mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-08 22:28:15 +00:00
Merge branch 'main' into feat/redis-sentinel-support
This commit is contained in:
Maidul Islam
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Available"
|
||||
openapi: "GET /api/v1/app-connections/1password/available"
|
||||
---
|
||||
@@ -0,0 +1,8 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/app-connections/1password"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [1Password Connections](/integrations/app-connections/1password) to learn how to obtain the required credentials.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/app-connections/1password/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/app-connections/1password/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/app-connections/1password/connection-name/{connectionName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/app-connections/1password"
|
||||
---
|
||||
@@ -0,0 +1,8 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/app-connections/1password/{connectionId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [1Password Connections](/integrations/app-connections/1password) to learn how to obtain the required credentials.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/pki/ca/acme"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/pki/ca/acme/{caName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/pki/ca/acme"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Read"
|
||||
openapi: "GET /api/v1/pki/ca/acme/{caName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/pki/ca/acme/{caName}"
|
||||
---
|
||||
@@ -1,4 +1,8 @@
|
||||
---
|
||||
title: "Create"
|
||||
title: "Create (Deprecated)"
|
||||
openapi: "POST /api/v1/pki/ca"
|
||||
---
|
||||
|
||||
<Note>
|
||||
This endpoint is deprecated. Please use the internal CA endpoint [here](/api-reference/endpoints/certificate-authorities/internal/create).
|
||||
</Note>
|
||||
@@ -1,4 +1,8 @@
|
||||
---
|
||||
title: "Delete"
|
||||
title: "Delete (Deprecated)"
|
||||
openapi: "DELETE /api/v1/pki/ca/{caId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
This endpoint is deprecated. Please use the internal CA endpoint [here](/api-reference/endpoints/certificate-authorities/internal/delete).
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/pki/ca/internal"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/pki/ca/internal/{caName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/pki/ca/internal"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Read"
|
||||
openapi: "GET /api/v1/pki/ca/internal/{caName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/pki/ca/internal/{caName}"
|
||||
---
|
||||
@@ -1,4 +1,8 @@
|
||||
---
|
||||
title: "List"
|
||||
title: "List (Deprecated)"
|
||||
openapi: "GET /api/v2/workspace/{slug}/cas"
|
||||
---
|
||||
|
||||
<Note>
|
||||
This endpoint is deprecated. Please use the internal CA endpoint [here](/api-reference/endpoints/certificate-authorities/internal/list).
|
||||
</Note>
|
||||
@@ -1,4 +1,8 @@
|
||||
---
|
||||
title: "Retrieve"
|
||||
title: "Retrieve (Deprecated)"
|
||||
openapi: "GET /api/v1/pki/ca/{caId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
This endpoint is deprecated. Please use the internal CA endpoint [here](/api-reference/endpoints/certificate-authorities/internal/read).
|
||||
</Note>
|
||||
@@ -1,4 +1,8 @@
|
||||
---
|
||||
title: "Update"
|
||||
title: "Update (Deprecated)"
|
||||
openapi: "PATCH /api/v1/pki/ca/{caId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
This endpoint is deprecated. Please use the internal CA endpoint [here](/api-reference/endpoints/certificate-authorities/internal/update).
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Retrieve latest certificate bundle"
|
||||
openapi: "GET /api/v1/pki/subscribers/{subscriberName}/latest-certificate-bundle"
|
||||
---
|
||||
@@ -1,4 +1,4 @@
|
||||
---
|
||||
title: "Issue Certificate"
|
||||
openapi: "POST /api/v1/pki/subscribers/{subscriberName}/issue-cert"
|
||||
openapi: "POST /api/v1/pki/subscribers/{subscriberName}/issue-certificate"
|
||||
---
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Order Certificate"
|
||||
openapi: "POST /api/v1/pki/subscribers/{subscriberName}/order-certificate"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/secret-syncs/1password"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/secret-syncs/1password/{syncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/secret-syncs/1password/{syncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/secret-syncs/1password/sync-name/{syncName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Import Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/1password/{syncId}/import-secrets"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/secret-syncs/1password"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Remove Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/1password/{syncId}/remove-secrets"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Sync Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/1password/{syncId}/sync-secrets"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/secret-syncs/1password/{syncId}"
|
||||
---
|
||||
@@ -3,10 +3,10 @@ title: "Access Requests"
|
||||
description: "Learn how to request access to sensitive resources in Infisical."
|
||||
---
|
||||
|
||||
In certain situations, developers need to expand their access to a certain new project or a sensitive environment. For those use cases, it is helpful to utilize Infisical's **Access Requests** functionality.
|
||||
In certain situations, developers need to expand their access to a certain new project or a sensitive environment. For those use cases, it is helpful to utilize Infisical's **Access Requests** functionality.
|
||||
|
||||
This functionality works in the following way:
|
||||
1. A project administrator sets up an access policy that assigns access managers (also known as eligible approvers) to a certain sensitive folder or environment.
|
||||
This functionality works in the following way:
|
||||
1. A project administrator sets up an access policy that assigns access managers (also known as eligible approvers) to a certain sensitive folder or environment.
|
||||
|
||||
|
||||
|
||||
@@ -19,9 +19,8 @@ This functionality works in the following way:
|
||||
|
||||
|
||||
<Info>
|
||||
If the access request matches with a policy that has a **Soft** enforcement level, the requester may bypass the policy and get access to the resource without full approval.
|
||||
If the access request matches with a policy that allows break-glass approval bypasses, the requester may bypass the policy and get access to the resource without full approval.
|
||||
</Info>
|
||||
|
||||
5. As soon as the request is approved, developer is able to access the sought resources.
|
||||
5. As soon as the request is approved, developer is able to access the sought resources.
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,299 @@
|
||||
---
|
||||
title: "Certificates with ACME CA"
|
||||
description: "Learn how to automatically provision and manage TLS certificates using ACME Certificate Authorities like Let's Encrypt with Infisical PKI"
|
||||
---
|
||||
|
||||
## Concept
|
||||
|
||||
The Infisical ACME integration allows you to connect with ACME (Automatic Certificate Management Environment) Certificate Authorities to automatically issue and manage publicly trusted TLS certificates for your [subscribers](/documentation/platform/pki/subscribers). This integration enables you to leverage established public CA infrastructure like Let's Encrypt while centralizing your certificate management within Infisical.
|
||||
|
||||
ACME is a protocol that automates the process of certificate issuance and renewal through domain validation challenges. The integration is perfect for obtaining trusted X.509 certificates for public-facing services and is capable of automatically renewing certificates as needed.
|
||||
|
||||
<div align="center">
|
||||
|
||||
```mermaid
|
||||
graph TD
|
||||
A[ACME CA Provider<br>e.g., Let's Encrypt] <-->|ACME v2 Protocol| B[Infisical]
|
||||
B -->|Creates TXT Records<br>via Route53| C[DNS Validation]
|
||||
B -->|Manages Certificates| D[Subscribers]
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
As part of the workflow, you configure DNS provider credentials, register an ACME CA provider with Infisical, and create subscribers to represent the certificates you wish to issue. Each issued certificate is automatically managed through its lifecycle, including renewal before expiration.
|
||||
|
||||
We recommend reading about [ACME protocol](https://tools.ietf.org/html/rfc8555) and [DNS-01 challenges](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge) for a fuller understanding of the underlying technology.
|
||||
|
||||
## Workflow
|
||||
|
||||
A typical workflow for using Infisical with ACME Certificate Authorities consists of the following steps:
|
||||
|
||||
1. Setting up AWS Route53 credentials with appropriate DNS permissions.
|
||||
2. Creating an AWS connection in Infisical to store the Route53 credentials.
|
||||
3. Registering an ACME Certificate Authority (like Let's Encrypt) with Infisical.
|
||||
4. Creating subscribers that use the ACME CA as their issuing authority.
|
||||
5. Managing certificate lifecycle events such as issuance, renewal, and revocation through Infisical.
|
||||
|
||||
## Understanding ACME DNS-01 Challenge
|
||||
|
||||
The DNS-01 challenge is the method used by ACME CA providers to verify that you control a domain before issuing a certificate. Here's how Infisical handles this process:
|
||||
|
||||
1. **Challenge Request**: When you request a certificate, the ACME provider (like Let's Encrypt) issues a challenge token.
|
||||
|
||||
2. **DNS Record Creation**: Infisical creates a TXT record at `_acme-challenge.<YOUR_DOMAIN>` with a value derived from the challenge token.
|
||||
|
||||
3. **DNS Propagation**: The TXT record must propagate through the DNS system (usually takes a few minutes, depending on TTL settings).
