mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-10 11:29:02 +00:00
Fix merge conflicts
This commit is contained in:
Tuan Dang
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Available"
|
||||
openapi: "GET /api/v1/app-connections/azure-client-secrets/available"
|
||||
---
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/app-connections/azure-client-secrets"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Azure Client Secret Connections must be created through the Infisical UI.
|
||||
Check out the configuration docs for [Azure Client Secret Connections](/integrations/app-connections/azure-client-secrets) for a step-by-step
|
||||
guide.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/app-connections/azure-client-secrets/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/app-connections/azure-client-secrets/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/app-connections/azure-client-secrets/connection-name/{connectionName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/app-connections/azure-client-secrets"
|
||||
---
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/app-connections/azure-client-secrets/{connectionId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Azure Client Secret Connections must be updated through the Infisical UI.
|
||||
Check out the configuration docs for [Azure Client Secret Connections](/integrations/app-connections/azure-client-secrets) for a step-by-step
|
||||
guide.
|
||||
</Note>
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v2/secret-rotations/azure-client-secret"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Azure Client Secret Rotations](/documentation/platform/secret-rotation/azure-client-secret) to learn how to obtain the
|
||||
required parameters.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v2/secret-rotations/azure-client-secret/{rotationId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v2/secret-rotations/azure-client-secret/{rotationId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v2/secret-rotations/azure-client-secret/rotation-name/{rotationName}"
|
||||
---
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get Credentials by ID"
|
||||
openapi: "GET /api/v2/secret-rotations/azure-client-secret/{rotationId}/generated-credentials"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v2/secret-rotations/azure-client-secret"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Rotate Secrets"
|
||||
openapi: "POST /api/v2/secret-rotations/azure-client-secret/{rotationId}/rotate-secrets"
|
||||
---
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v2/secret-rotations/azure-client-secret/{rotationId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Azure Client Secret Rotations](/documentation/platform/secret-rotation/azure-client-secret) to learn how to obtain the
|
||||
required parameters.
|
||||
</Note>
|
||||
@@ -0,0 +1,40 @@
|
||||
---
|
||||
title: "Assume Privileges"
|
||||
description: "Learn how to temporarily assume the privileges of a user or machine identity within a project."
|
||||
---
|
||||
|
||||
This feature allows authorized users to temporarily take on the permissions of another user or identity. It helps administrators and access managers test and verify permissions before granting access, ensuring everything is set up correctly.
|
||||
It also reduces back-and-forth with end users when troubleshooting permission-related issues.
|
||||
|
||||
## How It Works
|
||||
|
||||
When an authorized user activates assume privileges mode, they temporarily inherit the target user or identity’s permissions for up to one hour.
|
||||
During this time, they can perform actions within the system with the same level of access as the target user.
|
||||
|
||||
- **Permission-based**: Only permissions are inherited, not the full identity
|
||||
- **Time-limited**: Access automatically expires after one hour
|
||||
- **Audited**: All actions are logged under the original user's account. This means any action taken during the session will be recorded under the entity assuming the privileges, not the target entity.
|
||||
- **Authorization required**: Only users with the specific **assume privilege** permission can use this feature
|
||||
- **Scoped to a single project**: You can only assume privileges for one project at a time
|
||||
|
||||
## How to Assume Privileges
|
||||
|
||||
<Steps>
|
||||
<Step title="Go to Project Access">
|
||||
Click on the user or identity you want to assume.
|
||||
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Click Assume Privilege">
|
||||
Click **Assume Privilege**, then type `assume` to confirm and start your session.
|
||||
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Session is Active">
|
||||
You will see a yellow banner indicating that your assume privilege session is active. You can exit at any time by clicking **Exit**.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "GitHub Organization Sync"
|
||||
title: "GitHub Team Sync"
|
||||
description: "Learn how to automatically synchronize your GitHub teams with Infisical Groups."
