authorize: add support for service accounts (#1374)

authorize/evaluator/evaluator.go

@@ -30,10 +30,11 @@ import (
 )
 
 const (
+	directoryGroupTypeURL = "type.googleapis.com/directory.Group"
+	directoryUserTypeURL  = "type.googleapis.com/directory.User"
+	serviceAccountTypeURL = "type.googleapis.com/user.ServiceAccount"
 	sessionTypeURL        = "type.googleapis.com/session.Session"
 	userTypeURL           = "type.googleapis.com/user.User"
-	directoryUserTypeURL  = "type.googleapis.com/directory.User"
-	directoryGroupTypeURL = "type.googleapis.com/directory.Group"
 )
 
 // Evaluator specifies the interface for a policy engine.
@@ -282,6 +283,9 @@ type dataBrokerDataInput struct {
 func (e *Evaluator) newInput(req *Request, isValidClientCertificate bool) *input {
 	i := new(input)
 	i.DataBrokerData.Session = req.DataBrokerData.Get(sessionTypeURL, req.Session.ID)
+	if i.DataBrokerData.Session == nil {
+		i.DataBrokerData.Session = req.DataBrokerData.Get(serviceAccountTypeURL, req.Session.ID)
+	}
 	if obj, ok := i.DataBrokerData.Session.(interface{ GetUserId() string }); ok {
 		i.DataBrokerData.User = req.DataBrokerData.Get(userTypeURL, obj.GetUserId())
 

authorize/grpc.go

@@ -8,7 +8,6 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/golang/protobuf/ptypes"
 	"github.com/rs/zerolog"
 
 	"github.com/pomerium/pomerium/authorize/evaluator"
@@ -27,15 +26,11 @@ import (
 	envoy_service_auth_v2 "github.com/envoyproxy/go-control-plane/envoy/service/auth/v2"
 )
 
-var sessionTypeURL, userTypeURL string
+const (
-
+	serviceAccountTypeURL = "type.googleapis.com/user.ServiceAccount"
-func init() {
+	sessionTypeURL        = "type.googleapis.com/session.Session"
-	any, _ := ptypes.MarshalAny(new(session.Session))
+	userTypeURL           = "type.googleapis.com/user.User"
-	sessionTypeURL = any.GetTypeUrl()
+)
-
-	any, _ = ptypes.MarshalAny(new(user.User))
-	userTypeURL = any.GetTypeUrl()
-}
 
 // Check implements the envoy auth server gRPC endpoint.
 func (a *Authorize) Check(ctx context.Context, in *envoy_service_auth_v2.CheckRequest) (*envoy_service_auth_v2.CheckResponse, error) {
@@ -92,7 +87,7 @@ func (a *Authorize) forceSync(ctx context.Context, ss *sessions.State) error {
 	return nil
 }
 
-func (a *Authorize) forceSyncSession(ctx context.Context, sessionID string) *session.Session {
+func (a *Authorize) forceSyncSession(ctx context.Context, sessionID string) interface{ GetUserId() string } {
 	ctx, span := trace.StartSpan(ctx, "authorize.forceSyncSession")
 	defer span.End()
 
@@ -105,6 +100,13 @@ func (a *Authorize) forceSyncSession(ctx context.Context, sessionID string) *ses
 		return s
 	}
 
+	a.dataBrokerDataLock.RLock()
+	sa, ok := a.dataBrokerData.Get(serviceAccountTypeURL, sessionID).(*user.ServiceAccount)
+	a.dataBrokerDataLock.RUnlock()
+	if ok {
+		return sa
+	}
+
 	res, err := state.dataBrokerClient.Get(ctx, &databroker.GetRequest{
 		Type: sessionTypeURL,
 		Id:   sessionID,

cmd/pomerium-cli/cli.go

@@ -2,16 +2,25 @@ package main
 
 import (
 	"bufio"
+	"context"
 	"errors"
 	"fmt"
+	"net/url"
 	"os"
 	"strings"
 	"time"
 
+	"github.com/google/uuid"
+	"github.com/rs/zerolog"
 	"github.com/spf13/cobra"
+	"google.golang.org/protobuf/types/known/timestamppb"
 	"gopkg.in/square/go-jose.v2/jwt"
 