|
||||
|
||||
4. **Validation**: The ACME provider checks for the existence of this TXT record to verify domain control.
|
||||
|
||||
5. **Cleanup**: After validation completes successfully, Infisical automatically removes the TXT record from your DNS.
|
||||
|
||||
This automated process eliminates the need for manual intervention in domain validation, streamlining certificate issuance.
|
||||
|
||||
## Guide
|
||||
|
||||
In the following steps, we explore how to set up ACME Certificate Authority integration with Infisical using Let's Encrypt as an example.
|
||||
|
||||
<Steps>
|
||||
<Step title="Set Up AWS Connection with Required Permissions">
|
||||
Before proceeding with the ACME CA registration, you need to set up an AWS connection with the appropriate permissions for DNS validation:
|
||||
|
||||
1. Navigate to your Organization Settings > App Connections and create a new AWS connection.
|
||||
|
||||
2. Ensure your AWS connection has the following minimum permissions for Route53 DNS validation:
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": "route53:GetChange",
|
||||
"Resource": "arn:aws:route53:::change/*"
|
||||
},
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": "route53:ListHostedZonesByName",
|
||||
"Resource": "*"
|
||||
},
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"route53:ListResourceRecordSets"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID"
|
||||
]
|
||||
},
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"route53:ChangeResourceRecordSets"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID"
|
||||
],
|
||||
"Condition": {
|
||||
"ForAllValues:StringEquals": {
|
||||
"route53:ChangeResourceRecordSetsRecordTypes": [
|
||||
"TXT"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
Replace `YOUR_HOSTED_ZONE_ID` with your actual Route53 hosted zone ID.
|
||||
|
||||
For detailed instructions on setting up an AWS connection, see the [AWS Connection](/integrations/app-connections/aws) documentation.
|
||||
</Step>
|
||||
<Step title="Register ACME Certificate Authority">
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
<Steps>
|
||||
<Step title="Create ACME CA">
|
||||
To register an ACME CA, head to your Project > Internal PKI > Certificate Authorities and press the **+** button in the External Certificate Authorities section.
|
||||
|
||||
|
||||
|
||||
Fill out the details for the ACME CA registration:
|
||||
|
||||
|
||||
|
||||
Here's guidance on each field:
|
||||
|
||||
- **Type**: Select "ACME" as the External CA type.
|
||||
- **Name**: Enter a name for the ACME CA (e.g., "lets-encrypt-production").
|
||||
- **DNS App Connection**: Select from available DNS app connections or configure a new one. This connection provides Infisical with the credentials needed to create and remove DNS records for ACME validation.
|
||||
- **Hosted Zone ID**: Enter your Route53 hosted zone ID (e.g., Z04044I124N1GOOMCOYX1) for the domain(s) you'll be requesting certificates for.
|
||||
- **Directory URL**: Enter the ACME v2 directory URL for your chosen CA provider (e.g., `https://acme-v02.api.letsencrypt.org/directory` for Let's Encrypt).
|
||||
- **Account Email**: Email address to associate with your ACME account. This email will receive important notifications about your certificates.
|
||||
- **Enable Direct Issuance**: Toggle on to allow direct certificate issuance without requiring subscribers.
|
||||
|
||||
Finally, press **Create** to register the ACME CA with Infisical.
|
||||
</Step>
|
||||
<Step title="Verify ACME CA Registration">
|
||||
Once registered, your ACME CA will appear in the External Certificate Authorities section.
|
||||
|
||||
|
||||
|
||||
From here, you can:
|
||||
|
||||
- View the status of the ACME CA registration
|
||||
- Edit the configuration settings
|
||||
- Disable or re-enable the ACME CA
|
||||
- Delete the ACME CA registration if no longer needed
|
||||
|
||||
You can now use this ACME CA to issue certificates for your subscribers.
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To register an ACME CA with Infisical using the API, make a request to the Create External CA endpoint:
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl 'https://app.infisical.com/api/v1/pki/ca/acme' \
|
||||
-H 'Authorization: Bearer <your-access-token>' \
|
||||
-H 'Content-Type: application/json' \
|
||||
--data-raw '{
|
||||
"projectId": "0fccb6ee-1381-4ff1-8d5f-0cb93c6cc4d6",
|
||||
"name": "lets-encrypt-production",
|
||||
"type": "acme",
|
||||
"status": "active",
|
||||
"enableDirectIssuance": true,
|
||||
"configuration": {
|
||||
"dnsAppConnection": {
|
||||
"id": "1e5f8c0d-09d2-492c-9b28-469acd8e841b",
|
||||
"name": "acme-dns-test-connection"
|
||||
},
|
||||
"dnsProviderConfig": {
|
||||
"provider": "route53",
|
||||
"hostedZoneId": "Z040441124N1GOOMCQYX1"
|
||||
},
|
||||
"directoryUrl": "https://acme-v02.api.letsencrypt.org/directory",
|
||||
"accountEmail": "[email protected]",
|
||||
"dnsAppConnectionId": "1e5f8c0d-09d2-492c-9b28-469acd8e841b"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"id": "c48b701e-a20c-4a9a-8119-68f54e5fbb05",
|
||||
"name": "lets-encrypt-production",
|
||||
"type": "acme",
|
||||
"status": "active",
|
||||
"projectId": "0fccb6ee-1381-4ff1-8d5f-0cb93c6cc4d6",
|
||||
"enableDirectIssuance": true,
|
||||
"configuration": {
|
||||
"accountEmail": "[email protected]",
|
||||
"directoryUrl": "https://acme-v02.api.letsencrypt.org/directory",
|
||||
"dnsAppConnection": {
|
||||
"id": "1e5f8c0d-09d2-492c-9b28-469acd8e841b",
|
||||
"name": "acme-dns-test-connection"
|
||||
},
|
||||
"dnsAppConnectionId": "1e5f8c0d-09d2-492c-9b28-469acd8e841b",
|
||||
"dnsProviderConfig": {
|
||||
"provider": "route53",
|
||||
"hostedZoneId": "Z040441124N1GOOMCQYX1"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
</Step>
|
||||
<Step title="Create Subscriber for ACME CA">
|
||||
Next, create a subscriber that uses your ACME CA for certificate issuance. Navigate to your Project > Subscribers and create a new subscriber.
|
||||
|
||||
Configure the subscriber with:
|
||||
- **Issuing CA**: Select your registered ACME CA
|
||||
- **Common Name**: The domain for which you want to issue certificates (e.g., `example.com`)
|
||||
- **Alternative Names**: Additional domains to include in the certificate
|
||||
|
||||
Check out the [Subscribers](/documentation/platform/pki/subscribers) page for detailed instructions on creating and managing subscribers.
|
||||
</Step>
|
||||
<Step title="Issue Certificate">
|
||||
Once your subscriber is configured, you can issue certificates either through the Infisical UI or programmatically via the API.
|
||||
|
||||
When you request a certificate:
|
||||
1. Infisical generates a key pair for the certificate
|
||||
2. Sends a Certificate Signing Request (CSR) to the ACME CA
|
||||
3. Receives a DNS-01 challenge from the ACME provider
|
||||
4. Creates a TXT record in Route53 to satisfy the challenge
|
||||
5. Notifies the ACME provider that the challenge is ready for validation
|
||||
6. Once validated, the ACME provider issues the certificate
|
||||
7. Infisical stores and manages the certificate for your subscriber
|
||||
|
||||
The certificate will be automatically renewed before expiration according to your subscriber configuration.
|
||||
</Step>
|
||||
<Step title="Use Certificate in Your Applications">
|
||||
The issued certificate and private key are now available through Infisical and can be:
|
||||
|
||||
- Downloaded directly from the Infisical UI
|
||||
- Retrieved via the Infisical API for programmatic access using the [latest certificate bundle endpoint](/api-reference/endpoints/pki/subscribers/get-latest-cert-bundle)
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Example: Let's Encrypt Integration
|
||||
|
||||
Let's Encrypt is a free, automated, and open Certificate Authority that provides domain-validated SSL/TLS certificates. Here's how the integration works with Infisical:
|
||||
|
||||
### Production Environment
|
||||
- **Directory URL**: `https://acme-v02.api.letsencrypt.org/directory`
|
||||
- **Rate Limits**: 50 certificates per registered domain per week
|
||||
- **Certificate Validity**: 90 days with automatic renewal
|
||||
- **Trusted By**: All major browsers and operating systems
|
||||
|
||||
### Staging Environment (for testing)
|
||||
- **Directory URL**: `https://acme-staging-v02.api.letsencrypt.org/directory`
|
||||
- **Rate Limits**: Much higher limits for testing
|
||||
- **Certificate Validity**: 90 days (not trusted by browsers)
|
||||
- **Use Case**: Testing your ACME integration without hitting production rate limits
|
||||
|
||||
<Note>
|
||||
Always test your ACME integration using Let's Encrypt's staging environment first. This allows you to verify your DNS configuration and certificate issuance process without consuming your production rate limits.
