Description

This is issue is targeting on providing the guidance for the feature of Service Accounts and On Behalf Of Authentication. General design details from internal threat model document can be transferred to here as the guidance for documentation work on our doc website. So, let's using the comment section of this issue to capture all these informations with all the latest design changes.

Exit Criteria

Having the following portions of guidance:

On Behalf Of Authentication:

• Introduction / General design of OBO (including the general designs, and some naming conventions)
• Setup and Configuration for generic usage of OBO (including the security config, endpoint setup, and required permissions)
• Extension related usage of OBO (including the risks)

Service Account

• Introduction Service Account - what are they for?
• When should you use a service account vs another method?
• What is unique about service accounts, You can deactivate them, why and how?

References

1. Original meta issue of OBO: [META] On-Behalf-Of Authentication #2573
2. Original meta issue of Service Accounts: [META] Service Accounts #2944