Workload Identity Federation
āUnsolvedāQuestionāFeature Request
Does Zitadel support some kind of workload identity federation for service accounts? The main use case is avoiding the deployment of long lived private keys and instead relying on a JWT token signed by the infrastructure provider (where the keys can be discovered via the OIDC metadata endpoint). It limits the impact of an infra compromise since all credentials used are ephemeral and can be rotated automatically.
At first glance it would be very similar to authenticating with Private Key JWT, with the exception of needing some way to validate claims (and perhaps be a tad more flexible on the structure of accepted tokens).
At first glance it would be very similar to authenticating with Private Key JWT, with the exception of needing some way to validate claims (and perhaps be a tad more flexible on the structure of accepted tokens).