|
||||
</Note>
|
||||
|
||||
## FAQ
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="What DNS validation methods are supported?">
|
||||
Currently, Infisical supports DNS-01 validation through AWS Route53. The DNS-01 challenge method is preferred for ACME integrations because it:
|
||||
|
||||
- Works with wildcard certificates
|
||||
- Doesn't require your servers to be publicly accessible
|
||||
- Can be fully automated without manual intervention
|
||||
|
||||
Support for additional DNS providers is planned for future releases.
|
||||
</Accordion>
|
||||
<Accordion title="Can I use wildcard certificates with ACME CAs?">
|
||||
Yes! ACME CAs like Let's Encrypt support wildcard certificates (e.g., `*.example.com`) when using DNS-01 validation. Simply specify the wildcard domain in your subscriber configuration.
|
||||
|
||||
Note that wildcard certificates still require DNS-01 validation - HTTP-01 validation cannot be used for wildcard certificates.
|
||||
</Accordion>
|
||||
<Accordion title="How long are ACME certificates valid?">
|
||||
Most ACME providers issue certificates with 90-day validity periods. This shorter validity period is designed to:
|
||||
|
||||
- Encourage automation of certificate management
|
||||
- Reduce the impact of compromised certificates
|
||||
- Ensure systems stay up-to-date with certificate management practices
|
||||
|
||||
When configured, Infisical automatically handles certificate renewal for subscribers.
|
||||
</Accordion>
|
||||
<Accordion title="Can I use multiple ACME providers?">
|
||||
Yes! You can register multiple ACME CAs in the same project:
|
||||
|
||||
- Different providers for different domains or use cases
|
||||
- Staging and production environments for the same provider
|
||||
- Backup providers for redundancy
|
||||
|
||||
Each subscriber can be configured to use a specific ACME CA based on your requirements.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
@@ -0,0 +1,192 @@
|
||||
---
|
||||
title: "External CA"
|
||||
sidebarTitle: "External CA"
|
||||
description: "Learn how to connect External Certificate Authorities with Infisical."
|
||||
---
|
||||
|
||||
## Concept
|
||||
|
||||
In addition to creating a Private CA hierarchy, Infisical allows you to integrate with External Certificate Authorities (CAs) to issue digital certificates for your [subscribers](/documentation/platform/pki/subscribers). This integration enables you to leverage established certificate authority infrastructure while centralizing your certificate management within Infisical.
|
||||
|
||||
<div align="center">
|
||||
|
||||
```mermaid
|
||||
graph TD
|
||||
B[Infisical] -->|Manages Certificates| D[Subscribers]
|
||||
|
||||
A1[Public CAs<br>Let's Encrypt, ZeroSSL] -->|ACME Protocol| B
|
||||
A2[Enterprise CAs<br>Vault PKI, Step CA] -->|ACME Protocol| B
|
||||
A3[Cloud CAs<br>ACME-compatible services] -->|ACME Protocol| B
|
||||
|
||||
A4[Future: Enterprise CAs] -.->|EST/SCEP Protocols| B
|
||||
A5[Future: Cloud CAs] -.->|REST APIs| B
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
When you integrate an External CA with Infisical, you benefit from:
|
||||
|
||||
1. **Trust by Default**: Certificates issued by public CAs are trusted by default in browsers and operating systems.
|
||||
2. **Unified Management**: Manage all certificates—both internally and externally issued—from a single platform.
|
||||
3. **Automation**: Leverage Infisical's automation capabilities for certificate lifecycle management.
|
||||
4. **Compliance**: Meet requirements for publicly trusted certificates, especially for public-facing services.
|
||||
5. **Flexibility**: Choose the most appropriate CA for different use cases while maintaining consistent management.
|
||||
|
||||
## General Workflow
|
||||
|
||||
A typical workflow for integrating an External CA with Infisical consists of the following steps:
|
||||
|
||||
1. **Select External CA Type**: Choose the appropriate external CA based on your requirements and supported protocols.
|
||||
2. **Configure Prerequisites**: Set up any required credentials, connections, or configurations specific to your chosen CA type.
|
||||
3. **Register External CA**: Add the External CA configuration to your Infisical project.
|
||||
4. **Create Subscribers**: Set up subscribers that use the External CA as their issuing authority.
|
||||
5. **Manage Certificate Lifecycle**: Handle certificate issuance, renewal, and revocation through Infisical's unified interface.
|
||||
|
||||
The specific steps and requirements vary depending on the External CA type you choose to integrate.
|
||||
|
||||
## Supported Integration Methods
|
||||
|
||||
Infisical currently supports integration with External Certificate Authorities through the following protocol:
|
||||
|
||||
### ACME Protocol Integration
|
||||
|
||||
ACME (Automatic Certificate Management Environment) is a widely adopted protocol for automated certificate issuance and management. Infisical can integrate with any CA that supports the ACME protocol, including:
|
||||
|
||||
**Public Certificate Authorities:**
|
||||
- Let's Encrypt - Free, automated SSL/TLS certificates
|
||||
- ZeroSSL - Free and premium SSL certificates
|
||||
- Buypass - Norwegian CA with free ACME certificates
|
||||
|
||||
**Enterprise Certificate Authorities:**
|
||||
- HashiCorp Vault PKI - Enterprise secret management with ACME support
|
||||
- Step CA - Open-source certificate authority with ACME
|
||||
|
||||
**Cloud Certificate Authorities:**
|
||||
- Some managed certificate services that support ACME protocol
|
||||
|
||||
[Learn more about ACME integration →](/documentation/platform/pki/acme-ca)
|
||||
|
||||
## Use Cases
|
||||
|
||||
External CA integration is ideal for various scenarios:
|
||||
|
||||
### Public-Facing Services
|
||||
Use publicly trusted CAs for websites and services that need browser compatibility:
|
||||
- Web applications and APIs
|
||||
- Load balancers and CDNs
|
||||
- Public-facing microservices
|
||||
|
||||
### Compliance Requirements
|
||||
Meet specific compliance standards that require certificates from accredited CAs:
|
||||
- PCI DSS compliance
|
||||
- SOC 2 requirements
|
||||
- Industry-specific regulations
|
||||
|
||||
### Hybrid Infrastructure
|
||||
Combine internal and external CAs for different use cases:
|
||||
- Internal services with Private CAs
|
||||
- Public services with External CAs
|
||||
- Development vs. production environments
|
||||
|
||||
### Legacy System Integration
|
||||
Integrate with existing enterprise PKI infrastructure:
|
||||
- Windows Active Directory Certificate Services
|
||||
- Network device management
|
||||
- IoT device provisioning
|
||||
|
||||
## Benefits of Centralized Management
|
||||
|
||||
Managing External CAs through Infisical provides several advantages over direct CA management:
|
||||
|
||||
### Unified Certificate Inventory
|
||||
- Single dashboard for all certificates
|
||||
- Centralized expiration tracking
|
||||
- Cross-CA certificate analytics
|
||||
|
||||
### Automated Lifecycle Management
|
||||
- Automatic certificate reissuance before expiration
|
||||
- Proactive expiration alerts
|
||||
- Standardized certificate management processes
|
||||
|
||||
### Enhanced Security
|
||||
- Centralized access controls
|
||||
- Audit trails for all certificate operations
|
||||
- Policy enforcement across CAs
|
||||
|
||||
### Operational Efficiency
|
||||
- Reduced manual certificate management
|
||||
- Consistent deployment workflows
|
||||
- API-driven automation
|
||||
- Integration with existing tools
|
||||
|
||||
## Available Integration Guides
|
||||
|
||||
Get started with External CA integration:
|
||||
|
||||
<CardGroup cols={2}>
|
||||
<Card title="ACME Protocol Integration" icon="certificate" href="/documentation/platform/pki/acme-ca">
|
||||
Set up automated certificate issuance with any ACME-compatible CA
|
||||
</Card>
|
||||
<Card title="API Integrations" icon="code" color="#gray">
|
||||
Custom CA integrations via REST APIs (Coming Soon)
|
||||
</Card>
|
||||
</CardGroup>
|
||||
|
||||
## FAQ
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="Which External CAs does Infisical currently support?">
|
||||
Currently, Infisical supports any Certificate Authority that implements the ACME protocol, including:
|
||||
|
||||
- **Public CAs**: Let's Encrypt, ZeroSSL, Buypass
|
||||
- **Enterprise CAs**: HashiCorp Vault PKI, Step CA
|
||||
- **Cloud CAs**: ACME-compatible managed services
|
||||
|
||||
Integration uses DNS-01 validation through Route53. Learn more about [supported DNS validation methods](/documentation/platform/pki/acme-ca#what-dns-validation-methods-are-supported).
