New-ZrServiceAccount
Creates a passwordless machine identity (a non-interactive service account) and returns a self-contained bearer token for an application to authenticate with.
Syntax
New-ZrServiceAccount
-Name <string>
[-Role <string>]
[-Scope <string>]
[-LifetimeMinutes <int>]
[-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
[-WhatIf] [-Confirm]
Description
New-ZrServiceAccount creates a service account — a non-interactive identity with no password — on every connected manager and returns a self-contained bearer token an application uses to authenticate to the store. Optionally grants a role at a scope and bounds the token lifetime with -LifetimeMinutes. Requires a connected manager (an active workspace or explicit -Managers) and an admin token. The returned token is shown once, so capture it for the application (it renews via ZarisRenewingTokenProvider). See Authentication & tokens for how applications present tokens.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
-Name | string | Yes | The name of the service account (machine identity) to create. Position 0. |
-Role | string | No | An optional role to grant to the service account. |
-Scope | string | No | The scope at which the optional role is granted; defaults to the root scope when omitted. |
-LifetimeMinutes | int | No | The lifetime, in minutes, of the returned application token; when omitted the server default applies. |
-Managers | string[] | No | Management Service endpoints to target; when omitted the active workspace's managers are used. |
-Port | int | No | Management Service port for bare-host managers. Default 7801. |
-Token | string | No | Admin bearer token for authenticated control-plane calls. |
-TimeoutSec | int | No | Per-request timeout in seconds. Default 30. |
Supports -WhatIf and -Confirm.
Examples
Create the orders-svc machine identity with DataWriter on the orders store and print its application token.
New-ZrServiceAccount -Name orders-svc -Role DataWriter -Scope zaris:store:orders
Same as above, but issue a token that expires after 24 hours (1440 minutes).
New-ZrServiceAccount -Name orders-svc -Role DataWriter -Scope zaris:store:orders -LifetimeMinutes 1440