mirror of
https://github.com/pocket-id/pocket-id.git
synced 2025-12-06 09:13:19 +03:00
🚀 Feature: Machine to Machine Authentication(Service Accounts) #46
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @swapnilraut3 on GitHub.
Feature description
Description:
Currently, PocketID allows user accounts to authenticate via OIDC, passkeys, and API keys. However, for automation and machine-to-machine communication, there is no clear mechanism to obtain credentials for service accounts.
Pitch
Use Case:
I want to run long-running jobs (e.g., scheduled ETL pipelines, background workers, or CI/CD tasks) that need to authenticate securely without relying on a user account.
These jobs require their own service accounts with scoped permissions, separate from human users.
Ideally, the service account would have its own credentials (client ID/secret, API key, or token) that can be rotated and managed independently.
Feature Proposal:
Add support for service account credentials in PocketID.
Each service account could generate:
A client ID/secret pair (for OIDC flows), OR
A scoped API key tied to the service account.
Credentials should be manageable via the admin UI or API (create, revoke, rotate).
Permissions/RBAC can be assigned to service accounts just like user accounts or groups.
Benefits:
Enables secure automation without binding jobs to human accounts.
Provides clear separation of concerns between users and services.
Aligns with common practices in IAM systems like Keycloak, Authentik, and AWS IAM.
@ItalyPaleAle commented on GitHub:
@swapnilraut3 isn't this what #901 implements? You'd create one client as the service account, and use the client credentials flow to get the token
What is missing here is assigning groups/permissions to other clients, however
@kmendell commented on GitHub:
Are you referring to the client credentials flow? https://github.com/pocket-id/pocket-id/pull/901
@ItalyPaleAle commented on GitHub:
This has not been released yet, it will be in the next version.
That's a good feature request. Mind opening a new issue specifically about assigning roles / groups to OAuth2 clients?
@swapnilraut3 commented on GitHub:
Not exactly. I am looking for machine to machine authentication or say service account authentication. I want it to run long running automated jobs. So a service account is needed rather than individual account.
@swapnilraut3 commented on GitHub:
I think documentation lacks on this topic on official website. Also it would be greate if i am able to add service account a group permissions.