Skip to main content

Managing Service Accounts

Service accounts are a special type of user that can be created and assigned permissions and roles. They are intended for running jobs rather than for interactive use.

Because a service account is not meant to be signed into, it cannot have a password. It authenticates with a personal access token instead, and every token operation on a service account is restricted to organization administrators.

Creating a service account​

A service account is created the same way as a normal user account, with serviceAccount set to true.

create user {
  "userName": "service_account@silect.is",
  "serviceAccount": true
}

Service accounts must be created by an organization administrator.

Granting and revoking permissions​

Permissions and roles are granted to and revoked from service accounts in the same way as for normal user accounts.

grant use on repository staging to user service_account@silect.is

Generating a personal access token​

Since service accounts are not intended for normal interactive use, passwords cannot be generated for them. If a third-party job needs access to the Magpie CLI, use a personal access token. Tokens may be generated for a service account by an organization administrator only, using the same command as for a normal user.

create access token for service_account@silect.is

Once the token has been generated and recorded, it is good practice to remove the paragraph containing it.

Listing access tokens​

Access tokens may be listed for a service account by an organization administrator only. This prints the token ID, description, creation date, expiration date, and disabled status for each token.

list access tokens for user service_account@silect.is

Once the token information has been read, it is good practice to remove the output containing it.

Enabling and disabling a token​

Tokens may be enabled or disabled for a service account by an organization administrator only. This is intended to be a temporary change — disable a token only if it should not be deleted. If the token will not be enabled again, delete it instead.

enable access token <token id>
disable access token <token id>

Deleting a token​

Tokens may be deleted for a service account by an organization administrator only.

delete access token <token id>

Using a service account​

To run a job as a service account, set the account as the userName on the job schedule.

alter job my_job add schedule {
  "name": "daily",
  "description": "Run the ETL jobs at midnight EST.",
  "expression": "0 0 4 * * ?",
  "userName": "service_account@silect.is",
  "schemaName": "staging_schema",
  "startTime": "2004-11-21T00:00:00Z",
  "endTime": "2017-11-23T00:00:00Z"
}