mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-10 08:28:52 +00:00
merge conflicts
This commit is contained in:
x
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Available"
|
||||
openapi: "GET /api/v1/app-connections/azure-client-secrets/available"
|
||||
---
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/app-connections/azure-client-secrets"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Azure Client Secret Connections must be created through the Infisical UI.
|
||||
Check out the configuration docs for [Azure Client Secret Connections](/integrations/app-connections/azure-client-secrets) for a step-by-step
|
||||
guide.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/app-connections/azure-client-secrets/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/app-connections/azure-client-secrets/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/app-connections/azure-client-secrets/connection-name/{connectionName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/app-connections/azure-client-secrets"
|
||||
---
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/app-connections/azure-client-secrets/{connectionId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Azure Client Secret Connections must be updated through the Infisical UI.
|
||||
Check out the configuration docs for [Azure Client Secret Connections](/integrations/app-connections/azure-client-secrets) for a step-by-step
|
||||
guide.
|
||||
</Note>
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v2/secret-rotations/azure-client-secret"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Azure Client Secret Rotations](/documentation/platform/secret-rotation/azure-client-secret) to learn how to obtain the
|
||||
required parameters.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v2/secret-rotations/azure-client-secret/{rotationId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v2/secret-rotations/azure-client-secret/{rotationId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v2/secret-rotations/azure-client-secret/rotation-name/{rotationName}"
|
||||
---
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get Credentials by ID"
|
||||
openapi: "GET /api/v2/secret-rotations/azure-client-secret/{rotationId}/generated-credentials"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v2/secret-rotations/azure-client-secret"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Rotate Secrets"
|
||||
openapi: "POST /api/v2/secret-rotations/azure-client-secret/{rotationId}/rotate-secrets"
|
||||
---
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v2/secret-rotations/azure-client-secret/{rotationId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Azure Client Secret Rotations](/documentation/platform/secret-rotation/azure-client-secret) to learn how to obtain the
|
||||
required parameters.
|
||||
</Note>
|
||||
@@ -27,6 +27,10 @@ The **Settings** page lets you manage information about your organization includ
|
||||
|
||||
|
||||
|
||||
<Tip>
|
||||
You can adjust the maximum time a user token will remain valid for your organization. After this period, users will be required to re-authenticate. This helps improve security by enforcing regular sign-ins.
|
||||
</Tip>
|
||||
|
||||
## Access Control
|
||||
|
||||
The **Access Control** page is where you can manage identities (both people and machines) that are part of your organization.
|
||||
|
||||
@@ -0,0 +1,142 @@
|
||||
---
|
||||
title: "Azure Client Secret"
|
||||
description: "Learn how to automatically rotate Azure Client Secrets."
|
||||
---
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Create an [Azure Client Secret Connection](/integrations/app-connections/azure-client-secrets).
|
||||
|
||||
## Create an Azure Client Secret Rotation in Infisical
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to your Secret Manager Project's Dashboard and select **Add Secret Rotation** from the actions dropdown.
|
||||
|
||||
|
||||
2. Select the **Azure Client Secret** option.
|
||||
|
||||
|
||||
3. Select the **Azure Connection** to use and configure the rotation behavior. Then click **Next**.
|
||||
|
||||
|
||||
- **Azure Connection** - the connection that will perform the rotation of the specified application's Client Secret.
|
||||
- **Rotation Interval** - the interval, in days, that once elapsed will trigger a rotation.
|
||||
- **Rotate At** - the local time of day when rotation should occur once the interval has elapsed.
|
||||
- **Auto-Rotation Enabled** - whether secrets should automatically be rotated once the rotation interval has elapsed. Disable this option to manually rotate secrets or pause secret rotation.
|
||||
|
||||
4. Select the Azure application whose Client Secret you want to rotate. Then click **Next**.
|
||||
|
||||
|
||||
5. Specify the secret names that the client credentials should be mapped to. Then click **Next**.
|
||||
|
||||
|
||||
- **Client ID** - the name of the secret that the application Client ID will be mapped to.
|
||||
- **Client Secret** - the name of the secret that the rotated Client Secret will be mapped to.
|
||||
|
||||
6. Give your rotation a name and description (optional). Then click **Next**.
|
||||
|
||||
|
||||
- **Name** - the name of the secret rotation configuration. Must be slug-friendly.
|
||||
- **Description** (optional) - a description of this rotation configuration.
