Authenticate applications and services by setting up service accounts

Accounts are classified as either user accounts or service accounts. A user account authenticates human users in your organization. A service account authenticates applications or services without human intervention.

The practical difference between a user account and a service account is significant for automation. A user account can become inaccessible when an employee leaves your organization. A service account belongs to the workload, not the person, so organizational changes do not affect the account.

You must use service accounts to connect to cloud service APIs on Red Hat Hybrid Cloud Console. Service accounts support token-based authentication. Permissions on the token are determined by the User Access groups the service account belongs to. Without group membership, the account can authenticate but has no privileges on any Red Hat application or service.

Note
APIs require an access token from Red Hat Single Sign-On. The token expires after 15 minutes (900 seconds). Repeat the process of obtaining an access token every 10 minutes (600 seconds) so that the token is rotated prior to expiration.

Create service accounts on Red Hat Hybrid Cloud Console for the following reasons:

  • A workload must call Hybrid Cloud Console APIs without human intervention.
  • An application or service requires access to specific resources.
  • An application or service must access resources from multiple locations.

Example use cases for service accounts:

  • Automation and CI/CD pipelines: provision clusters, sync inventory, pull compliance reports, or push configuration.
  • Platform integrations: run Ansible playbooks, GitOps controllers, or cluster API providers that act on behalf of your organization against Red Hat APIs.
  • In-cluster operators: run operators such as the Cost Management Metrics Operator, which reads client_id and client_secret from a Kubernetes secret to send usage data back to console.redhat.com.
  • Scheduled data pulls: pull data and report against Insights (Red Hat Lightspeed), Inventory, Subscription Watch, Notifications, RBAC, and other console APIs.
  • Service-to-service authentication: authenticate against console-hosted APIs that accept OIDC bearer tokens.

Do not use service accounts in these situations:

  • For an individual's day-to-day console access.
  • As a shared "team" login.
  • For actions that require Organization Administrator privileges that your RBAC model does not allow to be delegated.

Red Hat tools that work with service accounts:

Once you've created a service account and added it to the correct User Access group, you can use it to authenticate to Red Hat tools and integrations, such as:

  • ROSA CLI
  • Cluster API Provider AWS (CAPA) for ROSA with hosted control planes HCP
  • Cost Management Metrics Operator
  • Kessel APIs (Inventory API and Relations API)
  • Ansible Automation Platform on Hybrid Cloud Console
  • Any Hybrid Cloud Console REST API

Set up access for your applications and services
Copy link

Use service accounts to securely and automatically connect and authenticate services or applications without requiring an end user’s credentials or direct interaction.

When you create a Red Hat service account, you generate a client ID and a secret. The service account uses the ID and secret to access services on the Red Hat Hybrid Cloud Console.

  • Client ID The client ID identifies the service account to the resource, much like a username identifies a user.
  • Secret The secret provides a similar function as does a password. The secret appears once when you create the service account. Copy and save the secret and protect it as you would any password.

After you create a service account, you add it to the applicable User Access group. User Access is the Red Hat implementation of role-based access control. The roles assigned to a User Access group determine the level of access the service account has to applications and services on the Red Hat Hybrid Cloud Console. You can also create a group for your service account.

The following tasks guide you through how to create and manage service accounts and groups:

  • Generate credentials for service account access
  • Add service accounts to a group
  • Organize service account access by group
  • Delete a service account from a group

You can perform the following tasks after you generate a client ID and a secret for a service account:

  • Update the service account secret key
  • Delete a service account

You must be the owner of a service account if you want to reset it or delete it. The Organization Administrator can reset or delete any service account.

Create a service account and generate credentials
Copy link

You can create a service account and generate the client ID and secret to use with that account.

Before you begin
Copy link

Procedure
Copy link

  1. From the Red Hat Hybrid Cloud Console, Click the settings icon (⚙) and click Service Accounts.
  2. Click Create service account to set up the account.
  3. Enter a Service account name and a Short description and click Create.
  4. Copy the generated Client ID and Client secret values to a secure location. You’ll specify these credentials when configuring a connection to a service.
    Important
    The Client secret is displayed only once, so ensure that you’ve successfully and securely saved the copied credentials before closing the credentials window.
  5. After you save the Client ID and secret to a secure location, select the confirmation check box in the credentials window and close the window. The Client secret is not displayed again.
  6. The service account and its Client ID appear on the Service Accounts page.

Add service accounts to a group
Copy link

The Organization Administrator adds a service account to a User Access group that has the permissions that allow a service account to access services and applications on the Red Hat Hybrid Cloud Console.

Before you begin
Copy link

Note
Any user can create a service account but only the Organization Administrator or a User Access administrator can add service accounts to groups.

Procedure
Copy link

  1. From the Red Hat Hybrid Cloud Console, click the settings icon (⚙) and click User Access.
  2. To add the service account to a preexisting group, click the Groups tab and click the name of the group that you want to add the service account to.
  3. When the group name window appears, click the Service accounts tab.
  4. Click Add service account. A list appears of all service accounts associated with your Red Hat organization account.
  5. Click the service accounts you want to add to the User Access group and click Add to group.
  6. The service accounts appear on the Service accounts tab.

Organize service account access by group
Copy link

The Organization Administrator can create a new User Access group with roles or permissions that are specific to a service account. This group has the permissions that allow a service account to access services and applications on the Red Hat Hybrid Cloud Console.