|
||||
---
|
||||
|
||||
|
||||
@@ -9,6 +9,9 @@ This guide will walk you through the steps needed to configure external KMS supp
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- An AWS KMS Key configured as a `Symmetric` key and with `Encrypt and Decrypt` key usage.
|
||||
|
||||
|
||||
Before you begin, you'll first need to choose a method of authentication with AWS from below.
|
||||
|
||||
<Tabs>
|
||||
|
||||
@@ -268,11 +268,11 @@ For organizations that work with US government agencies, FIPS compliance is almo
|
||||
|
||||
<Steps>
|
||||
<Step title="Create HSM client folder">
|
||||
When using Kubernetes, you need to mount the path containing the HSM client files. This section covers how to configure your Infisical instance to use an HSM with Kubernetes.
|
||||
When using Kubernetes, you need to mount the path containing the HSM client files. This section covers how to configure your Infisical instance to use an HSM with Kubernetes. In this example, we are going to be using `/etc/luna-docker`.
|
||||
|
||||
|
||||
```bash
|
||||
mkdir /etc/hsm-client
|
||||
mkdir /etc/luna-docker
|
||||
```
|
||||
|
||||
After [setting up your Luna Cloud HSM client](https://thalesdocs.com/gphsm/luna/7/docs/network/Content/install/client_install/add_dpod.htm), you should have a set of files, referred to as the HSM client. You don't need all the files, but for simplicity we recommend copying all the files from the client.
|
||||
@@ -306,20 +306,60 @@ For organizations that work with US government agencies, FIPS compliance is almo
|
||||
The most important parts of the client folder is the `Chrystoki.conf` file, and the `libs`, `plugins`, and `jsp` folders. You need to copy these files to the folder you created in the first step.
|
||||
|
||||
```bash
|
||||
cp -r /<path-to-where-your-hsm-client-is-located> /etc/hsm-client
|
||||
cp -r /<path-to-where-your-luna-client-is-located>/* /etc/luna-docker
|
||||
```
|
||||
|
||||
<Note>
|
||||
The `/*` wildcard will copy all files and folders within the HSM client. The wildcard is important to ensure that the file structure is inline with the rest of this guide.
|
||||
</Note>
|
||||
|
||||
After copying the files, the `/etc/luna-docker` directory should have the following file structure:
|
||||
```bash
|
||||
$ ls -R /etc/luna-docker
|
||||
Chrystoki.conf etc lock server-certificate.pem
|
||||
Chrystoki.conf.tmp2E jsp partition-ca-certificate.pem setenv
|
||||
lch-support-linux-64bit partition-certificate.pem
|
||||
bin libs plugins
|
||||
|
||||
/etc/luna-docker/bin:
|
||||
64
|
||||
|
||||
/etc/luna-docker/bin/64:
|
||||
ckdemo cmu lunacm multitoken vtl
|
||||
|
||||
/etc/luna-docker/etc:
|
||||
openssl.cnf
|
||||
|
||||
/etc/luna-docker/jsp:
|
||||
64 LunaProvider.jar
|
||||
|
||||
/etc/luna-docker/jsp/64:
|
||||
libLunaAPI.so
|
||||
|
||||
/etc/luna-docker/libs:
|
||||
64
|
||||
|
||||
/etc/luna-docker/libs/64:
|
||||
libCryptoki2.so
|
||||
|
||||
/etc/luna-docker/lock:
|
||||
|
||||
/etc/luna-docker/plugins:
|
||||
libcloud.plugin
|
||||
```
|
||||
|
||||
</Step>
|
||||
<Step title="Update Chrystoki.conf">
|
||||
The `Chrystoki.conf` file is used to configure the HSM client. You need to update the `Chrystoki.conf` file to point to the correct file paths.
|
||||
|
||||
In this example, we will be mounting the `/etc/hsm-client` folder from the host to containers in our deployment's pods at the path `/hsm-client`. This means the contents of `/etc/hsm-client` on the host will be accessible at `/hsm-client` within the containers.