|
||||
|
||||
7. Review your configuration, then click **Create Secret Rotation**.
|
||||
|
||||
|
||||
8. Your **Azure Client Secret** credentials are now available for use via the mapped secrets.
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an Azure Client Secret Rotation, make an API request to the [Create Azure
|
||||
Client Secret Rotation](/api-reference/endpoints/secret-rotations/azure-client-secret/create) API endpoint.
|
||||
|
||||
You will first need the **Client ID** and **Object ID** of the Azure application you want to rotate the secret for. This can be obtained from the Applications dashboard.
|
||||
|
||||
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://us.infisical.com/api/v2/secret-rotations/azure-client-secret \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-azure-rotation",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "my client secret rotation",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"environment": "dev",
|
||||
"secretPath": "/",
|
||||
"isAutoRotationEnabled": true,
|
||||
"rotationInterval": 30,
|
||||
"rotateAtUtc": {
|
||||
"hours": 0,
|
||||
"minutes": 0
|
||||
},
|
||||
"parameters": {
|
||||
"objectId": "...",
|
||||
"clientId": "...",
|
||||
"appName": "..."
|
||||
},
|
||||
"secretsMapping": {
|
||||
"clientId": "AZURE_CLIENT_ID",
|
||||
"clientSecret": "AZURE_CLIENT_SECRET"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"secretRotation": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-azure-rotation",
|
||||
"description": "my client secret rotation",
|
||||
"secretsMapping": {
|
||||
"clientId": "AZURE_CLIENT_ID",
|
||||
"clientSecret": "AZURE_CLIENT_SECRET"
|
||||
},
|
||||
"isAutoRotationEnabled": true,
|
||||
"activeIndex": 0,
|
||||
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-11-07T05:31:56Z",
|
||||
"updatedAt": "2023-11-07T05:31:56Z",
|
||||
"rotationInterval": 30,
|
||||
"rotationStatus": "success",
|
||||
"lastRotationAttemptedAt": "2023-11-07T05:31:56Z",
|
||||
"lastRotatedAt": "2023-11-07T05:31:56Z",
|
||||
"lastRotationJobId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"nextRotationAt": "2023-11-07T05:31:56Z",
|
||||
"connection": {
|
||||
"app": "azure",
|
||||
"name": "my-azure-connection",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"environment": {
|
||||
"slug": "dev",
|
||||
"name": "Development",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"folder": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"path": "/"
|
||||
},
|
||||
"rotateAtUtc": {
|
||||
"hours": 0,
|
||||
"minutes": 0
|
||||
},
|
||||
"lastRotationMessage": null,
|
||||
"type": "azure-client-secret",
|
||||
"parameters": {
|
||||
"objectId": "...",
|
||||
"appName": "...",
|
||||
"clientId": "..."
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 566 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 578 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 857 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 580 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 600 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 519 KiB After Width: | Height: | Size: 352 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 259 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 531 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 866 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 500 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 509 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 504 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 497 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 539 KiB |
@@ -0,0 +1,103 @@
|
||||
---
|
||||
title: "Azure Client Secrets Connection"
|
||||
description: "Learn how to configure an Azure Client Secrets Connection for Infisical."
|
||||
---
|
||||
|
||||
Infisical currently only supports one method for connecting to Azure, which is OAuth.
|
||||
|
||||
<Accordion title="Self-Hosted Instance">
|
||||
Using the Azure Client Secrets connection on a self-hosted instance of Infisical requires configuring an application in Azure
|
||||
and registering your instance with it.
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up Azure.
|
||||
|
||||
<Steps>
|
||||
<Step title="Create an application in Azure">
|
||||
Navigate to Azure Active Directory > App registrations to create a new application.
|
||||
|
||||
<Info>
|
||||
Azure Active Directory is now Microsoft Entra ID.
|
||||
</Info>
|
||||
|
||||
|
||||
|
||||
Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/organization/app-connections/azure/oauth/callback`.
|
||||
<Tip>
|
||||
The domain you defined in the Redirect URI should be equivalent to the `SITE_URL` configured in your Infisical instance.
|
||||
</Tip>
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Assign API permissions to the application">
|
||||
|
||||
For the Azure Connection to work with Client Secrets, you need to assign the following permission to the application.