Before you begin
Copy link

Note
Any user can create a service account but only the Organization Administrator or a User Access administrator can create a new group for a service account.
  • Ensure you are logged in to the Red Hat Hybrid Cloud Console as an Organization Administrator or as a user with User Access administrator permissions.
  • Confirm one or more service accounts are associated with your Red Hat organization account. Create a service account and generate credentials
  • Ensure you have access to the saved Client Secret information for the service account that you add to the User Access group.
Note
The Client Secret information is displayed once when you create a new service account. You must copy and save that information. It is not displayed again.

About this task
Copy link

In this example, you create a group that allows a service account to view automation analytics on the Red Hat Ansible Automation Platform.

Procedure
Copy link

  1. From the Red Hat Hybrid Cloud Console, click the settings icon (⚙) and click User Access.
  2. Click the Groups tab and click Create Group.
  3. Add a Group name and a Group description. The description is optional.
  4. Click Next to add roles to the group. For this example, find Automation Analytics viewer and click the checkbox next to the role name.
  5. Click Next to display Add members. Because you are adding a service account and not a member, click Next.
  6. Add service accounts appears. Choose the service account you want to add and click the checkbox next to the name.
  7. Click Next and review the details. If no changes are needed, click Submit. The new group is created that contains the service account and the Automation Analytics viewer role and permissions.

Remove a service account from a group
Copy link

The Organization Administrator can delete a service account from a User Access group on the Red Hat Hybrid Cloud Console. Any user can create a service account but only the Organization Administrator or a User Access administrator can delete service accounts from groups.

Before you begin
Copy link

Procedure
Copy link

  1. From the Red Hat Hybrid Cloud Console, click the settings icon (⚙) and click User Access.
  2. To delete the service account from a group, click the Groups tab and click the name of the group that includes the service account.
  3. When the group name window appears, click the Service accounts tab. All service accounts in that group appear.
  4. Remove a single service account.
    1. Click the options icon (⋮) in the Name row and click Remove.
    2. Acknowledge the Remove service account? message and click Remove service account.
  5. Remove multiple service accounts.
    1. Click the check box next to each account to remove.
    2. Click the options icon (⋮) in any Name row of the selected service accounts and click Remove.
    3. Acknowledge the Remove service account? message and click Remove service account.
  6. Verify that the selected service account does not appear on the Service accounts tab.

Update the service account secret key
Copy link

You can reset the secret for a service account. When you do so, the client ID does not change. You must be the owner of a service account if you want to reset it or delete it. The Organization Administrator user can reset or delete any service account.

Before you begin
Copy link

Procedure
Copy link

  1. From the Red Hat Hybrid Cloud Console, Click the settings icon (⚙) and click Service Accounts.
  2. On the list of existing service accounts, select the service account you want to reset and click the options icon (⋮).
  3. Verify that you want to reset this account and click Reset credentials.
  4. Copy the updated Client secret values to a secure location. You’ll specify these credentials when configuring a connection to a service.
    Important
    The generated credentials are displayed only once, so ensure that you’ve successfully and securely saved the copied credentials before closing the credentials window.
  5. After you save the generated credentials to a secure location, select the confirmation check box in the credentials window and close the window.

Delete a service account
Copy link

You can delete a service account. You must be the owner of a service account if you want to reset it or delete it. The Organization Administrator user can reset or delete any service account.

Before you begin
Copy link

Procedure
Copy link

  1. From the Red Hat Hybrid Cloud Console, Click the settings icon (⚙) and click Service Accounts.
  2. Identify the service account you want to delete and click the options icon (⋮).
  3. Verify that you want to delete this account and click Delete service account.

Guidelines for how to use service accounts with services
Copy link

The following information briefly describes how to use service accounts with services and the CLIENT_ID and CLIENT_SECRET variables. It is provided as a reference guideline only.

  1. Create a new Service account: Red Hat Hybrid Cloud Console Service accounts
  2. Paste the following information in a terminal, replacing the CLIENT_ID and CLIENT_SECRET variables: 
    export HOST='https://sso.redhat.com' CLIENT_ID='<client_id>' CLIENT_SECRET='<client_secret>' SCOPES='api.console'
  3. Get a token for the service account with 
    curl "${HOST}/auth/realms/redhat-external/protocol/openid-connect/token" \
        --data-urlencode "grant_type=client_credentials" \
        --data-urlencode "client_id=${CLIENT_ID}" \
        --data-urlencode "client_secret=${CLIENT_SECRET}" \
        --data-urlencode "scope=${SCOPES}"

    If you have jq installed (a command-line JSON processor), you can save the token to an env var:

    export ACCESS_TOKEN=$( \
    curl "${HOST}/auth/realms/redhat-external/protocol/openid-connect/token" \
        --data-urlencode "grant_type=client_credentials" \
        --data-urlencode "client_id=${CLIENT_ID}" \
        --data-urlencode "client_secret=${CLIENT_SECRET}" \
        --data-urlencode "scope=${SCOPES}" \
    | jq -r '.access_token')
  4. Send a request to an application that supports service accounts: 
    curl --header "Authorization:Bearer ${ACCESS_TOKEN}" --location "https://console.redhat.com/api/rbac/v1/access/?application=inventory"
  5. The response should be empty, or unprivileged depending on the app. Try adding the service account to an User Access group, and adding roles to that group. User Access Groups
  6. After roles are added to the service account group, repeat step 3 to grab a fresh token and attempt the request again. You should now have more privileges and get proper responses from applications.