 	"github.com/pomerium/pomerium/internal/encoding/jws"
+	"github.com/pomerium/pomerium/internal/log"
+	"github.com/pomerium/pomerium/pkg/grpc"
+	"github.com/pomerium/pomerium/pkg/grpc/databroker"
+	"github.com/pomerium/pomerium/pkg/grpc/user"
 )
 
 type stringSlice []string
@@ -46,11 +55,15 @@ type serviceAccount struct {
 }
 
 var serviceAccountOptions struct {
-	aud               stringSlice
+	aud                     stringSlice
-	groups            stringSlice
+	groups                  stringSlice
-	impersonateGroups stringSlice
+	impersonateGroups       stringSlice
-	expiry            time.Duration
+	expiry                  time.Duration
-	serviceAccount    serviceAccount
+	serviceAccount          serviceAccount
+	dataBrokerURL           string
+	overrideCertificateName string
+	ca                      string
+	caFile                  string
 }
 
 func init() {
@@ -64,6 +77,10 @@ func init() {
 	flags.Var(&serviceAccountOptions.groups, "groups", "Groups (e.g. admins@pomerium.io,users@pomerium.io)")
 	flags.Var(&serviceAccountOptions.impersonateGroups, "impersonate_groups", "Impersonation Groups (optional)")
 	flags.DurationVar(&serviceAccountOptions.expiry, "expiry", time.Hour, "Expiry")
+	flags.StringVar(&serviceAccountOptions.dataBrokerURL, "databroker-url", "http://localhost:5443", "the URL of the databroker used to store service accounts")
+	flags.StringVar(&serviceAccountOptions.overrideCertificateName, "override-certificate-name", "", "override the certificate name")
+	flags.StringVar(&serviceAccountOptions.ca, "certificate-authority", "", "custom certificate authority")
+	flags.StringVar(&serviceAccountOptions.caFile, "certificate-authority-file", "", "customer certificate authority file")
 	rootCmd.AddCommand(serviceAccountCmd)
 }
 
@@ -71,6 +88,26 @@ var serviceAccountCmd = &cobra.Command{
 	Use:   "service-account",
 	Short: "generates a pomerium service account from a shared key.",
 	RunE: func(cmd *cobra.Command, args []string) error {
+		l := zerolog.Nop()
+		log.SetLogger(&l)
+
+		dataBrokerURL, err := url.Parse(serviceAccountOptions.dataBrokerURL)
+		if err != nil {
+			return fmt.Errorf("invalid databroker url: %w", err)
+		}
+
+		cc, err := grpc.GetGRPCClientConn("databroker", &grpc.Options{
+			Addr:                    dataBrokerURL,
+			OverrideCertificateName: serviceAccountOptions.overrideCertificateName,
+			CA:                      serviceAccountOptions.ca,
+			CAFile:                  serviceAccountOptions.caFile,
+			WithInsecure:            !strings.HasSuffix(dataBrokerURL.Scheme, "s"),
+		})
+		if err != nil {
+			return fmt.Errorf("error creating databroker connection: %w", err)
+		}
+		defer cc.Close()
+
 		// hydrate our session
 		serviceAccountOptions.serviceAccount.Audience = jwt.Audience(serviceAccountOptions.aud)
 		serviceAccountOptions.serviceAccount.Groups = []string(serviceAccountOptions.groups)
@@ -106,6 +143,19 @@ var serviceAccountCmd = &cobra.Command{
 		if serviceAccountOptions.serviceAccount.Issuer == "" {
 			return errors.New("iss is required")
 		}
+
+		sa := &user.ServiceAccount{
+			Id:        uuid.New().String(),
+			UserId:    serviceAccountOptions.serviceAccount.User,
+			ExpiresAt: timestamppb.New(serviceAccountOptions.serviceAccount.Expiry.Time()),
+			IssuedAt:  timestamppb.Now(),
+		}
+		_, err = user.SetServiceAccount(context.Background(), databroker.NewDataBrokerServiceClient(cc), sa)
+		if err != nil {
+			return fmt.Errorf("error saving service account: %w", err)
+		}
+		serviceAccountOptions.serviceAccount.ID = sa.GetId()
+
 		encoder, err := jws.NewHS256Signer([]byte(sharedKey), serviceAccountOptions.serviceAccount.Issuer)
 		if err != nil {
 			return fmt.Errorf("bad shared key: %w", err)

internal/databroker/server.go

@@ -390,6 +390,7 @@ func (srv *Server) getDB(recordType string, lock bool) (db storage.Backend, vers
 		if db == nil {
 			db, err = srv.newDB(recordType)
 			srv.byType[recordType] = db
+			defer srv.onTypechange.Broadcast()
 		}
 		if lock {
 			srv.mu.Unlock()

internal/log/log.go

@@ -37,17 +37,22 @@ func init() {
 // DisableDebug tells the logger to use stdout and json output.
 func DisableDebug() {
 	l := zerolog.New(os.Stdout).With().Timestamp().Logger()
-	logger.Store(&l)
+	SetLogger(&l)
 	zapLevel.SetLevel(zapcore.InfoLevel)
 }
 
