Auth Service Configuration
Introduction
The Infinite Scale Auth Service is used to authenticate service accounts. Compared to normal accounts, service accounts are Infinite Scale internal only and not available to ordinary users like via LDAP.
The auth Service Family
Infinite Scale uses several authentication services for different use cases. All services that start with auth- are part of the authentication service family. Each member authenticates requests with different scopes.
As of now, these auth services exist |
|
|---|---|
Handles 3rd party app authentication. |
|
Handles basic authentication. |
|
Handles OIDC authentication. |
|
Handles interservice authentication when a user is impersonated. |
|
Handles interservice authentication when using service accounts. |
|
Service Accounts
Service accounts are user accounts that are only used for inter-service communication. These users have no personal space, do not show up in user lists and cannot login via the UI. Service accounts can be configured in the settings service. Only the admin service user is available for now. In addition to the actions it can do via its role, all service users can stat all files on all spaces.
Configuring Service Accounts
By using the envvars OCIS_SERVICE_ACCOUNT_ID and OCIS_SERVICE_ACCOUNT_SECRET, one can configure the ID and the secret of the service user. The secret can be rotated regulary to increase security. For activating a new secret, all services where the envvars are used need to be restarted. The secret is always and only stored in memory and never written into any persistant store. Though you can use any string for the service account, it is recommmended to use a UUIDv4 string.
Configuration
Environment Variables
The auth-service service is configured via the following environment variables. Read the Environment Variable Types documentation for important details. Column IV shows with which release the environment variable has been introduced.
404: Not Found
YAML Example
-
Note the file shown below must be renamed and placed in the correct folder according to the Configuration File Naming conventions to be effective.
-
See the Notes for Environment Variables if you want to use environment variables in the yaml file.