Service Account Configuration — Target Authentication Service Accounts
Overview
Target accounts are the S3 credentials that copy jobs use to write to vault-side ObjectScale devices. Each account is scoped to a specific vault device and namespace.
The copy engine uses these credentials when it uploads objects to the vault during a sync run. You can rotate keys directly from this tab.
Fields
| Field | Description |
|---|---|
| Vault device | The target ObjectScale vault device these credentials belong to. |
| Namespace | The ObjectScale namespace on the vault device that the credentials grant write access to. |
| Access key | The S3 access key ID for the vault namespace. |
| S3 Endpoint | The stored S3 data endpoint (host and port, for example https://vault-ecs.example.com:9021) that the copy engine connects to for this account. |
| Secret key | The S3 secret key. It is stored encrypted at rest. |
The S3 Endpoint is set at provisioning time from the vault device's Data Access IP or DNS Name (Setup & Settings > Storage, Data Access section). If this column shows the wrong host, the vault device's Data Access IP or DNS Name was corrected after initial provisioning. See Stale endpoints.
Manually added accounts
Manually added accounts have no vault device. Their form has these fields:
| Field | Description |
|---|---|
| Account Name | A name for the account. |
| Type | ECS / ObjectScale. |
| Endpoint | The S3 endpoint. |
| Region | The region. |
| Access Key ID | The S3 access key ID. |
| Secret Access Key | The S3 secret key. |
| Ignore SSL certificate errors | Off by default. |
How They Are Used
When a copy job runs, it looks up the target account that matches the job's target device and namespace. The job uses the credentials for all S3 write operations against the vault bucket (PutObject, CopyObject, and CreateMultipartUpload).
Selecting namespaces to provision
Expand a reachable vault device (View / Manage) to list every namespace on it with its provisioning status. The full list is fetched across all pages, so devices with 1,000 or more namespaces are shown completely. The list appears in a scrollable table.
You provision only the namespaces you choose, instead of all of them at once. This lets you provision a large vault estate incrementally rather than creating object users for every namespace at once.
Namespace selection is available only when the device is reachable. See Vault Reachability Check.
| Control | Description |
|---|---|
| Search | Filters the list by namespace name (case-insensitive substring). |
| Status filter | Switches between Not provisioned (the default), All, and Provisioned. The count beside each label updates live. |
| Select | Select the checkbox on any unprovisioned row. Provisioned namespaces show a green Ready status and cannot be selected. The header checkbox selects every unprovisioned row in view. The Select all N matching banner selects all rows that match the current search and filter. The selection is kept when you change the search or filter. |
| S3 Endpoint | Each provisioned row shows the stored S3 data endpoint. See Fields and Stale endpoints. |
| Create Service Accounts (N) | Creates one vault S3 service account for each selected namespace. |
Create Service Accounts
If you select 50 or more namespaces, a confirmation appears first. The work runs in sequential batches of 25 with a progress bar. Each row changes to Ready · NEW as its batch completes.
Partial failures
The result box is green only when every selected namespace got an account. If any failed, it is amber, for example "8 of 10 account(s) provisioned · 2 failed".
A namespace that fails stays selected with its error listed. Click Retry failed to re-run only those namespaces. Namespaces that already have an account are skipped automatically, so re-running is always safe.
Workflows
Add a target account manually
- Click Add Manually.
- Enter an Account Name.
- Choose the Type (ECS / ObjectScale).
- Enter the Endpoint.
- Enter the Region.
- Enter the access key and secret key.
- Click Save Account.
The account is listed under Manually Added Accounts.
Auto-provision service accounts
Create Service Accounts creates the target accounts for you. See Selecting namespaces to provision. The vault device's management credentials must be configured in Setup & Settings > Storage.
Key Rotation
Each target account row has an amber-bordered Rotate button. Click it to generate a new S3 secret key on ObjectScale for that vault service account. The new key is saved to settings with AES-256 encryption. A confirmation prompt appears first.