 // EnableDebug tells the logger to use stdout and pretty print output.
 func EnableDebug() {
 	l := zerolog.New(os.Stdout).With().Timestamp().Logger().Output(zerolog.ConsoleWriter{Out: os.Stdout})
-	logger.Store(&l)
+	SetLogger(&l)
 	zapLevel.SetLevel(zapcore.DebugLevel)
 }
 
+// SetLogger sets zerolog the logger.
+func SetLogger(l *zerolog.Logger) {
+	logger.Store(l)
+}
+
 // Logger returns the global logger.
 func Logger() *zerolog.Logger {
 	return logger.Load().(*zerolog.Logger)

pkg/grpc/user/user.go

@@ -50,3 +50,17 @@ func Set(ctx context.Context, client databroker.DataBrokerServiceClient, u *User
 	}
 	return res.GetRecord(), nil
 }
+
+// SetServiceAccount sets a service account in the databroker.
+func SetServiceAccount(ctx context.Context, client databroker.DataBrokerServiceClient, sa *ServiceAccount) (*databroker.Record, error) {
+	any, _ := anypb.New(sa)
+	res, err := client.Set(ctx, &databroker.SetRequest{
+		Type: any.GetTypeUrl(),
+		Id:   sa.GetId(),
+		Data: any,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error setting service account in databroker: %w", err)
+	}
+	return res.GetRecord(), nil
+}

pkg/grpc/user/user.pb.go

@@ -9,6 +9,7 @@ package user
 import (
 	proto "github.com/golang/protobuf/proto"
 	any "github.com/golang/protobuf/ptypes/any"
+	timestamp "github.com/golang/protobuf/ptypes/timestamp"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -105,30 +106,114 @@ func (x *User) GetClaims() map[string]*any.Any {
 	return nil
 }
 
+type ServiceAccount struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id        string               `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	UserId    string               `protobuf:"bytes,2,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	ExpiresAt *timestamp.Timestamp `protobuf:"bytes,3,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"`
+	IssuedAt  *timestamp.Timestamp `protobuf:"bytes,4,opt,name=issued_at,json=issuedAt,proto3" json:"issued_at,omitempty"`
+}
+
+func (x *ServiceAccount) Reset() {
+	*x = ServiceAccount{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_user_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServiceAccount) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServiceAccount) ProtoMessage() {}
+
+func (x *ServiceAccount) ProtoReflect() protoreflect.Message {
+	mi := &file_user_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServiceAccount.ProtoReflect.Descriptor instead.
+func (*ServiceAccount) Descriptor() ([]byte, []int) {
+	return file_user_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ServiceAccount) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *ServiceAccount) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+func (x *ServiceAccount) GetExpiresAt() *timestamp.Timestamp {
+	if x != nil {
+		return x.ExpiresAt
+	}
+	return nil
+}
+
+func (x *ServiceAccount) GetIssuedAt() *timestamp.Timestamp {
+	if x != nil {
+		return x.IssuedAt
+	}
+	return nil
+}
+
 var File_user_proto protoreflect.FileDescriptor
 
