Struct zitadel::credentials::ServiceAccount

pub struct ServiceAccount { /* private fields */ }

A service account for ZITADEL. The service account can be loaded from a valid JSON string or from a file containing the JSON string. The account is used to communicate with the ZITADEL API and may serve as access token provider for a gRPC service client.

The service account can be used with the provided access rights in ZITADEL. If you want to use the ZITADEL API itself (for example to manage organizations) TODO: sicher?

To create a service account json, head over to your ZITADEL console and execute the following steps:

• create a Service User in your organization
• Give the service user the relevant authorization (e.g. ORG_OWNER or access to a specific project)
• Create a “key” in the account detail page of the service user and download it

Implementations

impl ServiceAccount

pub fn load_from_file(file_path: &str) -> Result<Self, ServiceAccountError>

Load a ServiceAccount from a JSON file at a specific filepath.

Errors

This function may return an error when read_to_string returns an error. Further, an error may occur during the deserialization of load_from_json.

Example

use zitadel::credentials::ServiceAccount;
let service_account = ServiceAccount::load_from_file("./my_json_key.json")?;
println!("{:#?}", service_account);

pub fn load_from_json(json: &str) -> Result<Self, ServiceAccountError>

Load a ServiceAccount from a JSON string.

Errors

This method may fail if the deserialization does fail. Such an error can occur if the JSON is not formatted properly.

Example

use zitadel::credentials::ServiceAccount;
let service_account = ServiceAccount::load_from_json(r#"{"keyId": "1337", "userId": "42", "key": "foobar"}"#)?;
println!("{:#?}", service_account);

pub async fn authenticate( &self, audience: &str ) -> Result<String, ServiceAccountError>

Authenticates the ServiceAccount against the provided audience (or issuer) to fetch an access token. To authenticate with special options, use the authenticate_with_options call.

The function returns an access token that can be sent to authenticate any request as the given service account. The access token is valid for 60 minutes.

Errors

This method may fail when:

• The key in the service account is not a valid PEM encoded RSA private key.
• When the audience (issuer) is not reachable.
• When any error in the request happens.
• When the response status code is not 200 OK.
• When the response cannot be parsed as valid JSON.

Example

use zitadel::credentials::ServiceAccount;
let service_account = ServiceAccount::load_from_json(SERVICE_ACCOUNT)?;
let access_token = service_account.authenticate(ZITADEL_URL).await?;
println!("{}", access_token);

pub async fn authenticate_with_options( &self, audience: &str, options: &AuthenticationOptions ) -> Result<String, ServiceAccountError>

Authenticates the ServiceAccount against the provided audience (or issuer) like authenticate. However, the user can specify special options for the authentication within AuthenticationOptions.

The function returns an access token that can be sent to authenticate any request as the given service account. The access token is valid for 60 minutes.

Errors

This method may fail when:

• The key in the service account is not a valid PEM encoded RSA private key.
• When the audience (issuer) is not reachable.
• When any error in the request happens.
• When the response status code is not 200 OK.
• When the response cannot be parsed as valid JSON.

Examples

Authenticate with API access and profile scope

use zitadel::credentials::{AuthenticationOptions, ServiceAccount};
let service_account = ServiceAccount::load_from_json(SERVICE_ACCOUNT)?;
let access_token = service_account.authenticate_with_options(ZITADEL_URL, &AuthenticationOptions {
  api_access: true,
  scopes: vec!["profile".to_string()],
  ..Default::default()
}).await?;
println!("{}", access_token);

Authenticate with profile and email scope

use zitadel::credentials::{AuthenticationOptions, ServiceAccount};
let service_account = ServiceAccount::load_from_json(SERVICE_ACCOUNT)?;
let access_token = service_account.authenticate_with_options(ZITADEL_URL, &AuthenticationOptions {
  scopes: vec!["profile".to_string(), "email".to_string()],
  ..Default::default()
}).await?;
println!("{}", access_token);

Trait Implementations

impl Clone for ServiceAccount

fn clone(&self) -> ServiceAccount

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServiceAccount

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ServiceAccount

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ServiceAccount

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.