What's New

Introducing IBM Cloud IAM Service IDs and API Keys

Share this post:

IBM Cloud Identity & Access Management (IAM) enables you to securely authenticate users and control access to all cloud resources consistently on the IBM Bluemix Platform.  Starting in September 2017, you can authenticate your applications or services by using service IDs.

What is a Service ID?

A service ID is an identity that can be used by an application or service. Imagine that a group of developers work on an application together. The application needs the ability to call APIs of several services in the IBM Bluemix Platform. None of the developers would wish to use their personal identities and API keys to access those services from the shared application as that would expose their personal credentials to their co-developers. The developers may also wish to use a credential that has access only to the services needed by the application rather than using a credential that authenticates them as a user who has broader access. Service IDs are ideal for this purpose. The developers can create a service ID and an API key that can be used to authenticate as the service ID. They can then grant the service ID access to only the services the application requires, and then use the service ID’s API key from the application to authenticate as the service ID.

Why use Service IDs?

  • Users can keep their personal credentials private
  • The service ID can be granted access only to the minimum set of services required; loss of the API key would not give access to everything the user has access to
  • Each application can have its own service ID and API key, allowing for easy rotation of one key without impacting other applications or users
  • If desired, a unique key can be used for each service so that an untrusted service cannot gain access to other resources
  • Since service IDs are not tied to a specific user, if a user leaves an organization and is deleted from the account, the service ID remains ensuring that your application or service stays up and running

 

How do I use Service IDs and API Keys?

To create a service ID, navigate to Manage->Security->Identity & Access. Then, select Service IDs from the left navigation menu.

 

Click Create. You’ll be prompted to give the Service ID a name and description. Choose values that will be meaningful to you and will help you identify what you use this service ID for when working in the UI.

 

Once you click Create, your service ID is displayed.

In order for this service ID to have permissions to call APIs, you need to assign a policy to it.

 

After you have assigned a policy to the service ID to give it permission to call APIs, you must create at least one API key for the service ID to enable an application to authenticate as this identity. In the Actions menu for the service ID, select Manage service ID.

 

On the Manage Service ID page under the API keys section, click Create.

 

You are prompted to give the API key a name and description. Again, choose a name and description that will help you remember what the key is used for.

 

The key is generated and you can select to download it in a file or show it on the screen, which will allow you to cut and paste it into your application. You must save the key at this time because you cannot display it again. If you lose the key, you will need to delete that key and create a new one.

 

The API key should be protected as you would protect a password. Anyone who obtains the API key can perform any action or access any resource that the service ID’s policies allow. It is recommended that API keys be rotated at regular intervals. To rotate your key, create a new API key, modify your application to use the new key, and then delete the old API key. It is possible for one service ID to have multiple active API keys, which enables you to rotate keys without disruption.
From the application, you can now use the POST /oidc/token call to exchange the API key for a temporary token that will be used for API calls. It is also possible to use the API key directly in API calls, but it is strongly recommended for better security that you use a token to reduce the chances of anyone learning your API key.

To learn more

Add Comment
No Comments

Leave a Reply

Your email address will not be published.Required fields are marked *

More What's New Stories

Organize, navigate, and manage your resources on IBM Cloud

The IBM Cloud continues to grow, providing more and more functionality through our offerings in the catalog. As we grow, we’re excited to bring you new functionality to help better navigate your workloads on our cloud. Here are just a small subset of the things we have done with the console to make working with the IBM Cloud easier.

Continue reading

Opening the Compose API on the IBM Cloud

You can now use the Compose API to manage your IBM Cloud Compose databases. The new API is a carefully crafted selection of REST endpoints from the original Compose API. These endpoints are skillfully blended with IBM Cloud's concepts of service instances to bring the power of Compose's API to your database deployments.

Continue reading

Kubernetes conformance certification, new security controls, additional data centers, improved UI, and Kubernetes 1.8

The rate of change for the IBM Bluemix Container Service has been spectacular. Earlier this month, IBM announced a rebranding, and now we are IBM Cloud Container Service. The service is still the same great offering that launched in May 2017 and then expanded to support London and Sydney. Now we have more features to share.

Continue reading