAP. Using OAuth2 protocols that work over HTTPS to send a client token ID and secret key, authorization policies and controls are applied to limit what the requesting application is permitted to do and for how long. The client ID is used to identify the Service Account and the secret key is used to provide proof of right-to-access. Most notably, the client ID and secret key associated with a Service Account may be distributed to one or more Service Applications.

Feature Benefits

There are several benefits to encapsulating applications as Service Accounts in IAP. This new functionality:

• Provides a more secure way to connect IAP to external systems via one set of login information.
• Uses tokenization to give limited access to user data across applications and devices.
• Protects user data by providing access via client token ID without revealing user credentials.
• Allows third-party services to make requests on behalf of a user without accessing passwords and other sensitive information.

Parameters

Service account properties are referenced in the following table.

Sample Configuration

"accountData" : {
  "name": "Service Account Hello",
  "description": "This is a service account",
  "client_id": "638e17011ba61d5e222a16ab",
  "client_secret": "94367284-b12a-4858-b6c1-0bb11f1f126b",
  "grant_type": "xxxxx.yyyyy.zzzzz"
}

APIs

Listed below are the four (4) CRUD APIs with admin-level permissions used to support and manage service acounts.

Error Responses

The codes below indicate whether the HTTP request for a service account has been successfully executed or not.

Using Service Accounts in IAP

The following sections summarize how to use the Service Accounts feature in IAP.

Create a New Client for a Service Account

Navigate to IAP → Admin Essentials (AE). From the AE application:

1. Click the + sign on the toolbar to open the global Create dialog.

2. Select "OAuth Client" from the dropdown menu list.

3. Input a unique client name and a brief description, if desired (Figure 1)

   Figure 1: Create New Client
   

4. Click the Save button. The Authorization Client Details page displays with the Client Secret visible so the adminisrator can copy it to clipboard. A timestamp identifying the date and time the Client Secret was generated is also displayed (Figure 2).

   Figure 2: Client Details and Client Secret
   

5. A message to save the client secret displays in bold beneath the timestamp. If the secret is lost, use the Regenerate button to create a new one and invalidate the old one (Figure 3).

   Figure 3: Regenerate Client Secret
   

6. If a user leaves the Authorization Client Details page and later returns via the Clients Collection view (Admin Essentials → Authorization → Clients), they will not be able to see the client secret (Figure 4). They will, however, see the client secret timestamp.

   Figure 4: Client Secret Masked
   

Edit Client Permissions for a Service Account

From the Clients Authorization Details page:

1. Click the Edit Permissions button (Figure 5). The Edit User dialog displays.

   Figure 5: Edit Permissions
   

2. Select the appropriate user role permissions to assign (Figure 6).

3. Click the Save button to retain your changes.

   Figure 6: Edit Client User Role Permissions
   

Enable/Disable Clients for a Service Account

Use the toggle switch located at the top of the Client Details page to enable (turn on) or disable (turn off) the Service Account. Click the Save button to retain your changes. A message banner displays to inform users when the enable/disable state is activated for the Service Account. Authentication is not permitted against disabled Service Accounts.

Figure 7: Enable (Toggle On) Service Account Client

Figure 8: Disable (Toggle Off) Service Account Client

View & Edit Service Accounts

To view all Service Accounts on the system, select Users from the left navmenu in Admin Essentials and then click the Service Accounts tab. From this table view, you can also click the pencil icon to edit the permissions associated with a Service Account.

Figure 9: Service Accounts Tab

Delete a Client from a Service Account

To delete a client associated with a Service Account, click on the Clients name in the list to open the Client Details page (Figure 10). Next, clicked the menu button (⋮) in the upper-right corner of the page to open the menu dialog (Figure 11). Select the Delete option to remove the client.

Figure 10: Authorization Clients List

Figure 11: Client Menu Button

View & Modify Client Metadata for a Service Account

From the menu button (⋮) in the upper-right corner of the Client Details view, select the Metadata option (Figure 11). In the metadata drawer that opens, you will see a Created field with a date timestamp and the user that created/updated the client. Click the Close button to remove the current window from the screen (Figure 12).

Figure 12: Client Metadata