mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Merge pull request #2442 from meetcshah19/meet/eng-1495-dynamic-secrets-with-ad
feat: Add dynamic secrets for Azure Entra ID
This commit is contained in:
Meet Shah
164
docs/documentation/platform/dynamic-secrets/azure-entra-id.mdx
Normal file
164
docs/documentation/platform/dynamic-secrets/azure-entra-id.mdx
Normal file
@@ -0,0 +1,164 @@
|
||||
---
|
||||
title: "Azure Entra Id"
|
||||
description: "Learn how to dynamically generate Azure Entra Id user credentials."
|
||||
---
|
||||
|
||||
The Infisical Azure Entra Id dynamic secret allows you to generate Azure Entra Id credentials on demand based on configured role.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
<Steps>
|
||||
<Step>
|
||||
Login to [Microsoft Entra ID](https://entra.microsoft.com/)
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
Go to Overview, Copy and store `Tenant Id`
|
||||
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
Go to Applications > App registrations. Click on New Registration.
|
||||
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
Enter an application name. Click Register.
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
Copy and store `Application Id`.
|
||||
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
Go to Clients and Secrets. Click on New Client Secret.
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
Enter a description, select expiry and click Add.
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
Copy and store `Client Secret` value.
|
||||
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
Go to API Permissions. Click on Add a permission.
|
||||
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
Click on Microsoft Graph.
|
||||
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
Click on Application Permissions. Search and select `User.ReadWrite.All` and click Add permissions.
|
||||
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
Click on Grant admin consent for app. Click yes to confirm.
|
||||
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
Go to Dashboard. Click on show more.
|
||||
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
Click on Roles & admins. Search for User Administrator and click on it.
|
||||
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
Click on Add assignments. Search for the application name you created and select it. Click on Add.
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Set up Dynamic Secrets with Azure Entra ID
|
||||
|
||||
<Steps>
|
||||
<Step title="Open Secret Overview Dashboard">
|
||||
Open the Secret Overview dashboard and select the environment in which you would like to add a dynamic secret.
|
||||
</Step>
|
||||
<Step title="Click on the 'Add Dynamic Secret' button">
|
||||
|
||||
</Step>
|
||||
<Step title="Select 'Azure Entra ID'">
|
||||
|
||||
</Step>
|
||||
<Step title="Provide the inputs for dynamic secret parameters">
|
||||
<ParamField path="Secret Prefix" type="string" required>
|
||||
Prefix for the secrets to be created
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Default TTL" type="string" required>
|
||||
Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate)
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Max TTL" type="string" required>
|
||||
Maximum time-to-live for a generated secret.
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Tenant ID" type="string" required>
|
||||
The Tenant ID of your Azure Entra ID account.
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Application ID" type="string" required>
|
||||
The Application ID of the application you created in Azure Entra ID.
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Client Secret" type="string" required>
|
||||
The Client Secret of the application you created in Azure Entra ID.
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Users" type="selection" required>
|
||||
Multi select list of users to generate secrets for.
|
||||
</ParamField>
|
||||
|
||||
</Step>
|
||||
<Step title="Click `Submit`">
|
||||
After submitting the form, you will see a dynamic secrets for each user created in the dashboard.
|
||||
</Step>
|
||||
|
||||
<Step title="Generate dynamic secrets">
|
||||
Once you've successfully configured the dynamic secret, you're ready to generate on-demand credentials.
|
||||
To do this, simply click on the 'Generate' button which appears when hovering over the dynamic secret item.
|
||||
Alternatively, you can initiate the creation of a new lease by selecting 'New Lease' from the dynamic secret lease list section.
|
||||
|
||||
|
||||
|
||||
|
||||
When generating these secrets, it's important to specify a Time-to-Live (TTL) duration. This will dictate how long the credentials are valid for.
|
||||
|
||||
|
||||
|
||||
<Tip>
|
||||
Ensure that the TTL for the lease fall within the maximum TTL defined when configuring the dynamic secret.
|
||||
</Tip>
|
||||
|
||||
|
||||
Once you click the `Submit` button, a new secret lease will be generated and the credentials from it will be shown to you.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
## Audit or Revoke Leases
|
||||
Once you have created one or more leases, you will be able to access them by clicking on the respective dynamic secret item on the dashboard.
|
||||
This will allow you see the expiration time of the lease or delete a lease before it's set time to live.
|
||||
|
||||
|
||||
|
||||
## Renew Leases
|
||||
To extend the life of the generated dynamic secret leases past its initial time to live, simply click on the **Renew** as illustrated below.
|
||||
|
||||
|
||||
<Warning>
|
||||
Lease renewals cannot exceed the maximum TTL set when configuring the dynamic secret
|
||||
</Warning>
|
||||
Reference in New Issue
Block a user