Skip to main content

Create and manage workload identities

Use this page to create, view, edit, enable, disable, and delete workload identities. For an introduction to workload identities and the problems they solve, see Workload identities. To configure authentication, claims, and resource server access for a workload identity, see Configure workload identity authentication.

Prerequisites​

Before you manage workload identities, ensure you meet the following requirements:

  • Your role includes the Workload Identity Management permission. The view, add, edit, and remove actions each control a specific operation.
  • To assign groups to a workload identity, your role can manage those groups. Group assignment is optional.
  • To view the audit history for a workload identity, your role also includes the Reports view permission.

Create a workload identity​

When you create a workload identity, IDaaS generates its OIDC application and client credentials automatically.

  1. Click > Members > Workload Identity. The Workload Identities page appears.
  2. Click . The Add Workload Identity page appears.
  3. Enter a Name for the workload identity. The name is required and must be unique.
  4. Optional: Enter a Description that explains the purpose of the workload identity.
  5. Optional: Enter an Owner to identify the person or team responsible for the workload identity.
  6. Optional: In the Groups section, select a group from the list to assign it to the workload identity.
    • Repeat to assign more groups.
    • To remove an assigned group, click next to the group.
  7. Click Save. IDaaS creates the workload identity and its associated OIDC application, then opens the workload identity details page.
info

If the default OIDC signing certificate is unavailable, IDaaS uses another available certificate for the workload's OIDC application and displays a message that identifies the certificate it used.

View workload identities​

The Workload Identities page lists the workload identities you can manage based on your role and group assignments.

  1. Click > Members > Workload Identity. The Workload Identities page appears.
  2. Review the following information for each workload identity:
    • State. Indicates whether the workload identity is active or disabled.
    • Name. The name of the workload identity. Click the name to open its details.
    • Last Authentication Time. The most recent time the workload authenticated. Displays as not available if the workload has never authenticated.
    • Created. The date and time the workload identity was created.

Sort and filter workload identities​

You can sort and filter the list to find a specific workload identity.

  1. Click > Members > Workload Identity. The Workload Identities page appears.
  2. You can do the following actions:
    • Click the arrow next to the Name column heading to sort the list alphabetically.
    • Click to enable filtering, then filter by name, state, or group. Select your filter options and click Apply.
    • To select multiple workload identities, select the checkbox next to each one.

Edit a workload identity​

You can update a workload identity's name, description, owner, and group assignments from the Profile tab.

  1. Click > Members > Workload Identity. The Workload Identities page appears.
  2. Click the name of the workload identity you want to edit. The details page appears with the Profile tab selected.
  3. Update the Name, Description, or Owner as required.
  4. In the Groups section, add or remove group assignments as required.
  5. Click Save.

Enable or disable a workload identity​

Disabling a workload identity prevents it from authenticating without deleting it. You can enable it again later.

  1. Click > Members > Workload Identity. The Workload Identities page appears.
  2. Do one of the following:
    • To disable an active workload identity, click for that workload identity.
    • To enable a disabled workload identity, click for that workload identity.
  3. Confirm the action on the prompt.
tip

To change the state of several workload identities at once, select their checkboxes and use the enable or disable action in the toolbar. You can also change the state from the Profile tab by using the active toggle.

Delete a workload identity​

Deleting a workload identity also removes its associated OIDC application. You cannot delete the OIDC application on its own.

  1. Click > Members > Workload Identity. The Workload Identities page appears.
  2. Click for the workload identity you want to delete.
  3. Click Delete on the confirmation prompt.
warning

Deleting a workload identity is permanent. Any service that relies on the workload's client credentials can no longer authenticate.

Next steps​