|
||||
|
||||
Support for additional integration protocols (EST, SCEP, direct APIs) is planned for future releases.
|
||||
</Accordion>
|
||||
<Accordion title="Can I use both Private CAs and External CAs in the same project?">
|
||||
Yes. You can have both Private CAs (root and intermediate) and External CAs in the same project, allowing you flexibility in how you issue certificates for different use cases. This hybrid approach enables you to:
|
||||
|
||||
- Use Private CAs for internal services and applications
|
||||
- Use External CAs for public-facing services
|
||||
- Apply consistent management practices across all certificate types
|
||||
- Implement appropriate security controls based on certificate usage
|
||||
</Accordion>
|
||||
<Accordion title="What types of certificates can I issue through External CAs?">
|
||||
The types of certificates you can issue depend on the External CA provider and type:
|
||||
|
||||
- **Public CAs**: Typically support Domain Validation (DV) certificates, with some offering Organization Validation (OV)
|
||||
- **Enterprise CAs**: Support internal certificates, device certificates, and custom certificate types
|
||||
- **Cloud CAs**: Support various certificate types depending on the service
|
||||
|
||||
Certificate capabilities vary by provider and integration method.
|
||||
</Accordion>
|
||||
<Accordion title="How does certificate renewal work with External CAs?">
|
||||
Certificate reissuance is handled automatically by Infisical based on the CA type:
|
||||
|
||||
- **Public CAs**: Automatic reissuance using ACME protocol with the same certificate extensions before expiration
|
||||
- **Other CA types**: Certificate management methods depend on the specific integration (when available)
|
||||
|
||||
All certificate lifecycle events are tracked and managed through Infisical's unified interface, ensuring continuous certificate validity.
|
||||
</Accordion>
|
||||
<Accordion title="What authentication methods are supported for External CAs?">
|
||||
Authentication methods vary by CA type:
|
||||
|
||||
- **Public CAs**: ACME account registration with email and account keys
|
||||
- **Enterprise CAs**: Client certificates, username/password, or domain authentication (when available)
|
||||
- **Cloud CAs**: API keys, OAuth tokens, or service account authentication (when available)
|
||||
|
||||
Infisical securely stores and manages all authentication credentials.
|
||||
</Accordion>
|
||||
<Accordion title="Can I enforce policies on certificates from External CAs?">
|
||||
Yes, Infisical provides policy enforcement capabilities:
|
||||
|
||||
- Certificate template constraints
|
||||
- Monitoring and alerting policies
|
||||
- Access controls for certificate operations
|
||||
|
||||
These policies ensure consistent governance across both internal and external certificate sources.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
@@ -24,7 +24,7 @@ A[Issuing CA] --> C1[Certificate]
|
||||
|
||||
The typical workflow for managing subscribers consists of the following steps:
|
||||
|
||||
1. Creating a subscriber and defining which (issuing) CA will issue X.509 certificates for it as well as attributes to be included on the certificates including common name, subject alternative names, TLL, etc.
|
||||
1. Creating a subscriber and defining which (issuing) CA will issue X.509 certificates for it as well as attributes to be included on the certificates including common name, subject alternative names, TTL, etc. You can also optionally configure automatic certificate renewal.
|
||||
2. Requesting for a certificate against the subscriber with or without a certificate signing request (CSR).
|
||||
3. Managing certificate lifecycle events such as certificate renewal and revocation. As part of the certificate revocation flow,
|
||||
you can also query for a Certificate Revocation List [CRL](https://en.wikipedia.org/wiki/Certificate_revocation_list), a time-stamped, signed
|
||||
@@ -49,17 +49,32 @@ In the following steps, we explore how to issue a X.509 certificate for a subscr
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
The **PKI Subscriber** modal is organized into two tabs:
|
||||
|
||||
### Configuration Tab
|
||||
|
||||
|
||||
|
||||
Here's some guidance on each field.
|
||||
This tab contains the core certificate attributes and settings:
|
||||
|
||||
- Subscriber Name: A slug-friendly name for the subscriber such as `web-service`.
|
||||
- Issuing CA: The Certificate Authority (CA) that will issue X.509 certificates for the subscriber.
|
||||
- Common Name (CN): The common name to be included on certificates to be issued to the subscriber.
|
||||
- Subject Alternative Names (SANs): A comma-delimited list of Subject Alternative Names (SANs) to be included on certificates; these can be hostnames or email addresses like `app1.acme.com, app2.acme.com`.
|
||||
- TTL: The lifetime of the certificate.
|
||||
- Key Usage: The key usage extension of the certificate.
|
||||
- Extended Key Usage: The extended key usage extension of the certificate.
|
||||
- **Subscriber Name**: A slug-friendly name for the subscriber such as `web-service`.
|
||||
- **Issuing CA**: The Certificate Authority (CA) that will issue X.509 certificates for the subscriber.
|
||||
- **Common Name (CN)**: The common name to be included on certificates to be issued to the subscriber.
|
||||
- **Subject Alternative Names (SANs)**: A comma-delimited list of Subject Alternative Names (SANs) to be included on certificates; these can be hostnames or email addresses like `app1.acme.com, app2.acme.com`.
|
||||
- **TTL**: The lifetime of the certificate.
|
||||
- **Key Usage**: The key usage extension of the certificate.
|
||||
- **Extended Key Usage**: The extended key usage extension of the certificate.
|
||||
|
||||
### Advanced Tab
|
||||
|
||||
|
||||
|
||||
This tab contains optional advanced features:
|
||||
|
||||
- **Certificate Auto Renewal**: Toggle to enable automatic certificate renewal for this subscriber.
|
||||
- **Renewal Before Expiry**: When auto renewal is enabled, specify how many days before certificate expiry the system should automatically issue a new certificate (e.g., 7 days).
|
||||
|
||||
<Note>
|
||||
It's possible to issue certificates for a subscriber with or without a certificate signing request (CSR).
|
||||
@@ -68,6 +83,10 @@ In the following steps, we explore how to issue a X.509 certificate for a subscr
|
||||
and a certificate is only issued if they comply.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
When Certificate Auto Renewal is enabled, the system will automatically issue new certificates before the current ones expire, ensuring continuous certificate availability without manual intervention.
|
||||
</Note>
|
||||
|
||||
</Step>
|
||||
<Step title="Requesting a certificate">
|
||||
Once you have created a subscriber from step 1, you can issue a certificate for it.
|
||||
@@ -123,8 +142,13 @@ openssl verify -verbose -crl_check -crl_download -CAfile chain.pem cert.pem
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="What is the workflow for renewing a certificate?">
|
||||
To renew a certificate, you have to issue a new certificate for the same
|
||||
subscriber. The original certificate will continue to be valid through its
|
||||
original TTL unless explicitly revoked.
|
||||
To renew a certificate, you have two options:
|
||||
|
||||
**Manual Renewal**: Issue a new certificate for the same subscriber. The original certificate will continue to be valid through its original TTL unless explicitly revoked.
|
||||
|
||||
**Automatic Renewal**: If Certificate Auto Renewal is enabled for the subscriber, the system will automatically issue new certificates before the current ones expire based on the configured renewal period.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
<Accordion title="How does Certificate Auto Renewal work?">
|
||||
When Certificate Auto Renewal is enabled for a subscriber, the system monitors certificate expiration dates and automatically issues new certificates before they expire. You can configure how many days before expiry the renewal should occur (e.g., 7 days before expiration). This ensures continuous certificate availability without manual intervention.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
@@ -33,6 +33,10 @@ First, you would need to create a set of policies for a certain environment. In
|
||||
|
||||
The enforcement level determines how strict the policy is. A **Hard** enforcement level means that any change that matches the policy will need full approval prior merging. A **Soft** enforcement level allows for break glass functionality on the request. If a change request is bypassed, the approvers will be notified via email.
|
||||
|
||||
<Note>
|
||||
Enabling the "Bypass Approvals" toggle during policy creation will create a **Soft** enforcement level. Disabling the toggle makes the enforcement level **Hard**.
