Identity Cloud

Service accounts

Overview

Identity Cloud provides service accounts to let you request access tokens for most REST API endpoints; for example, you may need an access token to use the REST API endpoint /openidm/managed/alpha_user to get a list of identities.

You create a new service account in the Identity Cloud admin UI, then use the JWT profile for OAuth 2.0 authorization grant flow to obtain an access token from it. You can then use the access token as a bearer token in the Authorization HTTP header for each API request.

Managing service accounts

Only a tenant administrator can create, modify, or delete service accounts, and only by using the Identity Cloud admin UI; refer to Manage service accounts using the UI. It is not possible for any user, even a tenant administrator, to create, modify, or delete service accounts using the REST API.

You create service accounts in each environment; they are not promotable.

Service account scopes

When you create a service account, you choose which scopes it can grant to the access tokens it creates. You should always choose the minimum number of scopes needed.

Scope Purpose

fr:am:*

Access to /am/* API endpoints

fr:idm:*

Access to /openidm/* API endpoints

fr:idc:esv:*

Access to ESV API endpoints

      fr:idc:esv:read

Read access to ESV API endpoints

      fr:idc:esv:update

Create, update, and delete access to ESV API endpoints

      fr:idc:esv:restart

Access to ESV API endpoint to restart Identity Cloud services

fr:idc:promotion:*

Access to promotions API endpoints

Get an access token using a service account

To get an access token using a service account, refer to Authenticate to Identity Cloud REST API with access token.

Manage service accounts using the UI

View service accounts

  1. In the Identity Cloud admin UI, open the Tenant menu (upper right).

    150

  2. Click Tenant settings.

  3. Click Settings.

  4. Click Service Accounts. The page displays existing service accounts for your tenant.

Create a new service account

  1. In the Identity Cloud admin UI, open the Tenant menu (upper right).

  2. Click Tenant settings.

  3. Click Settings.

  4. Click Service Accounts.

  5. Click New Service Account.

  6. Enter a Name and optional Description for the service account.

  7. In the Scopes section, select the scopes that the service application can grant to an access token. Refer to Service account scopes.

  8. Click Save.

  9. When the 'Service account successfully created!' message shows:

    1. Make a note of the service account ID, found in the ID field.

    2. Click Download Key to download the service account private key.

      You must download the private key at this point as it will not be available again.

  10. Click Done.

To get an access token using a service account, refer to Authenticate to Identity Cloud REST API with access token.

Modify a service account

  1. In the Identity Cloud admin UI, open the Tenant menu (upper right).

  2. Click Tenant settings.

  3. Click Settings.

  4. Click Service Accounts.

  5. Click the ellipsis on the right of a service account and select Edit.

  6. You can change the Name or optional Description.

  7. In the Scopes section, you can change the scopes that the service application can grant to an access token. Refer to Service account scopes.

    Before removing scopes that the service application can grant to an access token, make sure you identify which of your integrations are dependent upon those scopes; otherwise those integrations will fail the next time they request an access token.

  8. Click Save.

Regenerate a key for a service account

Before regenerating a key, make sure you identify which of your integrations are dependent upon it to sign JWTs, as all those integrations need to be updated with the new key.

  1. In the Identity Cloud admin UI, open the Tenant menu (upper right).

  2. Click Tenant settings.

  3. Click Settings.

  4. Click Service Accounts.

  5. Click the ellipsis on the right of a service account and select Regenerate Key.

  6. On the Regenerate Key dialog box, click Regenerate Key.

  7. When the 'Key successfully created!' message is shown:

    1. Click Download Key to download the new service account private key.

      You must download the private key at this point as it will not be available again.

  8. Click Done.

Delete a service account

Before deleting a service account, make sure none of your integrations are dependent upon its key to sign JWTs; otherwise those integrations will fail the next time they request an access token.

  1. In the Identity Cloud admin UI, open the Tenant menu (upper right).

  2. Click Tenant settings.

  3. Click Settings.

  4. Click Service Accounts.

  5. Click the ellipsis on the right of a service account and select Delete.

  6. On the Delete Service Account page, click Delete Service Account.

Copyright © 2010-2023 ForgeRock, all rights reserved.