Accounts

An account is a resource that represents a unique set of credentials issued from a configured auth method which can be used to establish the identity of a user.

A user can have zero or more accounts but an account can only belong to a single user. An account can only be associated with a user in the same scope as the account's auth method.

Attributes

All account types have the following configurable attributes:

name - (optional) If set, the name must be unique within the account's auth method.
description - (optional)

Password account attributes

Password account types have the following additional attributes:

login_name - (required) Must be unique within the account's auth method. Can only contain lower case letters.
password - (optional) Not setting the password disables the account.

OIDC account attributes

OIDC account types have the following additional attributes:

subject - (required) A case-sensitive string that maps to the OIDC sub claim for the end-user. You can set this value when you create the account. It is immutable after creation.
issuer - (optional) A case-sensitive URL that maps to the OIDC iss claim. You can set this value when you create the account. It is immutable after creation. If you do not set an issuer, it defaults to the issuer configured on the account's OIDC auth method.
full_name - (output only) Maps to the OIDC name claim for the authenticated user, and is updated every time the user successfully authenticates. It is empty until the user's first successful authentication.
email - (output only) Maps to the OIDC email claim for the authenticated user, and is updated every time the user successfully authenticates. It is empty until the user's first successful authentication.
token_claims - (output only) The marshaled claims from the ID token returned by the OIDC provider.
userinfo_claims - (output only) The marshaled claims returned by the OIDC provider's userinfo endpoint.

LDAP account attributes

LDAP account types have the following additional attributes:

login_name - (required) Must be unique within the account's auth method. Can only contain lower case letters.
full_name - (output only) Maps to the name attribute for the authenticated user, and is updated every time the user successfully authenticates. It is empty until the user's first successful authentication.
email - (output only) Maps to the email address attribute for the authenticated user, and is updated every time the user successfully authenticates. It is empty until the user's first successful authentication.
dn - (output only) Maps to the distinguished name for the authenticated user, and is updated every time the user successfully authenticates. It is empty until the user's first successful authentication.
member_of_groups - (output only) A list of the groups the authenticated user is a member of. It is empty until the user's first successful authentication.

Referenced by

Service API docs

The following services are relevant to this resource:

Account service