|
||||
</Note>
|
||||
|
||||
### Self approvals
|
||||
|
||||
If the **Self Approvals** option is enabled, users who are designated as approvers on the policy can approve requests that they themselves have submitted.
|
||||
|
||||
@@ -14,7 +14,7 @@ description: "Learn how to configure Auth0 OIDC for Infisical SSO."
|
||||
<Step title="Setup application in Auth0">
|
||||
1.1. From the Application's Page, navigate to the settings tab of the Auth0 application you want to integrate with Infisical.
|
||||
|
||||
|
||||
|
||||
1.2. In the Application URIs section, set the **Application Login URI** and **Allowed Web Origins** fields to `https://app.infisical.com` and the **Allowed Callback URL** field to `https://app.infisical.com/api/v1/sso/oidc/callback`.
|
||||
|
||||
|
||||
@@ -70,7 +70,7 @@ description: "Learn how to configure Auth0 OIDC for Infisical SSO."
|
||||
prior to enforcing OIDC SSO to prevent any unintended issues.
|
||||
</Warning>
|
||||
<Info>
|
||||
In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
</Info>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
@@ -23,30 +23,30 @@ description: "Learn how to configure Auth0 SAML for Infisical SSO."
|
||||
</Step>
|
||||
<Step title="Create a SAML application in Auth0">
|
||||
2.1. In your Auth0 account, head to Applications and create an application.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Select **Regular Web Application** and press **Create**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
2.2. In the Application head to Settings > Application URIs and add the **Application Callback URL** from step 1 into the **Allowed Callback URLs** field.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
2.3. In the Application head to Addons > SAML2 Web App and copy the **Issuer**, **Identity Provider Login URL**, and **Identity Provider Certificate** from the **Usage** tab.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
2.4. Back in Infisical, set **Issuer**, **Identity Provider Login URL**, and **Certificate** to the corresponding items from step 2.3.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
2.5. Back in Auth0, in the **Settings** tab, set the **Application Callback URL** to the **Application Callback URL** from step 1
|
||||
and update the **Settings** field with the JSON under the picture below (replacing `<audience-from-infisical>` with the **Audience** from step 1).
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
```json
|
||||
{
|
||||
"audience": "<audience-from-infisical>",
|
||||
@@ -76,7 +76,7 @@ description: "Learn how to configure Auth0 SAML for Infisical SSO."
|
||||
Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO.
|
||||
|
||||
<Info>
|
||||
In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
</Info>
|
||||
</Step>
|
||||
|
||||
@@ -96,4 +96,4 @@ description: "Learn how to configure Auth0 SAML for Infisical SSO."
|
||||
32`.
|
||||
<div class="height:1px;"/>
|
||||
- `SITE_URL`: The absolute URL of your self-hosted instance of Infisical including the protocol (e.g. https://app.infisical.com)
|
||||
</Note>
|
||||
</Note>
|
||||
|
||||
@@ -5,7 +5,7 @@ description: "Learn how to configure Microsoft Entra ID for Infisical SSO."
|
||||
|
||||
<Info>
|
||||
Azure SAML SSO is a paid feature.
|
||||
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
|
||||
then you should contact [email protected] to purchase an enterprise license to use it.
|
||||
</Info>
|
||||
@@ -26,7 +26,7 @@ description: "Learn how to configure Microsoft Entra ID for Infisical SSO."
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
On the next screen, press the **+ Create your own application** button.
|
||||
Give the application a unique name like Infisical; choose the "Integrate any other application you don't find in the gallery (Non-gallery)"
|
||||
option and hit the **Create** button.
|
||||
@@ -89,9 +89,9 @@ description: "Learn how to configure Microsoft Entra ID for Infisical SSO."
|
||||
</Step>
|
||||
<Step title="Assign users in Azure to the application">
|
||||
Back in Azure, navigate to the **Users and groups** tab and select **+ Add user/group** to assign access to the login with SSO application on a user or group-level.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
</Step>
|
||||
<Step title="Enable SAML SSO in Infisical">
|
||||
Enabling SAML SSO allows members in your organization to log into Infisical via Azure.
|
||||
|
||||
@@ -109,7 +109,7 @@ description: "Learn how to configure Microsoft Entra ID for Infisical SSO."
|
||||
prior to enforcing SAML SSO to prevent any unintended issues.
|
||||
</Warning>
|
||||
<Info>
|
||||
In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
</Info>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
@@ -70,7 +70,7 @@ Prerequisites:
|
||||
We recommend ensuring that your account is provisioned using the identity provider prior to enforcing OIDC SSO to prevent any unintended issues.
|
||||
</Warning>
|
||||
<Info>
|
||||
In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
</Info>
|
||||
</Step>
|
||||
|
||||
|
||||
@@ -24,21 +24,21 @@ description: "Learn how to configure Google SAML for Infisical SSO."
|
||||
<Step title="Create a SAML application in Google">
|
||||
2.1. In your [Google Admin console](https://support.google.com/a/answer/182076), head to Menu > Apps > Web and mobile apps and
|
||||
create a **custom SAML app**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
2.2. In the **App details** tab, give the application a unique name like Infisical.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
2.3. In the **Google Identity Provider details** tab, copy the **SSO URL**, **Entity ID** and **Certificate**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
2.4. Back in Infisical, set **SSO URL** and **Certificate** to the corresponding items from step 2.3.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
2.5. Back in the Google Admin console, in the **Service provider details** tab, set the **ACS URL** and **Entity ID** to the corresponding items from step 1.
|
||||
|
||||
Also, check the **Signed response** checkbox.
|
||||
@@ -84,7 +84,7 @@ description: "Learn how to configure Google SAML for Infisical SSO."
|
||||
prior to enforcing SAML SSO to prevent any unintended issues.
|
||||
</Warning>
|
||||
<Info>
|
||||
In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
</Info>
|
||||
</Step>
|
||||
|
||||
|
||||
@@ -5,7 +5,7 @@ description: "Learn how to configure JumpCloud SAML for Infisical SSO."
|
||||
|
||||
<Info>
|
||||
JumpCloud SAML SSO is a paid feature.
|
||||
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
|
||||
then you should contact [email protected] to purchase an enterprise license to use it.
|
||||
</Info>
|
||||
@@ -83,13 +83,12 @@ description: "Learn how to configure JumpCloud SAML for Infisical SSO."
|
||||
|
||||
To enforce SAML SSO, you're required to test out the SAML connection by successfully authenticating at least one JumpCloud user with Infisical;
|
||||
Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO.
|
||||
|
||||
|
||||
<Warning>
|
||||
We recommend ensuring that your account is provisioned the application in JumpCloud
|
||||
prior to enforcing SAML SSO to prevent any unintended issues.
|
||||
We recommend ensuring that your account is provisioned in the application in JumpCloud prior to enforcing SAML SSO to prevent any unintended issues.
|
||||
</Warning>
|
||||
<Info>
|
||||
In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
</Info>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
@@ -97,7 +97,7 @@ description: "Learn how to configure Keycloak OIDC for Infisical SSO."
|
||||
prior to enforcing OIDC SSO to prevent any unintended issues.
|
||||
</Warning>
|
||||
<Info>
|
||||
In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
</Info>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
@@ -5,7 +5,7 @@ description: "Learn how to configure Keycloak SAML for Infisical SSO."
|
||||
|
||||
<Info>
|
||||
Keycloak SAML SSO is a paid feature.
|
||||
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
|
||||
then you should contact [email protected] to purchase an enterprise license to use it.
|
||||
</Info>
|
||||
@@ -13,36 +13,36 @@ description: "Learn how to configure Keycloak SAML for Infisical SSO."
|
||||
<Steps>
|
||||
<Step title="Prepare the SAML SSO configuration in Infisical">
|
||||
In Infisical, head to the **Single Sign-On (SSO)** page and select the **General** tab. Click **Connect** for **SAML** under the Connect to an Identity Provider section. Select **Keycloak**, then click **Connect** again.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Next, copy the **Valid redirect URI** and **SP Entity ID** to use when configuring the Keycloak SAML application.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Create a SAML client application in Keycloak">
|
||||
2.1. In your realm, navigate to the **Clients** tab and click **Create client** to create a new client application.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<Info>
|
||||
You don’t typically need to make a realm dedicated to Infisical. We recommend adding Infisical as a client to your primary realm.
|
||||
</Info>
|
||||
|
||||
|
||||
In the General Settings step, set **Client type** to **SAML**, the **Client ID** field to `https://app.infisical.com`, and the **Name** field to a friendly name like **Infisical**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<Info>
|
||||
If you’re self-hosting Infisical, then you will want to replace https://app.infisical.com with your own domain.