ObjectScale expires the previous key about 1 minute after the rotation. The result says "old key expires in ~1 minute". Nothing has to be cleaned up on ObjectScale.
A Rotate All Keys (N) button appears below the namespace table when at least one target account is listed. It rotates every account on that vault device in one operation. This is useful after a device-wide credential event.
While Vault Mode is active, the vault network is air-gapped. Rotate Key and Reveal Key are disabled here, and service account names are shown for reference only. Key rotation then runs through the vault agent. See Vault Operations > Target Auth Service Accounts.
When to rotate a target key
Rotate a target key in these cases:
- A key has stopped working. For example, the key was invalidated by an ObjectScale password change, a system restore, or manual deletion on ObjectScale.
- You suspect a key has been compromised and want to issue a fresh credential without fully provisioning the account again.
- You restored settings from a backup that contained a stale secret key.
Effect on running jobs
Copy jobs that are already in progress keep the key they started with. After ObjectScale expires the old key, about a minute after the rotation, these jobs can fail with authentication errors on their remaining objects.
The next job start picks up the new key automatically. Rotate when no large copy job is running, or re-run the affected job afterward.
ObjectScale key limit
ObjectScale enforces a maximum of 2 active secret keys per user. Each rotation lets the old key expire after about a minute, so repeated rotations do not fill the slots.
If both slots are already occupied by keys created outside the console, delete one of them in the ObjectScale management console first. Otherwise the rotate call fails.
Vault Reachability Check
When the Target Authentication tab opens, the console automatically tests connectivity to each vault device's management API (port 4443). This runs in the background while your stored credentials load. Stored account data is always shown immediately, whether or not the device is reachable.
| State | Meaning |
|---|---|
| Checking… (gray spinner) | The reachability ping is still in progress. The namespace scan has not started yet. |
| Reachable (green dot) | The console logged in to the ObjectScale management API. It scans namespaces and service accounts live, then shows the full coverage table with provision and rotate actions enabled. |
| Not reachable (amber dot) | The console could not reach the device's management API. An amber warning banner is shown in the expanded panel. Your stored credentials (access key IDs and namespace assignments) are shown in a read-only table. Provision and rotate actions are not available until the device is reachable. |
This prevents the tab from hanging or showing confusing errors when a vault device is offline or the network path to its management port (4443) is unavailable.
To re-check reachability after a device comes back online, click Refresh in the tab header. This resets all reachability state and re-runs the pings.
Stale endpoints
If you correct the vault device's Data Access IP or DNS Name in Setup & Settings > Storage after accounts were provisioned, the stored endpoint in each target account is updated automatically the next time settings are saved. This applies only when the account's endpoint still matches the old device endpoint. Accounts with a custom endpoint that differs from the device default are left untouched.
Diagnose a 403 error
A copy job can fail with 403 — The Access Key ID you provided does not exist in our records. To diagnose it:
- Open the Target Authentication Service Accounts tab and expand the affected vault device.
- Check the S3 Endpoint column. If it shows the source ObjectScale address instead of the vault ObjectScale address, the endpoint was captured incorrectly at provisioning time. This is common after a device misconfiguration.
- Correct the vault device's Data Access IP or DNS Name in Setup & Settings > Storage, then save. The endpoint is propagated automatically to all linked target accounts when you save.
- Re-run the copy job.
If accounts still show the wrong endpoint after you save, rotate the service account keys and provision the accounts again to force a full refresh.
Tips
The vault target account must have write permissions on the target namespace. Read-only credentials cause jobs to fail at the first PutObject call.
You need one target account for each vault device and namespace combination. Multiple job configurations that target the same vault namespace share the same target account.
Check the S3 Endpoint column to confirm each account points at the correct vault ObjectScale cluster before you run copy jobs. A stale endpoint that points at the source ObjectScale causes 403 errors that are otherwise difficult to diagnose.