|
||||
|
||||
#### Azure Client Secrets permissions
|
||||
|
||||
Set the API permissions of the Azure application to include the following permissions:
|
||||
- Microsoft Graph
|
||||
- `Application.ReadWrite.All`
|
||||
- `Application.ReadWrite.OwnedBy`
|
||||
- `Application.ReadWrite.All` (Delegated)
|
||||
- `Directory.ReadWrite.All` (Delegated)
|
||||
- `User.Read` (Delegated)
|
||||
- Azure App Configuration
|
||||
- `KeyValue.Delete` (Delegated)
|
||||
- `KeyValue.Read` (Delegated)
|
||||
- `KeyValue.Write` (Delegated)
|
||||
- Access Key Vault
|
||||
- `user_impersonation` (Delegated)
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Add your application credentials to Infisical">
|
||||
Obtain the **Application (Client) ID** and **Directory (Tenant) ID** (this will be used later in the Infisical connection) in Overview and generate a **Client Secret** in Certificate & secrets for your Azure application.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Back in your Infisical instance, add two new environment variables for the credentials of your Azure application.
|
||||
|
||||
- `INF_APP_CONNECTION_AZURE_CLIENT_ID`: The **Application (Client) ID** of your Azure application.
|
||||
- `INF_APP_CONNECTION_AZURE_CLIENT_SECRET`: The **Client Secret** of your Azure application.
|
||||
|
||||
Once added, restart your Infisical instance and use the Azure Client Secrets connection.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Accordion>
|
||||
|
||||
## Setup Azure Connection in Infisical
|
||||
|
||||
<Steps>
|
||||
<Step title="Navigate to App Connections">
|
||||
Navigate to the **App Connections** tab on the **Organization Settings** page. 
|
||||
</Step>
|
||||
<Step title="Add Connection">
|
||||
Select the **Azure Connection** option from the connection options modal. 
|
||||
</Step>
|
||||
<Step title="Authorize Connection">
|
||||
Fill in the **Tenant ID** field with the Directory (Tenant) ID you obtained in the previous step.
|
||||
|
||||
Now select the **OAuth** method and click **Connect to Azure**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Grant Access">
|
||||
You will then be redirected to Azure to grant Infisical access to your Azure account. Once granted,
|
||||
you will be redirected back to Infisical's App Connections page. 
|
||||
</Step>
|
||||
<Step title="Connection Created">
|
||||
Your **Azure Client Secrets Connection** is now available for use. 
|
||||
</Step>
|
||||
</Steps>
|
||||
@@ -0,0 +1,60 @@
|
||||
---
|
||||
title: "Bug bounty program"
|
||||
description: " Learn about our bug bounty program and how to report vulnerabilities."
|
||||
---
|
||||
|
||||
The Infisical Bug Bounty Program is our way of recognizing and rewarding the work of security researchers who help keep our platform secure. By reporting vulnerabilities or potential risks, you help us protect secrets, infrastructure, and the organizations who rely on us.
|
||||
|
||||
We value reports that help identify vulnerabilities that affect the integrity of secrets, prevent unauthorized access to environments, or expose flaws in our authentication or authorization flows.
|
||||
|
||||
### How to Report
|
||||
|
||||
- Send reports to **[email protected]** with clear steps to reproduce, impact, and (if possible) a proof-of-concept.
|
||||
- We will acknowledge receipt within 3 business days.
|
||||
- We'll provide an initial assessment or next steps within 5 business days.
|
||||
|
||||
### What's in Scope?
|
||||
|
||||
- Vulnerabilities in our cloud-hosted platform (e.g., `app.infisical.com`, `eu.infisical.com`)
|
||||
- Security issues in the open source Infisical codebase, as maintained in our official GitHub repository
|
||||
- Authentication bypass, privilege escalation, or access to secrets/data without authorization
|
||||
|
||||
### Reward Guidelines
|
||||
|
||||
Bounties are based on severity, impact, and exploitability, as well as whether the report introduces a new vulnerability class or helps improve an existing fix.
|
||||
|
||||
| Severity | Examples | Typical Reward (USD currency) |
|
||||
| --- | --- | --- |
|
||||
| **Critical** | Full unauthorized access to secrets, authentication bypass, cross-tenant access, RCE, full compromise, etc | $2,000 - $5,000 |
|
||||
| **High** | Privilege escalation, project-level access without authorization, persistent DoS | $750 - $2,000 |
|
||||
| **Medium** | Info disclosure, scoped DoS (e.g. ReDoS with auth), or minor access control issues | $250 - $1,000 |
|
||||
| **Low / Informational** | Missing headers, CSP warnings, theoretical flaws, self-hosting misconfigurations | Recognition only |
|
||||
|
||||
|
||||
We may award lower amounts for:
|
||||
- Duplicate class vulnerabilities already under review
|
||||
- Patch bypasses of previously rewarded issues
|
||||
- Vulnerabilities requiring unrealistic attacker conditions
|
||||
|
||||
All final reward amounts are determined at Infisical's discretion based on impact, report quality, and how actionable the issue is.
