Auth Service Configuration

Introduction

The Infinite Scale Auth Service is used to authenticate service accounts. Compared to normal accounts, service accounts are Infinite Scale internal only and not available to ordinary users like via LDAP.

Default Values

  • Auth Server listens on port 9198 by default.

The auth Service Family

Infinite Scale uses several authentication services for different use cases. All services that start with auth- are part of the authentication service family. Each member authenticates requests with different scopes.


As of now, these auth services exist

auth-basic

Handles basic authentication.

auth-bearer

Handles OIDC authentication.

auth-machine

Handles interservice authentication when a user is impersonated.

auth-service

Handles interservice authentication when using service accounts.

Service Accounts

Service accounts are user accounts that are only used for inter-service communication. These users have no personal space, do not show up in user lists and cannot login via the UI. Service accounts can be configured in the settings service. Only the admin service user is available for now. In addition to the actions it can do via its role, all service users can stat all files on all spaces.

Configuring Service Accounts

By using the envvars OCIS_SERVICE_ACCOUNT_ID and OCIS_SERVICE_ACCOUNT_SECRET, one can configure the ID and the secret of the service user. The secret can be rotated regulary to increase security. For activating a new secret, all services where the envvars are used need to be restarted. The secret is always and only stored in memory and never written into any persistant store. Though you can use any string for the service account, it is recommmended to use a UUIDv4 string.

Configuration

Environment Variables

The auth-service service is configured via the following environment variables. Read the Environment Variable Types documentation for important details.

  • 5.0.2

Environment variables for the auth-service service
Name Type Default Value Description

OCIS_TRACING_ENABLED
AUTH_SERVICE_TRACING_ENABLED

bool

false

Activates tracing.

OCIS_TRACING_TYPE
AUTH_SERVICE_TRACING_TYPE

string

The type of tracing. Defaults to '', which is the same as 'jaeger'. Allowed tracing types are 'jaeger' and '' as of now.

OCIS_TRACING_ENDPOINT
AUTH_SERVICE_TRACING_ENDPOINT

string

The endpoint of the tracing agent.

OCIS_TRACING_COLLECTOR
AUTH_SERVICE_TRACING_COLLECTOR

string

The HTTP endpoint for sending spans directly to a collector, i.e. http://jaeger-collector:14268/api/traces. Only used if the tracing endpoint is unset.

OCIS_LOG_LEVEL
AUTH_SERVICE_LOG_LEVEL

string

The log level. Valid values are: 'panic', 'fatal', 'error', 'warn', 'info', 'debug', 'trace'.

OCIS_LOG_PRETTY
AUTH_SERVICE_LOG_PRETTY

bool

false

Activates pretty log output.

OCIS_LOG_COLOR
AUTH_SERVICE_LOG_COLOR

bool

false

Activates colorized log output.

OCIS_LOG_FILE
AUTH_SERVICE_LOG_FILE

string

The path to the log file. Activates logging to this file if set.

AUTH_SERVICE_DEBUG_ADDR

string

127.0.0.1:9198

Bind address of the debug server, where metrics, health, config and debug endpoints will be exposed.

AUTH_SERVICE_DEBUG_TOKEN

string

Token to secure the metrics endpoint.

AUTH_SERVICE_DEBUG_PPROF

bool

false

Enables pprof, which can be used for profiling.

AUTH_SERVICE_DEBUG_ZPAGES

bool

false

Enables zpages, which can be used for collecting and viewing in-memory traces.

AUTH_SERVICE_GRPC_ADDR

string

127.0.0.1:9199

The bind address of the GRPC service.

AUTH_SERVICE_GRPC_PROTOCOL

string

tcp

The transport protocol of the GRPC service.

OCIS_JWT_SECRET
AUTH_SERVICE_JWT_SECRET

string

The secret to mint and validate jwt tokens.

OCIS_REVA_GATEWAY

string

com.owncloud.api.gateway

The CS3 gateway endpoint.

OCIS_GRPC_CLIENT_TLS_MODE

string

TLS mode for grpc connection to the go-micro based grpc services. Possible values are 'off', 'insecure' and 'on'. 'off': disables transport security for the clients. 'insecure' allows using transport security, but disables certificate verification (to be used with the autogenerated self-signed certificates). 'on' enables transport security, including server certificate verification.

OCIS_GRPC_CLIENT_TLS_CACERT

string

Path/File name for the root CA certificate (in PEM format) used to validate TLS server certificates of the go-micro based grpc services.

OCIS_SERVICE_ACCOUNT_ID
AUTH_SERVICE_SERVICE_ACCOUNT_ID

string

The ID of the service account the service should use. See the 'auth-service' service description for more details.

OCIS_SERVICE_ACCOUNT_SECRET
AUTH_SERVICE_SERVICE_ACCOUNT_SECRET

string

The service account secret.

YAML Example

  • 5.0.2

# Autogenerated
# Filename: auth-service-config-example.yaml

tracing:
  enabled: false
  type: ""
  endpoint: ""
  collector: ""
log:
  level: ""
  pretty: false
  color: false
  file: ""
debug:
  addr: 127.0.0.1:9198
  token: ""
  pprof: false
  zpages: false
grpc:
  addr: 127.0.0.1:9199
  tls: null
  protocol: tcp
token_manager:
  jwt_secret: ""
reva:
  address: com.owncloud.api.gateway
  tls:
    mode: ""
    cacert: ""
service_account:
  service_account_id: ""
  service_account_secret: ""