|
||||
In this example, we will be mounting the `/etc/luna-docker` folder from the host to containers in our deployment's pods at the path `/usr/safenet/lunaclient`. This means the contents of `/etc/luna-docker` on the host will be accessible at `/usr/safenet/lunaclient` within the containers.
|
||||
|
||||
An example config file will look like this:
|
||||
|
||||
```Chrystoki.conf
|
||||
Chrystoki2 = {
|
||||
# This path points to the mounted path, /hsm-client
|
||||
LibUNIX64 = /hsm-client/libs/64/libCryptoki2.so;
|
||||
# This path points to the mounted path, /usr/safenet/lunaclient
|
||||
LibUNIX64 = /usr/safenet/lunaclient/libs/64/libCryptoki2.so;
|
||||
}
|
||||
|
||||
Luna = {
|
||||
@@ -339,8 +379,8 @@ For organizations that work with US government agencies, FIPS compliance is almo
|
||||
|
||||
Misc = {
|
||||
# Update the paths to point to the mounted path if your folder structure is different from the one mentioned in the previous step.
|
||||
PluginModuleDir = /hsm-client/plugins;
|
||||
MutexFolder = /hsm-client/lock;
|
||||
PluginModuleDir = /usr/safenet/lunaclient/plugins;
|
||||
MutexFolder = /usr/safenet/lunaclient/lock;
|
||||
PE1746Enabled = 1;
|
||||
ToolsDir = /usr/bin;
|
||||
|
||||
@@ -353,7 +393,7 @@ For organizations that work with US government agencies, FIPS compliance is almo
|
||||
LunaSA Client = {
|
||||
ReceiveTimeout = 20000;
|
||||
# Update the paths to point to the mounted path if your folder structure is different from the one mentioned in the previous step.
|
||||
SSLConfigFile = /hsm-client/etc/openssl.cnf;
|
||||
SSLConfigFile = /usr/safenet/lunaclient/etc/openssl.cnf;
|
||||
ClientPrivKeyFile = ./etc/ClientNameKey.pem;
|
||||
ClientCertFile = ./etc/ClientNameCert.pem;
|
||||
ServerCAFile = ./etc/CAFile.pem;
|
||||
@@ -441,7 +481,7 @@ For organizations that work with US government agencies, FIPS compliance is almo
|
||||
|
||||
```bash
|
||||
kubectl exec hsm-setup-pod -- mkdir -p /data/ # Create the data directory
|
||||
kubectl cp ./hsm-client/ hsm-setup-pod:/data/ # Copy the HSM client files into the PVC
|
||||
kubectl cp /etc/luna-docker/. hsm-setup-pod:/data/ # Copy the HSM client files into the PVC
|
||||
kubectl exec hsm-setup-pod -- chmod -R 755 /data/ # Set the correct permissions for the HSM client files
|
||||
```
|
||||
|
||||
@@ -456,7 +496,7 @@ For organizations that work with US government agencies, FIPS compliance is almo
|
||||
Next we need to update the environment variables used for the deployment. If you followed the [setup instructions for Kubernetes deployments](/self-hosting/deployment-options/kubernetes-helm), you should have a Kubernetes secret called `infisical-secrets`.
|
||||
We need to update the secret with the following environment variables:
|
||||
|
||||
- `HSM_LIB_PATH` - The path to the HSM client library _(mapped to `/hsm-client/libs/64/libCryptoki2.so`)_
|
||||
- `HSM_LIB_PATH` - The path to the HSM client library _(mapped to `/usr/safenet/lunaclient/libs/64/libCryptoki2.so`)_
|
||||
- `HSM_PIN` - The PIN for the HSM device that you created when setting up your Luna Cloud HSM client
|
||||
- `HSM_SLOT` - The slot number for the HSM device that you selected when setting up your Luna Cloud HSM client
|
||||
- `HSM_KEY_LABEL` - The label for the HSM key. If no key is found with the provided key label, the HSM will create a new key with the provided label.