 var file_user_proto_rawDesc = []byte{
 	0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x04, 0x75, 0x73,
 	0x65, 0x72, 0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xdb, 0x01,
+	0x62, 0x75, 0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67,
-	0x0a, 0x04, 0x55, 0x73, 0x65, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74,
-	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xdb,
-	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
+	0x01, 0x0a, 0x04, 0x55, 0x73, 0x65, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69,
-	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
-	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x04, 0x20,
+	0x6e, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
-	0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x2e, 0x0a, 0x06, 0x63, 0x6c,
+	0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x61, 0x69, 0x6d, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x75, 0x73, 0x65,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x04,
-	0x72, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x2e, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x73, 0x45, 0x6e, 0x74,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x2e, 0x0a, 0x06, 0x63,
-	0x72, 0x79, 0x52, 0x06, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x73, 0x1a, 0x4f, 0x0a, 0x0b, 0x43, 0x6c,
+	0x6c, 0x61, 0x69, 0x6d, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x75, 0x73,
-	0x61, 0x69, 0x6d, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x65, 0x72, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x2e, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x73, 0x45, 0x6e,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2a, 0x0a, 0x05, 0x76,
+	0x74, 0x72, 0x79, 0x52, 0x06, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x73, 0x1a, 0x4f, 0x0a, 0x0b, 0x43,
-	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f,
+	0x6c, 0x61, 0x69, 0x6d, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2a, 0x0a, 0x05,
-	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x2c, 0x5a, 0x2a, 0x67,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f,
-	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e,
-	0x75, 0x6d, 0x2f, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2f, 0x70, 0x6b, 0x67, 0x2f,
+	0x79, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xad, 0x01, 0x0a,
-	0x67, 0x72, 0x70, 0x63, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x0e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12,
-	0x33,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x39, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69,
+	0x72, 0x65, 0x73, 0x5f, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54,
+	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65,
+	0x73, 0x41, 0x74, 0x12, 0x37, 0x0a, 0x09, 0x69, 0x73, 0x73, 0x75, 0x65, 0x64, 0x5f, 0x61, 0x74,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x52, 0x08, 0x69, 0x73, 0x73, 0x75, 0x65, 0x64, 0x41, 0x74, 0x42, 0x2c, 0x5a, 0x2a,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x6f, 0x6d, 0x65, 0x72,
+	0x69, 0x75, 0x6d, 0x2f, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2f, 0x70, 0x6b, 0x67,
+	0x2f, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
 }
 
 var (
@@ -143,20 +228,24 @@ func file_user_proto_rawDescGZIP() []byte {
 	return file_user_proto_rawDescData
 }
 
-var file_user_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_user_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
 var file_user_proto_goTypes = []interface{}{
-	(*User)(nil),    // 0: user.User
+	(*User)(nil),                // 0: user.User
-	nil,             // 1: user.User.ClaimsEntry
+	(*ServiceAccount)(nil),      // 1: user.ServiceAccount
-	(*any.Any)(nil), // 2: google.protobuf.Any
+	nil,                         // 2: user.User.ClaimsEntry
+	(*timestamp.Timestamp)(nil), // 3: google.protobuf.Timestamp
+	(*any.Any)(nil),             // 4: google.protobuf.Any
 }
 var file_user_proto_depIdxs = []int32{
-	1, // 0: user.User.claims:type_name -> user.User.ClaimsEntry
+	2, // 0: user.User.claims:type_name -> user.User.ClaimsEntry
-	2, // 1: user.User.ClaimsEntry.value:type_name -> google.protobuf.Any
+	3, // 1: user.ServiceAccount.expires_at:type_name -> google.protobuf.Timestamp
-	2, // [2:2] is the sub-list for method output_type
+	3, // 2: user.ServiceAccount.issued_at:type_name -> google.protobuf.Timestamp
-	2, // [2:2] is the sub-list for method input_type
+	4, // 3: user.User.ClaimsEntry.value:type_name -> google.protobuf.Any
-	2, // [2:2] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for method output_type
-	2, // [2:2] is the sub-list for extension extendee
+	4, // [4:4] is the sub-list for method input_type
-	0, // [0:2] is the sub-list for field type_name
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
 }
 
 func init() { file_user_proto_init() }
@@ -177,6 +266,18 @@ func file_user_proto_init() {
 				return nil
 			}
 		}
+		file_user_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServiceAccount); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -184,7 +285,7 @@ func file_user_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_user_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   2,
+			NumMessages:   3,
 			NumExtensions: 0,
 			NumServices:   0,
 		},

pkg/grpc/user/user.proto

@@ -4,6 +4,7 @@ package user;
 option go_package = "github.com/pomerium/pomerium/pkg/grpc/user";
 
 import "google/protobuf/any.proto";
+import "google/protobuf/timestamp.proto";
 
 message User {
   string version = 1;
@@ -12,3 +13,10 @@ message User {
   string email = 4;
   map<string, google.protobuf.Any> claims = 8;
 }
+
+message ServiceAccount {
+  string id = 1;
+  string user_id = 2;
+  google.protobuf.Timestamp expires_at = 3;
+  google.protobuf.Timestamp issued_at = 4;
+}