From 837158e344c471508193b16527724bf75ef97ea1 Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Wed, 30 Jul 2025 11:09:16 -0700 Subject: [PATCH 1/2] improvement: reduce azure client secret token expiry to two rotation intervals --- .../azure-client-secret-rotation-fns.ts | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts b/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts index e2969ac1d..57bfb6d59 100644 --- a/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts +++ b/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts @@ -21,6 +21,8 @@ const GRAPH_API_BASE = "https://graph.microsoft.com/v1.0"; type AzureErrorResponse = { error: { message: string } }; +const EXPIRY_PADDING_IN_DAYS = 3; + const sleep = async () => new Promise((resolve) => { setTimeout(resolve, 1000); @@ -33,7 +35,8 @@ export const azureClientSecretRotationFactory: TRotationFactory< const { connection, parameters: { objectId, clientId: clientIdParam }, - secretsMapping + secretsMapping, + rotationInterval } = secretRotation; /** @@ -50,7 +53,7 @@ export const azureClientSecretRotationFactory: TRotationFactory< )}-${now.getFullYear()}`; const endDateTime = new Date(); - endDateTime.setFullYear(now.getFullYear() + 5); + endDateTime.setDate(now.getDate() + rotationInterval * 2 + EXPIRY_PADDING_IN_DAYS); // give 72 hour buffer try { const { data } = await request.post( @@ -195,6 +198,11 @@ export const azureClientSecretRotationFactory: TRotationFactory< callback ) => { const credentials = await $rotateClientSecret(); + + if (rotationInterval > 365 * 5 - EXPIRY_PADDING_IN_DAYS) { + throw new BadRequestError({ message: "Azure does not support token duration over 5 years" }); + } + return callback(credentials); }; From 691cbe0a4f6d361f6beeb2856e83c7e23f5a6cd2 Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Wed, 30 Jul 2025 11:15:10 -0700 Subject: [PATCH 2/2] fix: correct issue client secret rotation interval check --- .../azure-client-secret/azure-client-secret-rotation-fns.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts b/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts index 57bfb6d59..84fcfdd90 100644 --- a/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts +++ b/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts @@ -199,7 +199,8 @@ export const azureClientSecretRotationFactory: TRotationFactory< ) => { const credentials = await $rotateClientSecret(); - if (rotationInterval > 365 * 5 - EXPIRY_PADDING_IN_DAYS) { + // 2.5 years as expiry is set to x2 interval for the inactive period of credential + if (rotationInterval > Math.floor(365 * 2.5) - EXPIRY_PADDING_IN_DAYS) { throw new BadRequestError({ message: "Azure does not support token duration over 5 years" }); }