|
||||
@@ -471,7 +511,7 @@ For organizations that work with US government agencies, FIPS compliance is almo
|
||||
type: Opaque
|
||||
stringData:
|
||||
# ... Other environment variables ...
|
||||
HSM_LIB_PATH: "/hsm-client/libs/64/libCryptoki2.so" # If you followed this guide, this will be the path of the Luna Cloud HSM client
|
||||
HSM_LIB_PATH: "/usr/safenet/lunaclient/libs/64/libCryptoki2.so" # If you followed this guide, this will be the path of the Luna Cloud HSM client
|
||||
HSM_PIN: "<your-hsm-device-pin>"
|
||||
HSM_SLOT: "<hsm-device-slot>"
|
||||
HSM_KEY_LABEL: "<your-key-label>"
|
||||
@@ -487,7 +527,7 @@ For organizations that work with US government agencies, FIPS compliance is almo
|
||||
<Step title="Updating the Deployment">
|
||||
After we've successfully configured the PVC and updated our environment variables, we are ready to update the deployment configuration so that the pods it creates can access the HSM client files.
|
||||
|
||||
We need to update the Docker image of the deployment to use `infisical/infisical-fips`. The `infisical/infisical-fips` image is a functionally identical image to the `infisical/infisical` image, but it is built with support for HSM encryption.
|
||||
We need to update the Docker image of the deployment to use `infisical/infisical-fips`. The `infisical/infisical-fips` image is a functionally identical image to the `infisical/infisical` image, but it is built with HSM support.
|
||||
|
||||
```yaml
|
||||
# ... The rest of the values.yaml file ...
|
||||
@@ -499,8 +539,7 @@ For organizations that work with US government agencies, FIPS compliance is almo
|
||||
|
||||
extraVolumeMounts:
|
||||
- name: hsm-data
|
||||
mountPath: /hsm-client # The path we will mount the HSM client files to
|
||||
subPath: ./hsm-client
|
||||
mountPath: /usr/safenet/lunaclient # The path we will mount the HSM client files to
|
||||
|
||||
extraVolumes:
|
||||
- name: hsm-data
|
||||
|
||||
@@ -27,6 +27,10 @@ The **Settings** page lets you manage information about your organization includ
|
||||
|
||||
|
||||
|
||||
<Tip>
|
||||
You can adjust the maximum time a user token will remain valid for your organization. After this period, users will be required to re-authenticate. This helps improve security by enforcing regular sign-ins.
|
||||
</Tip>
|
||||
|
||||
## Access Control
|
||||
|
||||
The **Access Control** page is where you can manage identities (both people and machines) that are part of your organization.
|
||||
|
||||
@@ -0,0 +1,142 @@
|
||||
---
|
||||
title: "Azure Client Secret"
|
||||
description: "Learn how to automatically rotate Azure Client Secrets."
|
||||
---
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Create an [Azure Client Secret Connection](/integrations/app-connections/azure-client-secrets).
|
||||
|
||||
## Create an Azure Client Secret Rotation in Infisical
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to your Secret Manager Project's Dashboard and select **Add Secret Rotation** from the actions dropdown.
|
||||
|
||||
|
||||
2. Select the **Azure Client Secret** option.
|
||||
|
||||
|
||||
3. Select the **Azure Connection** to use and configure the rotation behavior. Then click **Next**.
|
||||
|
||||
|
||||
- **Azure Connection** - the connection that will perform the rotation of the specified application's Client Secret.
|
||||
- **Rotation Interval** - the interval, in days, that once elapsed will trigger a rotation.
|
||||
- **Rotate At** - the local time of day when rotation should occur once the interval has elapsed.