|
||||
</Info>
|
||||
|
||||
|
||||
Next, in the Login Settings step, set both the **Home URL** field and **Valid redirect URIs** field to the **Valid redirect URI** from step 1 and press **Save**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
2.2. Once you've created the client, under its **Settings** tab, make sure to set the following values:
|
||||
|
||||
|
||||
- Under **SAML Capabilities**:
|
||||
- Name ID format: email (or username).
|
||||
- Force name ID format: On.
|
||||
@@ -54,59 +54,59 @@ description: "Learn how to configure Keycloak SAML for Infisical SSO."
|
||||
- Signature algorithm: RSA_SHA256.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
2.3. Next, navigate to the **Client scopes** tab select the client's dedicated scope.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Next click **Add predefined mapper**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Select the **X500 email**, **X500 givenName**, and **X500 surname** attributes and click **Add**.
|
||||
|
||||
|
||||
|
||||
|
||||
Now click on the **X500 email** mapper and set the **SAML Attribute Name** field to **email**.
|
||||
|
||||
Now click on the **X500 email** mapper and set the **SAML Attribute Name** field to **email**.
|
||||
|
||||
|
||||
|
||||
|
||||
Repeat the same for **X500 givenName** and **X500 surname** mappers, setting the **SAML Attribute Name** field to **firstName** and **lastName** respectively.
|
||||
|
||||
|
||||
Next, back in the client scope's **Mappers**, click **Add mapper** and select **by configuration**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Select **User Property**.
|
||||
|
||||
|
||||
|
||||
|
||||
Set the the **Name** field to **Username**, the **Property** field to **username**, and the **SAML Attribtue Name** to **username**.
|
||||
|
||||
Set the the **Name** field to **Username**, the **Property** field to **username**, and the **SAML Attribute Name** to **username**.
|
||||
|
||||
|
||||
|
||||
|
||||
Repeat the same for the `id` attribute, setting the **Name** field to **ID**, the **Property** field to **id**, and the **SAML Attribute Name** to **id**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Once you've completed the above steps, the list of mappers should look like this:
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Retrieve Identity Provider (IdP) Information from Keycloak">
|
||||
Back in Keycloak, navigate to Configure > Realm settings > General tab > Endpoints > SAML 2.0 Identity Provider Metadata and copy the IDP URL. This should appear in various places and take the form: `https://keycloak-mysite.com/realms/myrealm/protocol/saml`.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Also, in the **Keys** tab, locate the RS256 key and copy the certificate to use when finishing configuring Keycloak SAML in Infisical.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Finish configuring SAML in Infisical">
|
||||
Back in Infisical, set **IDP URL** and **Certificate** to the items from step 3. Also, set the **Client ID** to the `https://app.infisical.com`.
|
||||
|
||||
|
||||
Once you've done that, press **Update** to complete the required configuration.
|
||||
|
||||
|
||||
@@ -119,7 +119,7 @@ description: "Learn how to configure Keycloak SAML for Infisical SSO."
|
||||
<Step title="Enforce SAML SSO in Infisical">
|
||||
Enforcing SAML SSO ensures that members in your organization can only access Infisical
|
||||
by logging into the organization via Keycloak.
|
||||
|
||||
|
||||
To enforce SAML SSO, you're required to test out the SAML connection by successfully authenticating at least one Keycloak user with Infisical;
|
||||
Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO.
|
||||
|
||||
@@ -128,7 +128,7 @@ description: "Learn how to configure Keycloak SAML for Infisical SSO."
|
||||
prior to enforcing SAML SSO to prevent any unintended issues.
|
||||
</Warning>
|
||||
<Info>
|
||||
In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
</Info>
|
||||
</Step>
|
||||
</Steps>
|
||||
@@ -147,4 +147,4 @@ description: "Learn how to configure Keycloak SAML for Infisical SSO."
|
||||
32`.
|
||||
<div class="height:1px;"/>
|
||||
- `SITE_URL`: The absolute URL of your self-hosted instance of Infisical including the protocol (e.g. https://app.infisical.com)
|
||||
</Note>
|
||||
</Note>
|
||||
|
||||
@@ -93,13 +93,12 @@ description: "Learn how to configure Okta SAML 2.0 for Infisical SSO."
|
||||
Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO.
|
||||
|
||||
<Warning>
|
||||
We recommend ensuring that your account is provisioned the application in Okta
|
||||
prior to enforcing SAML SSO to prevent any unintended issues.
|
||||
We recommend ensuring that your account is provisioned for the application in Okta prior to enforcing SAML SSO to prevent any unintended issues.
|
||||
</Warning>
|
||||
<Info>
|
||||
In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
</Info>
|
||||
|
||||
<Info>
|
||||
In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
</Info>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
|
||||
@@ -39,18 +39,30 @@ If your required identity provider is not shown in the list above, please reach
|
||||
For enhanced security, Infisical enforces PKCE (Proof Key for Code Exchange) with the OAuth 2.0-based SSO providers and OIDC. This provides additional protection against authorization code interception attacks and strengthens your authentication flow security.
|
||||
</Info>
|
||||
|
||||
## SSO Break Glass
|
||||
|
||||
In the event your SSO provider experiences downtime, and you need to access Infisical, Organization Admins can utilize the Admin Login Portal to bypass SSO enforcement.
|
||||
|
||||
This portal is accessible at `/login/admin` (e.g., https://app.infisical.com/login/admin).
|
||||
|
||||
<Note>
|
||||
To bypass SSO for an organization, you must be an **Organization Admin** for that specific organization. This **Organization Admin** role is independent of **Server Admin** status. Being a **Server Admin** alone does not grant permission to use this bypass feature.
|
||||
</Note>
|
||||
|
||||
## FAQ
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="Why does Infisical require additional email verification for users connected via SAML?">
|
||||
By default, Infisical Cloud is configured to not trust emails from external
|
||||
identity providers to prevent any malicious account takeover attempts via
|
||||
email spoofing. Accordingly, Infisical creates a new user for anyone provisioned
|
||||
through an external identity provider and requires an additional email
|
||||
verification step upon their first login.
|
||||
<Accordion title="Why does Infisical require additional email verification for users connected via SAML?">
|
||||
By default, Infisical Cloud is configured to not trust emails from external
|
||||
identity providers to prevent any malicious account takeover attempts via
|
||||
email spoofing. Accordingly, Infisical creates a new user for anyone provisioned
|
||||
through an external identity provider and requires an additional email
|
||||
verification step upon their first login.
|
||||
|
||||
If you're running a self-hosted instance of Infisical and would like it to trust emails from external identity providers,
|
||||
you can configure this behavior in the Server Admin Console.
|
||||
|
||||
</Accordion>
|
||||
If you're running a self-hosted instance of Infisical and would like it to trust emails from external identity providers,
|
||||
you can configure this behavior in the Server Admin Console.
|
||||
</Accordion>
|
||||
<Accordion title="Why do I get redirected to SSO when trying to use the Admin Login Portal?">
|
||||
You are likely being redirected because you do not have email authentication mode enabled, or you're not an **Organization Admin**. This portal requires **Organization Admin** status and direct credential login (email and password). **Server Admin** status alone is insufficient.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 1.0 MiB |
Binary file not shown.
|
After Width: | Height: | Size: 820 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 780 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 395 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 436 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 349 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 420 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 427 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 991 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 539 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 989 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 550 KiB After Width: | Height: | Size: 520 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 480 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 133 KiB After Width: | Height: | Size: 129 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 715 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 692 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 678 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 727 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 726 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 747 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 1.1 MiB |
@@ -0,0 +1,123 @@
|
||||
---
|
||||
title: "1Password Connection"
|
||||
description: "Learn how to configure a 1Password Connection for Infisical."
|
||||
---
|
||||
|
||||
Infisical supports the use of [Service Accounts](https://developer.1password.com/docs/service-accounts) to connect with 1Password.
|
||||
|
||||
## Setup 1Password Connect Server
|
||||
|
||||
<Note>
|
||||
If you already have a Connect Server for your vault you may skip this step.
|
||||
</Note>
|
||||
|
||||
<Steps>
|
||||
<Step title="Navigate to 'Developer' and click 'Other'">
|
||||
|
||||
</Step>
|
||||
<Step title="Select 'Connect Server'">
|
||||
|
||||
</Step>
|
||||
<Step title="Configure Connect Server">
|
||||
1. Input a name for your Connect Server
|
||||
2. Click "Choose Vaults" and select the vaults you want to connect
|
||||
3. For each selected vault, click **Edit Access** and **Enable All**
|
||||
4. Click "Add Environment"
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Configure Access Token">
|
||||
1. Input a name and expiration for the token
|
||||
2. Click "Choose Vaults" and select the vaults you want to connect
|
||||
3. For each selected vault, click **Edit Access** and **Enable All**
|
||||
4. Click "Issue Token"
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Deploy Connect Server">
|
||||
Download the Credentials File and set up your Connect Server.
