Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.

Service Account Configuration — Source Authentication Service Accounts

Overview​

Source accounts are the S3 credentials used by copy jobs to read from source ObjectScale devices. Each account is scoped to a specific device and namespace. The copy engine uses these credentials when connecting to the source bucket to enumerate and download objects during a sync run.

Fields​

Device — the source ObjectScale device these credentials belong to.

Namespace — the ObjectScale namespace the credentials grant access to.

Access key — the S3 access key ID for the source namespace.

Secret key — the S3 secret key (stored encrypted at rest).

How They Are Used​

Manually added accounts have no device. Their form has Account Name, Type (ECS / ObjectScale), Endpoint, Namespace (optional), Access Key ID, Secret Access Key, and Ignore SSL certificate errors (off by default).

When a copy job runs, it looks up the source account matching the job's source device and namespace. The credentials are used for all S3 read operations (ListObjects, GetObject, HeadObject) against the source bucket.

Selecting namespaces to provision​

Expand a device (View / Manage) to list every namespace on it alongside its provisioning status. The full list is fetched (all pages, including devices with 1,000 or more namespaces) and rendered in a virtualized, scrollable table so you provision only the namespaces you choose instead of all of them at once.

  • Search — filters the list by namespace name (case-insensitive substring) so you can find specific namespaces without scrolling.
  • Status filter — switch between Not provisioned (the default — the actionable set), All, and Provisioned; the count beside each label updates live.
  • Select — tick the checkbox on any un-provisioned row. Already-provisioned namespaces show a green Ready status and cannot be selected. The header checkbox selects every un-provisioned row currently in view; the Select all N matching banner selects all rows matching the current search/filter. Your selection is preserved as you change the search or filter, and the action bar always shows the true total selected.
  • Create Service Accounts (N) — creates one S3 service account per selected namespace. Selecting 50 or more shows a confirmation first. The work runs in sequential batches of 25 with a progress bar, and rows flip to Ready · NEW as each batch completes.
  • Partial failures — the result box is green only when every selected namespace got an account; if any failed it is amber ("8 of 10 account(s) provisioned · 2 failed"). Any namespace that fails stays selected with its error listed and a Retry failed button to re-run just those. Namespaces that already have an account are skipped automatically, so re-running is always safe.

This lets you provision a large estate incrementally — a few namespaces at a time — rather than committing to creating object users for every namespace in a single action.

Workflows​

Add a source account manually​

  1. Click Add Manually.
  2. Enter an Account Name and choose the Type (ECS / ObjectScale). Enter the Endpoint and, optionally, the Namespace.
  3. Enter the access key and secret key.
  4. Click Save Account. The account is listed under Manually Added Accounts.

Auto-provision service accounts​

Create Service Accounts (see Selecting namespaces to provision above) creates the source accounts for you, as long as the device's ObjectScale management credentials are configured in Setup & Settings > Storage.

Key Rotation​

Each source account row has a Rotate button (amber-bordered). Clicking it generates a brand-new S3 secret key on ObjectScale for that service account and saves the new key (AES-256 encrypted) to settings. A confirmation is asked first. ObjectScale expires the previous key about 1 minute after the rotation (the result says "old key expires in ~1 minute"), so nothing has to be cleaned up on ObjectScale.

A Rotate All Keys (N) button appears below the namespace table when at least one source account is listed. It rotates every account on that device in a single operation, which is useful after a device-wide credential event.

When to rotate a source key​

  • A key has stopped working (e.g. the key was invalidated by an ObjectScale password change, a system restore, or manual deletion on ObjectScale).
  • You suspect a key has been compromised and want to issue a fresh credential without fully reprovisioning the account.
  • After restoring settings from a backup that contained a stale secret key.

Effect on running jobs​

Copy jobs that are already in progress keep the key they started with. Once ObjectScale expires the old key (about a minute after the rotation) they can fail with authentication errors on their remaining objects. The next job start picks up the new key automatically — rotate when no large copy job is running, or re-run the affected job afterwards.

ObjectScale key limit​

ObjectScale enforces a maximum of 2 active secret keys per user. Because each rotation lets the old key expire after about a minute, repeated rotations don't fill the slots. If both slots were already occupied by keys created outside the console, delete one of them in the ObjectScale management console first, otherwise the rotate call fails.

Tips​

  • One source account per namespace is required. If a job's source namespace has no matching account, the job will fail at startup with an authentication error.
  • Credentials are masked in the UI after saving. Use the eye icon to reveal them when troubleshooting.