|
||||
- **Auto-Rotation Enabled** - whether secrets should automatically be rotated once the rotation interval has elapsed. Disable this option to manually rotate secrets or pause secret rotation.
|
||||
|
||||
4. Select the Azure application whose Client Secret you want to rotate. Then click **Next**.
|
||||
|
||||
|
||||
5. Specify the secret names that the client credentials should be mapped to. Then click **Next**.
|
||||
|
||||
|
||||
- **Client ID** - the name of the secret that the application Client ID will be mapped to.
|
||||
- **Client Secret** - the name of the secret that the rotated Client Secret will be mapped to.
|
||||
|
||||
6. Give your rotation a name and description (optional). Then click **Next**.
|
||||
|
||||
|
||||
- **Name** - the name of the secret rotation configuration. Must be slug-friendly.
|
||||
- **Description** (optional) - a description of this rotation configuration.
|
||||
|
||||
7. Review your configuration, then click **Create Secret Rotation**.
|
||||
|
||||
|
||||
8. Your **Azure Client Secret** credentials are now available for use via the mapped secrets.
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an Azure Client Secret Rotation, make an API request to the [Create Azure
|
||||
Client Secret Rotation](/api-reference/endpoints/secret-rotations/azure-client-secret/create) API endpoint.
|
||||
|
||||
You will first need the **Client ID** and **Object ID** of the Azure application you want to rotate the secret for. This can be obtained from the Applications dashboard.
|
||||
|
||||
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://us.infisical.com/api/v2/secret-rotations/azure-client-secret \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-azure-rotation",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "my client secret rotation",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"environment": "dev",
|
||||
"secretPath": "/",
|
||||
"isAutoRotationEnabled": true,
|
||||
"rotationInterval": 30,
|
||||
"rotateAtUtc": {
|
||||
"hours": 0,
|
||||
"minutes": 0
|
||||
},
|
||||
"parameters": {
|
||||
"objectId": "...",
|
||||
"clientId": "...",
|
||||
"appName": "..."
|
||||
},
|
||||
"secretsMapping": {
|
||||
"clientId": "AZURE_CLIENT_ID",
|
||||
"clientSecret": "AZURE_CLIENT_SECRET"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"secretRotation": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-azure-rotation",
|
||||
"description": "my client secret rotation",
|
||||
"secretsMapping": {
|
||||
"clientId": "AZURE_CLIENT_ID",
|
||||
"clientSecret": "AZURE_CLIENT_SECRET"
|
||||
},
|
||||
"isAutoRotationEnabled": true,
|
||||
"activeIndex": 0,
|
||||
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-11-07T05:31:56Z",
|
||||
"updatedAt": "2023-11-07T05:31:56Z",
|
||||
"rotationInterval": 30,
|
||||
"rotationStatus": "success",
|
||||
"lastRotationAttemptedAt": "2023-11-07T05:31:56Z",
|
||||
"lastRotatedAt": "2023-11-07T05:31:56Z",
|
||||
"lastRotationJobId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"nextRotationAt": "2023-11-07T05:31:56Z",
|
||||
"connection": {
|
||||
"app": "azure",
|
||||
"name": "my-azure-connection",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"environment": {
|
||||
"slug": "dev",
|
||||
"name": "Development",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"folder": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"path": "/"
|
||||
},
|
||||
"rotateAtUtc": {
|
||||
"hours": 0,
|
||||
"minutes": 0
|
||||
},
|
||||
"lastRotationMessage": null,
|
||||
"type": "azure-client-secret",
|
||||
"parameters": {
|
||||
"objectId": "...",
|
||||
"appName": "...",
|
||||
"clientId": "..."
