Target Authentication Service Account Ownership
Overview
This tab shows which entity currently owns service account operations for each vault ObjectScale storage device. The owner is either the console or a vault agent.
Ownership determines who may provision, rotate, and manage the service account credentials that the copy engine uses to authenticate against vault-side targets.
Why Ownership Matters
When a vault agent operates in vault mode and owns a device:
- The console cannot provision or rotate service account keys for that device.
- All credential operations must be performed by the vault agent inside the vault network.
This enforces the air-gap principle. The vault-side agent handles its own authentication material for these operations.
When the console owns a device:
- The console can provision and rotate service account keys normally through Setup & Settings.
- No vault agent is active for that device.
Reading the Cards
Each vault ObjectScale device appears as a card.
| Element | Meaning |
|---|---|
| Console Owned badge (green) | The console manages service accounts for this device. |
| Agent Owned badge (blue) | A vault agent has claimed ownership. Console operations are blocked. |
| Agent name and owned-since timestamp | Which vault agent owns the device and when it took ownership. |
| Protection Groups | Sync groups that reference this device. |
| Service Accounts section | Individual service account rows, shown when the agent owns the device. |
Service Account Rows
When the device is agent-owned, each provisioned service account appears as a row inside the device card.
| Element | Description |
|---|---|
| Account name | The human-readable account name. |
| Access key | The ObjectScale username or access key ID. Always visible. |
| Eye button (👁) | Click to reveal the decrypted secret key on demand. Click again to hide it. |
| Key rotation status badge | The current rotation lifecycle state. See Key Rotation Status Badges. |
| Last rotated | Timestamp of the most recent successful rotation. |
Revealing Secrets
Clicking the eye button calls the backend to decrypt and return the secret key for that account only. The secret is never included in the normal page load. It is fetched on demand.
The revealed key appears below the access key in a selectable monospace field so that you can copy it.
Old vs New Key Comparison
If the account has been rotated at least once and the previous key is stored, the eye button also reveals a Prev key field with an amber background, next to the current secret.
You can compare the old and new secrets side by side. This helps you confirm that a rotation completed, and identify which key is in use on existing connections.
After a rollback, the previous and current keys swap, so the comparison stays meaningful.
Key Rotation
Old Key Expiry (hours)
Before you rotate, set the Old key expiry field in the Service Accounts section header. The default is 24 hours.
This field controls how long ObjectScale keeps the displaced key active after rotation. During the expiry window:
- The previous key is still valid on ObjectScale.
- Copy jobs that started before the rotation keep working.
- Rollback needs no ObjectScale API call.
After the window closes, ObjectScale automatically deletes the old key.
The value applies to both Rotate Key and Rotate All Keys in the same device card. You can reduce it, for example to 1 hour, for faster cleanup. You can increase it, up to 168 hours (7 days), for a longer safety net. A 24-hour window gives enough time to detect problems and roll back.
Choose the Old key expiry carefully. A copy job keeps the key it started with. A rotation runs at the vault agent's next heartbeat, even while a sync is running.
Any job still copying when the old key expires fails on its remaining objects (HTTP 403). Its change windows are then retried with the new key, like any failure.
Keep the Old key expiry at least as long as the Sync Time Limit (Vault Data Sync Dashboard > Settings, default 24 hours). The default 24-hour expiry matches it.
Rotate Key (per account)
This action queues a KEY_ROTATION_REQUEST message through the Quantum Trust Protocol for a single service account.
The vault agent runs the rotation at the end of its next heartbeat, also while a protection group sync is running. It uses the current Old key expiry setting. The agent itself performs the ObjectScale-side key creation, replacement, and old-key cleanup if configured. There is no separate KEY_ROTATION_CLEANUP QTD message.
Prerequisite: ObjectScale management credentials must be synced to the vault agent. The button is disabled until credentials are delivered.
Rotate All Keys
This action queues rotation for all service accounts on the device in a single operation. All accounts in the batch use the Old key expiry window currently set in the header.
Key Rotation Status Badges
| Badge | Meaning |
|---|---|
| Rotation Queued | The request was created. The agent has not yet confirmed receipt. |
| Rotation Pending | The agent received the request and is preparing to run it. |
| Rotation Success | The rotation completed and the new key is active. |
| Rotation Failed | The agent reported an error. See the Quantum Trust Protocol Audit Log tab for details. |
| Rolled Back | The previous key was restored with the Rollback action. |
After you click Rotate Key, the badge shows Rotation Queued immediately. It then changes automatically as the agent reports progress on later heartbeats.
Rollback
If a rotation completed and the previous key is stored, a Rollback button appears. Clicking it swaps the current and previous keys back.
Both keys remain live on ObjectScale within the expiry window, so existing connections that use the old key continue to work immediately. The badge shows Rolled Back after a successful rollback.
Rollback window: Rollback is effective only while the old key is still live on ObjectScale, which is within the Old key expiry hours set at rotation time.
After ObjectScale expires the old key, the Rollback button still appears while the previous key is stored. Authenticating with the old key fails on ObjectScale. Act within the expiry window if you need to roll back.
Returning Ownership to the Console
To let the console manage service accounts again, the owning vault agent must exit vault mode. In the Operational Mode panel of the Vault Data Sync Dashboard tab, use Exit Vault Mode. This returns target authentication ownership to the console for all devices owned by that agent.
Until vault mode is exited, the console blocks service account provisioning and key rotation for agent-owned devices. This prevents credential conflicts.
Troubleshooting
For target authentication problems, see the Vault agents and target authentication section of the Troubleshooting page.