Skip to content

Feature: Composite Identity for Service Accounts

Release notes

AI agent use cases require mirroring the authorization and user permissions based on the user who initiated the task within GitLab, while simultaneously showing a distinct identity separate from the initiating user. Previously, agentic workflows within the GitLab platform are not supported by the current GitLab permission and authentication models. Service accounts can support some tasks, although without the attached user identity.

Now, with Composite Identity for Service Accounts, we have extended the authorization and authentication mechanisms. Composite Identity includes the user identity via dynamic token scopes where the GitLab user id is embedded within the Service Account token. This new method ensures traceability and fully supported actions as granted by the GitLab user's permissions.

For more information about how Compositie Identity for Service Accounts can be used, see our [documentation]().

Overview

Actions taken on the GitLab platform by AI Agents require special authentication and authorization considerations. It is important that AI Agents are able to mirror their authorization abilities to the authorization abilities of the user who initiated the action. At the same time, the activities of the Agent must be easily identified as not being the same as the activities of a human user.

For example, when a GitLab user requests that an AI agent writes tests for a bit of code:

  1. The GitLab user must have access to the project that the code is attached to
  2. It should be clear that the tests were written by an Agent
  3. It should be clear that the GitLab user made the request to the Agent

To solve the above set of requirements, we must extend the existing authentication/authorization features of GitLab. We have the concept of a machine user: a service account. But there is no way to attach a human user identity to this Service Account or its tokens.

The solution to this problem is Composite Identity.

To create composite identities, we will leverage the concept of a dynamic scope.

The AI Agent will authenticate all requests using Service account tokens. The id of the GitLab user who initiates the AI Agent request will be embedded in the token scopes via the dynamic scope feature. Using this dynamic scope, we will be able to:

  • Clearly identify AI Agent activities (author will be a designated Duo service account)
  • Tie actions taken by the Service Account to a GitLab user for auditing purposes
  • Ensure that authorization checks for Service Account activities also look at the GitLab user's permissions

References

Edited by Jackie Porter