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 566 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 578 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 857 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 580 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 600 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 335 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 360 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 439 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 170 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 519 KiB After Width: | Height: | Size: 352 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 259 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 531 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 866 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 500 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 509 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 504 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 497 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 539 KiB |
@@ -0,0 +1,103 @@
|
||||
---
|
||||
title: "Azure Client Secrets Connection"
|
||||
description: "Learn how to configure an Azure Client Secrets Connection for Infisical."
|
||||
---
|
||||
|
||||
Infisical currently only supports one method for connecting to Azure, which is OAuth.
|
||||
|
||||
<Accordion title="Self-Hosted Instance">
|
||||
Using the Azure Client Secrets connection on a self-hosted instance of Infisical requires configuring an application in Azure
|
||||
and registering your instance with it.
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up Azure.
|
||||
|
||||
<Steps>
|
||||
<Step title="Create an application in Azure">
|
||||
Navigate to Azure Active Directory > App registrations to create a new application.
|
||||
|
||||
<Info>
|
||||
Azure Active Directory is now Microsoft Entra ID.
|
||||
</Info>
|
||||
|
||||
|
||||
|
||||
Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/organization/app-connections/azure/oauth/callback`.
|
||||
<Tip>
|
||||
The domain you defined in the Redirect URI should be equivalent to the `SITE_URL` configured in your Infisical instance.
|
||||
</Tip>
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Assign API permissions to the application">
|
||||
|
||||
For the Azure Connection to work with Client Secrets, you need to assign the following permission to the application.
|
||||
|
||||
#### Azure Client Secrets permissions
|
||||
|
||||
Set the API permissions of the Azure application to include the following permissions:
|
||||
- Microsoft Graph
|
||||
- `Application.ReadWrite.All`
|
||||
- `Application.ReadWrite.OwnedBy`
|
||||
- `Application.ReadWrite.All` (Delegated)
|
||||
- `Directory.ReadWrite.All` (Delegated)
|
||||
- `User.Read` (Delegated)
|
||||
- Azure App Configuration
|
||||
- `KeyValue.Delete` (Delegated)
|
||||
- `KeyValue.Read` (Delegated)
|
||||
- `KeyValue.Write` (Delegated)
|
||||
- Access Key Vault
|
||||
- `user_impersonation` (Delegated)
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Add your application credentials to Infisical">
|
||||
Obtain the **Application (Client) ID** and **Directory (Tenant) ID** (this will be used later in the Infisical connection) in Overview and generate a **Client Secret** in Certificate & secrets for your Azure application.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Back in your Infisical instance, add two new environment variables for the credentials of your Azure application.
|
||||
|
||||
- `INF_APP_CONNECTION_AZURE_CLIENT_ID`: The **Application (Client) ID** of your Azure application.
|
||||
- `INF_APP_CONNECTION_AZURE_CLIENT_SECRET`: The **Client Secret** of your Azure application.
|
||||
|
||||
Once added, restart your Infisical instance and use the Azure Client Secrets connection.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Accordion>
|
||||
|
||||
## Setup Azure Connection in Infisical
|
||||
|
||||
<Steps>
|
||||
<Step title="Navigate to App Connections">
|
||||
Navigate to the **App Connections** tab on the **Organization Settings** page. 
|
||||
</Step>
|
||||
<Step title="Add Connection">
|
||||
Select the **Azure Connection** option from the connection options modal. 
|
||||
</Step>
|
||||
<Step title="Authorize Connection">
|
||||
Fill in the **Tenant ID** field with the Directory (Tenant) ID you obtained in the previous step.
|
||||
|
||||
Now select the **OAuth** method and click **Connect to Azure**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Grant Access">
|
||||
You will then be redirected to Azure to grant Infisical access to your Azure account. Once granted,
|
||||
you will be redirected back to Infisical's App Connections page. 
|
||||
</Step>
|
||||
<Step title="Connection Created">
|
||||
Your **Azure Client Secrets Connection** is now available for use. 
|
||||
</Step>
|
||||
</Steps>
|
||||
@@ -34,7 +34,7 @@ description: "Learn how to configure a TeamCity Sync for Infisical."