|
||||
|
||||
<Note>
|
||||
Follow [this guide](https://developer.1password.com/docs/connect/get-started#step-2-deploy-1password-connect-server) to deploy a Connect Server.
|
||||
</Note>
|
||||
|
||||
Make sure to save the **Access Token** for later use.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Create 1Password Connection in Infisical
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
<Steps>
|
||||
<Step title="Navigate to App Connections">
|
||||
In your Infisical dashboard, go to **Organization Settings** and select the [**App Connections**](https://app.infisical.com/organization/app-connections) tab.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Select 1Password Connection">
|
||||
Click the **+ Add Connection** button and select the **1Password Connection** option from the available integrations.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Fill out the 1Password Connection Modal">
|
||||
Complete the 1Password Connection form by entering:
|
||||
- A descriptive name for the connection
|
||||
- An optional description for future reference
|
||||
- The URL at which your 1Password Connect Server instance is hosted
|
||||
- The Access Token from earlier steps
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Connection Created">
|
||||
After clicking Create, your **1Password Connection** is established and ready to use with your Infisical projects.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an 1Password Connection, make an API request to the [Create 1Password Connection](/api-reference/endpoints/app-connections/1password/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/app-connections/1password \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-1password-connection",
|
||||
"method": "api-token",
|
||||
"credentials": {
|
||||
"instanceUrl": "https://1pass.example.com",
|
||||
"apiToken": "[PRIVATE TOKEN]"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"appConnection": {
|
||||
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
|
||||
"name": "my-1password-connection",
|
||||
"description": null,
|
||||
"version": 1,
|
||||
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
|
||||
"createdAt": "2025-04-23T19:46:34.831Z",
|
||||
"updatedAt": "2025-04-23T19:46:34.831Z",
|
||||
"isPlatformManagedCredentials": false,
|
||||
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
|
||||
"app": "1password",
|
||||
"method": "api-token",
|
||||
"credentials": {
|
||||
"instanceUrl": "https://1pass.example.com"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
@@ -3,6 +3,13 @@ title: "OCI Connection"
|
||||
description: "Learn how to configure an Oracle Cloud Infrastructure Connection for Infisical."
|
||||
---
|
||||
|
||||
<Info>
|
||||
OCI App Connection is a paid feature.
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
|
||||
then you should contact [email protected] to purchase an enterprise license to use it.
|
||||
</Info>
|
||||
|
||||
Infisical supports the use of [API Signing Key Authentication](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm) to connect with OCI.
|
||||
|
||||
## Create OCI User
|
||||
|
||||
@@ -0,0 +1,163 @@
|
||||
---
|
||||
title: "1Password Sync"
|
||||
description: "Learn how to configure a 1Password Sync for Infisical."
|
||||
---
|
||||
|
||||
**Prerequisites:**
|
||||
- Create an [1Password Connection](/integrations/app-connections/1password)
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
<Steps>
|
||||
<Step title="Add Sync">
|
||||
Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Select '1Password'">
|
||||
|
||||
</Step>
|
||||
<Step title="Configure source">
|
||||
Configure the **Source** from where secrets should be retrieved, then click **Next**.
|
||||
|
||||
|
||||
|
||||
- **Environment**: The project environment to retrieve secrets from.
|
||||
- **Secret Path**: The folder path to retrieve secrets from.
|
||||
|
||||
<Tip>
|
||||
If you need to sync secrets from multiple folder locations, check out [secret imports](/documentation/platform/secret-reference#secret-imports).
|
||||
</Tip>
|
||||
</Step>
|
||||
<Step title="Configure destination">
|
||||
Configure the **Destination** to where secrets should be deployed, then click **Next**.
|
||||
|
||||
|
||||
|
||||
- **1Password Connection**: The 1Password Connection to authenticate with.
|
||||
- **Vault**: The 1Password vault to sync secrets to.
|
||||
</Step>
|
||||
<Step title="Configure sync options">
|
||||
Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
|
||||
|
||||
|
||||
|
||||
- **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
|
||||
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
|
||||
- **Import Secrets (Prioritize Infisical)**: Imports secrets from the destination endpoint before syncing, prioritizing values from Infisical over 1Password when keys conflict.
|
||||
- **Import Secrets (Prioritize 1Password)**: Imports secrets from the destination endpoint before syncing, prioritizing values from 1Password over Infisical when keys conflict.
|
||||
- **Key Schema**: Template that determines how secret names are transformed when syncing, using `{{secretKey}}` as a placeholder for the original secret name.
|
||||
<Note>
|
||||
We highly recommend using a Key Schema to ensure that Infisical only manages the specific keys you intend, keeping everything else untouched.
|
||||
</Note>
|
||||
- **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
|
||||
- **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
|
||||
</Step>
|
||||
<Step title="Configure details">
|
||||
Configure the **Details** of your 1Password Sync, then click **Next**.
|
||||
|
||||
|
||||
|
||||
- **Name**: The name of your sync. Must be slug-friendly.
|
||||
- **Description**: An optional description for your sync.
|
||||
</Step>
|
||||
<Step title="Review configuration">
|
||||
Review your 1Password Sync configuration, then click **Create Sync**.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Sync created">
|
||||
If enabled, your 1Password Sync will begin syncing your secrets to the destination endpoint.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an **1Password Sync**, make an API request to the [Create 1Password Sync](/api-reference/endpoints/secret-syncs/1password/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/secret-syncs/1password \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-1password-sync",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "an example sync",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"environment": "dev",
|
||||
"secretPath": "/my-secrets",
|
||||
"isEnabled": true,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination"
|
||||
},
|
||||
"destinationConfig": {
|
||||
"vaultId": "..."
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"secretSync": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-1password-sync",
|
||||
"description": "an example sync",
|
||||
"isEnabled": true,
|
||||
"version": 1,
|
||||
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-11-07T05:31:56Z",
|
||||
"updatedAt": "2023-11-07T05:31:56Z",
|
||||
"syncStatus": "succeeded",
|
||||
"lastSyncJobId": "123",
|
||||
"lastSyncMessage": null,
|
||||
"lastSyncedAt": "2023-11-07T05:31:56Z",
|
||||
"importStatus": null,
|
||||
"lastImportJobId": null,
|
||||
"lastImportMessage": null,
|
||||
"lastImportedAt": null,
|
||||
"removeStatus": null,
|
||||
"lastRemoveJobId": null,
|
||||
"lastRemoveMessage": null,
|
||||
"lastRemovedAt": null,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connection": {
|
||||
"app": "1password",
|
||||
"name": "my-1password-connection",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"environment": {
|
||||
"slug": "dev",
|
||||
"name": "Development",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"folder": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"path": "/my-secrets"
|
||||
},
|
||||
"destination": "1password",
|
||||
"destinationConfig": {
|
||||
"vaultId": "..."
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
## FAQ
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="How are different 1Password item types treated?">
|
||||
Infisical can only perform CRUD operations on the following item types:
|
||||
- API Credentials
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
@@ -3,6 +3,13 @@ title: "OCI Vault Sync"
|
||||
description: "Learn how to configure an Oracle Cloud Infrastructure Vault Sync for Infisical."
|
||||
---
|
||||
|
||||
<Info>
|
||||
OCI Vault Sync is a paid feature.
