Manage Service Accounts for Beatbox

Configure Service Accounts

Define service accounts under mc.flow-server.security.users in config/utilihive-flow-server-override.properties. Use the entry name as the username. Set .credentials for basic authentication or .apiKey for API key authentication. Passwords and API keys must be BCrypt hashes. Give each account a unique name.

Each Beatbox also has a predefined service account <CONNECT_OWNER_ID>-poller for flows that poll external systems and for flows that an internal processor triggers, such as scheduled execution. The poller account does not need credentials. To grant it flow access, use one of the methods in Grant Flow Access.

Basic Authentication

With basic authentication, the username is the service account name, and the password is the plain-text password that matches the BCrypt-encoded value.

mc.flow-server.security.users.<service-account>.credentials=<bcryptEncodedPassword>

API Key Authentication

Send the API key in the x-api-key header. The key identifies the configured service account, so the request needs no username.

mc.flow-server.security.users.<service-account>.apiKey=<bcryptEncodedApiKey>

BCrypt Encoding of Passwords and API Keys

Use only ASCII characters in the password or API key. Non-ASCII characters do not work correctly.

To generate a BCrypt-encoded password or API key, use the following command. Replace <passphrase> with the password or API key to encode.

docker run --rm httpd:alpine \
  sh -c 'htpasswd -nbBC 10 "" "<passphrase>"' | sed 's/\$2y\$/\$2a\$/' | tr -d ':\n'

Replace 10 with your chosen cost factor. Use a cost factor of 10 or 12.

Grant Flow Access

In the Beatbox Configuration

Use this option to manage flow access in the Beatbox instance configuration. It works whether or not the SDK deployment bundle also defines flow access. Add resourceAccesses under the service account in config/utilihive-flow-server-override.properties. Set it to a comma-separated list of flow IDs or regular expressions. Each pattern must match the full flow ID. For example, my-.*-flow matches flow IDs beginning with my- and ending with -flow. Use .* to grant access to all flows. Give each account access to only the flows it needs.

To configure additional access for the predefined poller account, add a resourceAccesses property under its name. Replace gridos in this example with the Beatbox’s CONNECT_OWNER_ID:

mc.flow-server.security.users.gridos-poller.resourceAccesses=my-scheduled-flow

In the SDK Deployment Bundle

Define flow access in the SDK deployment bundle, alongside the flows you deploy. This is the recommended method for the predefined poller account and for other service accounts whose names you know in advance. Put flow-access.properties under deployment/<ownerId>/<environment>/ in the bundle. When you deploy the bundle, the Beatbox reads the file and grants access to the listed accounts.

Each property key must be an existing Connect Service Account username. Its value is a comma-separated list of flow IDs.

Example flow-access.properties:

myServiceAccount=my-flow-id, my-other-flow-id

For the file location, deployment behavior, and more details, see Flow Access Properties.

You can use both methods together. flow-access.properties defines flow access in the SDK deployment bundle, and resourceAccesses in the instance configuration can define additional flow access.