|
||||
|
||||
|
||||
### Out of Scope
|
||||
|
||||
- Social engineering or phishing
|
||||
- Rate limiting issues on non-sensitive endpoints
|
||||
- Denial-of-service attacks that require authentication and don't impact core service availability
|
||||
- Findings based on outdated or forked code not maintained by the Infisical team
|
||||
- Vulnerabilities in third-party dependencies unless they result in a direct risk to Infisical users
|
||||
|
||||
|
||||
### Responsible Disclosure
|
||||
|
||||
We ask that researchers:
|
||||
|
||||
- Avoid accessing data that isn't yours
|
||||
- Do not publicly disclose without coordination
|
||||
- Use testing accounts where possible
|
||||
- Give us a reasonable window to investigate and patch before going public
|
||||
|
||||
Researchers can also spin up our [self-hosted version of Infisical](/self-hosting/overview) to test for vulnerabilities locally.
|
||||
@@ -118,8 +118,6 @@ It should be noted that, even on Infisical Cloud, it is physically impossible fo
|
||||
|
||||
Please email [email protected] if you have any specific inquiries about employee data and security policies.
|
||||
|
||||
## Get in touch
|
||||
|
||||
If you have any concerns about Infisical or believe you have uncovered a vulnerability, please get in touch via the e-mail address [email protected]. In the message, try to provide a description of the issue and ideally a way of reproducing it. The security team will get back to you as soon as possible.
|
||||
|
||||
Note that this security address should be used for undisclosed vulnerabilities. Please report any security problems to us before disclosing it publicly.
|
||||
## Bug Bounty Program
|
||||
We run a [Bug Bounty Program](/internals/bug-bounty) to recognize and reward security researchers who help make Infisical more secure.
|
||||
If you've found a vulnerability, please review the program details for scope, disclosure guidelines, and reward tiers.
|
||||
@@ -181,6 +181,7 @@
|
||||
"documentation/platform/secret-rotation/overview",
|
||||
"documentation/platform/secret-rotation/auth0-client-secret",
|
||||
"documentation/platform/secret-rotation/aws-iam-user-secret",
|
||||
"documentation/platform/secret-rotation/azure-client-secret",
|
||||
"documentation/platform/secret-rotation/ldap-password",
|
||||
"documentation/platform/secret-rotation/mssql-credentials",
|
||||
"documentation/platform/secret-rotation/postgres-credentials"
|
||||
@@ -430,6 +431,7 @@
|
||||
"integrations/app-connections/auth0",
|
||||
"integrations/app-connections/aws",
|
||||
"integrations/app-connections/azure-app-configuration",
|
||||
"integrations/app-connections/azure-client-secrets",
|
||||
"integrations/app-connections/azure-key-vault",
|
||||
"integrations/app-connections/camunda",
|
||||
"integrations/app-connections/databricks",
|
||||
@@ -889,6 +891,19 @@
|
||||
"api-reference/endpoints/secret-rotations/aws-iam-user-secret/update"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Azure Client Secret",
|
||||
"pages": [
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/create",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/delete",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/get-by-id",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/get-by-name",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/get-generated-credentials-by-id",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/list",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/rotate-secrets",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/update"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "LDAP Password",
|
||||
"pages": [
|
||||
@@ -982,6 +997,18 @@
|
||||
"api-reference/endpoints/app-connections/azure-app-configuration/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Azure Client Secret",
|
||||
"pages": [
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/list",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/available",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/get-by-id",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/get-by-name",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/create",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/update",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Azure Key Vault",
|
||||
"pages": [
|
||||
@@ -1521,6 +1548,7 @@
|
||||
},
|
||||
"internals/components",
|
||||
"internals/security",
|
||||
"internals/bug-bounty",
|
||||
"internals/service-tokens"
|
||||
]
|
||||
},
|
||||
|
||||
@@ -73,7 +73,8 @@ The platform utilizes Postgres to persist all of its data and Redis for caching
|
||||
### PostgreSQL
|
||||
|
||||
<Info>
|
||||
Please note that the database user must have **CREATE** privileges along with ability to create and modify tables. This is needed for Infisical to run schema migrations.
|
||||
Please note that the database user you create must be granted all privileges on the Infisical database.
|
||||
This includes the ability to create new schemas, create, update, delete, modify tables and indexes, etc.
|
||||
</Info>
|
||||
|
||||
<ParamField query="DB_CONNECTION_URI" type="string" default="" required>
|
||||
|
||||
Reference in New Issue
Block a user