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
|
||||
then you should contact [email protected] to purchase an enterprise license to use it.
|
||||
</Info>
|
||||
|
||||
**Prerequisites:**
|
||||
- Create an [OCI Connection](/integrations/app-connections/oci) with the required **Secret Sync** permissions
|
||||
- [Create](https://docs.oracle.com/en-us/iaas/Content/Identity/compartments/To_create_a_compartment.htm) or use an existing OCI Compartment (which the OCI Connection is authorized to access)
|
||||
|
||||
@@ -178,12 +178,14 @@ Supports conditions and permission inversion
|
||||
|
||||
#### Subject: `secret-approval`
|
||||
|
||||
| Action | Description |
|
||||
| -------- | ----------------------------------- |
|
||||
| `read` | View approval policies and requests |
|
||||
| `create` | Create new approval policies |
|
||||
| `edit` | Modify approval policies |
|
||||
| `delete` | Remove approval policies |
|
||||
| Action | Description |
|
||||
| --------------------- | ----------------------------------------------------------------------------------- |
|
||||
| `read` | View approval policies and requests |
|
||||
| `create` | Create new approval policies |
|
||||
| `edit` | Modify approval policies |
|
||||
| `delete` | Remove approval policies |
|
||||
| `allow-change-bypass` | Allow request creators to merge changes without approval in break-glass situations |
|
||||
| `allow-access-bypass` | Allow request creators to access secrets without approval in break-glass situations |
|
||||
|
||||
#### Subject: `secret-rotation`
|
||||
|
||||
|
||||
+53
-1
@@ -112,8 +112,10 @@
|
||||
"pages": [
|
||||
"documentation/platform/pki/overview",
|
||||
"documentation/platform/pki/private-ca",
|
||||
"documentation/platform/pki/external-ca",
|
||||
"documentation/platform/pki/subscribers",
|
||||
"documentation/platform/pki/certificates",
|
||||
"documentation/platform/pki/acme-ca",
|
||||
"documentation/platform/pki/pki-issuer",
|
||||
"documentation/platform/pki/est",
|
||||
"documentation/platform/pki/alerting"
|
||||
@@ -470,6 +472,7 @@
|
||||
{
|
||||
"group": "Connections",
|
||||
"pages": [
|
||||
"integrations/app-connections/1password",
|
||||
"integrations/app-connections/auth0",
|
||||
"integrations/app-connections/aws",
|
||||
"integrations/app-connections/azure-app-configuration",
|
||||
@@ -500,6 +503,7 @@
|
||||
{
|
||||
"group": "Syncs",
|
||||
"pages": [
|
||||
"integrations/secret-syncs/1password",
|
||||
"integrations/secret-syncs/aws-parameter-store",
|
||||
"integrations/secret-syncs/aws-secrets-manager",
|
||||
"integrations/secret-syncs/azure-app-configuration",
|
||||
@@ -1041,6 +1045,18 @@
|
||||
"pages": [
|
||||
"api-reference/endpoints/app-connections/list",
|
||||
"api-reference/endpoints/app-connections/options",
|
||||
{
|
||||
"group": "1Password",
|
||||
"pages": [
|
||||
"api-reference/endpoints/app-connections/1password/list",
|
||||
"api-reference/endpoints/app-connections/1password/available",
|
||||
"api-reference/endpoints/app-connections/1password/get-by-id",
|
||||
"api-reference/endpoints/app-connections/1password/get-by-name",
|
||||
"api-reference/endpoints/app-connections/1password/create",
|
||||
"api-reference/endpoints/app-connections/1password/update",
|
||||
"api-reference/endpoints/app-connections/1password/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Auth0",
|
||||
"pages": [
|
||||
@@ -1276,6 +1292,20 @@
|
||||
"pages": [
|
||||
"api-reference/endpoints/secret-syncs/list",
|
||||
"api-reference/endpoints/secret-syncs/options",
|
||||
{
|
||||
"group": "1Password",
|
||||
"pages": [
|
||||
"api-reference/endpoints/secret-syncs/1password/list",
|
||||
"api-reference/endpoints/secret-syncs/1password/get-by-id",
|
||||
"api-reference/endpoints/secret-syncs/1password/get-by-name",
|
||||
"api-reference/endpoints/secret-syncs/1password/create",
|
||||
"api-reference/endpoints/secret-syncs/1password/update",
|
||||
"api-reference/endpoints/secret-syncs/1password/delete",
|
||||
"api-reference/endpoints/secret-syncs/1password/sync-secrets",
|
||||
"api-reference/endpoints/secret-syncs/1password/import-secrets",
|
||||
"api-reference/endpoints/secret-syncs/1password/remove-secrets"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "AWS Parameter Store",
|
||||
"pages": [
|
||||
@@ -1519,12 +1549,34 @@
|
||||
"api-reference/endpoints/pki/subscribers/update",
|
||||
"api-reference/endpoints/pki/subscribers/delete",
|
||||
"api-reference/endpoints/pki/subscribers/issue-cert",
|
||||
"api-reference/endpoints/pki/subscribers/sign-cert"
|
||||
"api-reference/endpoints/pki/subscribers/sign-cert",
|
||||
"api-reference/endpoints/pki/subscribers/order-cert",
|
||||
"api-reference/endpoints/pki/subscribers/get-latest-cert-bundle"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Certificate Authorities",
|
||||
"pages": [
|
||||
{
|
||||
"group": "ACME",
|
||||
"pages": [
|
||||
"api-reference/endpoints/certificate-authorities/acme/list",
|
||||
"api-reference/endpoints/certificate-authorities/acme/create",
|
||||
"api-reference/endpoints/certificate-authorities/acme/read",
|
||||
"api-reference/endpoints/certificate-authorities/acme/update",
|
||||
"api-reference/endpoints/certificate-authorities/acme/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Internal",
|
||||
"pages": [
|
||||
"api-reference/endpoints/certificate-authorities/internal/list",
|
||||
"api-reference/endpoints/certificate-authorities/internal/create",
|
||||
"api-reference/endpoints/certificate-authorities/internal/read",
|
||||
"api-reference/endpoints/certificate-authorities/internal/update",
|
||||
"api-reference/endpoints/certificate-authorities/internal/delete"
|
||||
]
|
||||
},
|
||||
"api-reference/endpoints/certificate-authorities/list",
|
||||
"api-reference/endpoints/certificate-authorities/create",
|
||||
"api-reference/endpoints/certificate-authorities/read",
|
||||
|
||||
@@ -32,7 +32,7 @@ Used to configure platform-specific security and operational settings
|
||||
<ParamField query="HOST" type="string" default="localhost" optional>
|
||||
Specifies the network interface Infisical will bind to when accepting incoming connections.
|
||||
|
||||
By default, Infisical binds to `localhost`, which restricts access to connections from the same machine.
|
||||
By default, Infisical binds to `localhost`, which restricts access to connections from the same machine.
|
||||
|
||||
To make the application accessible externally (e.g., for self-hosted deployments), set this to `0.0.0.0`, which tells the server to listen on all network interfaces.
|
||||
|
||||
@@ -98,8 +98,8 @@ The platform utilizes Postgres to persist all of its data and Redis for caching
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="DB_ROOT_CERT" type="string" default="" optional>
|
||||
Configure the SSL certificate for securing a Postgres connection by first
|
||||
encoding it in base64. Use the command below to encode your certificate:
|
||||
Configure the SSL certificate for securing a Postgres connection by first encoding it in base64.
|
||||
Use the following command to encode your certificate: `echo "<certificate>" | base64`
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="DB_READ_REPLICAS" type="string" default="" optional>
|
||||
@@ -113,10 +113,9 @@ DB_READ_REPLICAS=[{"DB_CONNECTION_URI":""}]
|
||||
</ParamField>
|
||||
<ParamField query="DB_ROOT_CERT" type="string" default="" optional>
|
||||
Configure the SSL certificate for securing a Postgres replica connection by first encoding it in base64.
|
||||
Use the command below to encode your certificate:
|
||||
`echo "<certificate>" | base64`
|
||||
Use the following command to encode your certificate: `echo "<certificate>" | base64`
|
||||
|
||||
If not provided it will use master SSL certificate.
|
||||
If not provided it will use master SSL certificate.
|
||||
</ParamField>
|
||||
|
||||
</Expandable>
|
||||
@@ -203,6 +202,16 @@ Without email configuration, Infisical's core functions like sign-up/login and s
|
||||
<ParamField query="SMTP_TLS_REJECT_UNAUTHORIZED" type="bool" default="true" optional>
|
||||
If this is `true`, Infisical will validate the server's SSL/TLS certificate and reject the connection if the certificate is invalid or not trusted. If set to `false`, the client will accept the server's certificate regardless of its validity, which can be useful in development or testing environments but is not recommended for production use.
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="SMTP_CUSTOM_CA_CERT" type="string" default="none" optional>
|
||||
If your SMTP server uses a certificate signed by a custom Certificate Authority, you should set this variable so that Infisical can trust the custom CA.
|
||||
|
||||
This variable **must be a base64 encoded PEM certificate**. Use the following command to encode your certificate: `echo "<certificate>" | base64`
|
||||
|
||||
Infisical highly encourages the following variables be used alongside this one for maximum security:
|
||||
- `SMTP_REQUIRE_TLS=true`
|
||||
- `SMTP_TLS_REJECT_UNAUTHORIZED=true`
|
||||
</ParamField>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Twilio SendGrid">
|
||||
|
||||
Reference in New Issue
Block a user