|
||||
- **Build Configuration**: The build configuration to sync secrets to.
|
||||
|
||||
<Note>
|
||||
Not including a Build Configuration will sync secrets to the entire project.
|
||||
Not including a Build Configuration will sync secrets to the project.
|
||||
</Note>
|
||||
|
||||
5. Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
|
||||
@@ -44,6 +44,11 @@ description: "Learn how to configure a TeamCity Sync for Infisical."
|
||||
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
|
||||
- **Import Secrets (Prioritize Infisical)**: Imports secrets from the destination endpoint before syncing, prioritizing values from Infisical over TeamCity when keys conflict.
|
||||
- **Import Secrets (Prioritize TeamCity)**: Imports secrets from the destination endpoint before syncing, prioritizing values from TeamCity over Infisical when keys conflict.
|
||||
|
||||
<Note>
|
||||
Infisical only syncs secrets from within the target scope; inherited secrets will not be imported.
|
||||
</Note>
|
||||
|
||||
- **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
|
||||
- **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
|
||||
|
||||
|
||||
@@ -166,6 +166,7 @@
|
||||
},
|
||||
"documentation/platform/access-controls/additional-privileges",
|
||||
"documentation/platform/access-controls/temporary-access",
|
||||
"documentation/platform/access-controls/assume-privilege",
|
||||
"documentation/platform/access-controls/access-requests",
|
||||
"documentation/platform/access-controls/project-access-requests",
|
||||
"documentation/platform/pr-workflows",
|
||||
@@ -186,6 +187,7 @@
|
||||
"documentation/platform/secret-rotation/overview",
|
||||
"documentation/platform/secret-rotation/auth0-client-secret",
|
||||
"documentation/platform/secret-rotation/aws-iam-user-secret",
|
||||
"documentation/platform/secret-rotation/azure-client-secret",
|
||||
"documentation/platform/secret-rotation/ldap-password",
|
||||
"documentation/platform/secret-rotation/mssql-credentials",
|
||||
"documentation/platform/secret-rotation/postgres-credentials"
|
||||
@@ -435,6 +437,7 @@
|
||||
"integrations/app-connections/auth0",
|
||||
"integrations/app-connections/aws",
|
||||
"integrations/app-connections/azure-app-configuration",
|
||||
"integrations/app-connections/azure-client-secrets",
|
||||
"integrations/app-connections/azure-key-vault",
|
||||
"integrations/app-connections/camunda",
|
||||
"integrations/app-connections/databricks",
|
||||
@@ -892,6 +895,19 @@
|
||||
"api-reference/endpoints/secret-rotations/aws-iam-user-secret/update"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Azure Client Secret",
|
||||
"pages": [
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/create",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/delete",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/get-by-id",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/get-by-name",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/get-generated-credentials-by-id",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/list",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/rotate-secrets",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/update"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "LDAP Password",
|
||||
"pages": [
|
||||
@@ -985,6 +1001,18 @@
|
||||
"api-reference/endpoints/app-connections/azure-app-configuration/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Azure Client Secret",
|
||||
"pages": [
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/list",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/available",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/get-by-id",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/get-by-name",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/create",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/update",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Azure Key Vault",
|
||||
"pages": [
|
||||
|
||||
@@ -73,7 +73,8 @@ The platform utilizes Postgres to persist all of its data and Redis for caching
|
||||
### PostgreSQL
|
||||
|
||||
<Info>
|
||||
Please note that the database user must have **CREATE** privileges along with ability to create and modify tables. This is needed for Infisical to run schema migrations.
|
||||
Please note that the database user you create must be granted all privileges on the Infisical database.
|
||||
This includes the ability to create new schemas, create, update, delete, modify tables and indexes, etc.
|
||||
</Info>
|
||||
|
||||
<ParamField query="DB_CONNECTION_URI" type="string" default="" required>
|
||||
|
||||
Reference in New Issue
Block a user