firezone
Update directory sync to use service accounts instead of user token
@bmanifold do you want to take care of the changes in providers you implemented or should I do that?
I can update them. I've got an update I need to make to the Okta api client anyway.
~~Actually for Google Workspace I think we can stick to personal tokens since they don't expire, and the service account requires an impersonation email anyhow.~~
Scratch that - we can keep the service account for auth, and just send an email to the org administrator to provision the service account for this and save the key.
@jamilbk @bmanifold Is this still relevant with the idea of using a public app instead?
Yeah this is still relevant:
- Okta will use a service app the customer provisions in their tenant
- Google will use our public service account
- Entra won't use these - we can exchange an access token for the tenant with our public OAuth creds