Change Azure Client Secret Rotation to show app client id

backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts

@@ -24,7 +24,7 @@ export const azureClientSecretRotationFactory: TRotationFactory<
 > = (secretRotation, appConnectionDAL, kmsService) => {
   const {
     connection,
-    parameters: { appId },
+    parameters: { appId, clientId: clientIdParam },
     secretsMapping
   } = secretRotation;
 
@@ -64,7 +64,8 @@ export const azureClientSecretRotationFactory: TRotationFactory<
 
       return {
         clientSecret: data.secretText,
-        clientId: data.keyId
+        keyId: data.keyId,
+        clientId: clientIdParam
       };
     } catch (error: unknown) {
       if (error instanceof AxiosError) {
@@ -81,14 +82,14 @@ export const azureClientSecretRotationFactory: TRotationFactory<
   /**
    * Revokes a client secret from the Azure app using its keyId.
    */
-  const revokeCredential = async (clientId: string) => {
+  const revokeCredential = async (keyId: string) => {
     const accessToken = await getAzureConnectionAccessToken(connection.id, appConnectionDAL, kmsService);
     const endpoint = `${GRAPH_API_BASE}/applications/${appId}/removePassword`;
 
     try {
       await request.post(
         endpoint,
-        { keyId: clientId },
+        { keyId },
         {
           headers: {
             Authorization: `Bearer ${accessToken}`,
@@ -99,7 +100,7 @@ export const azureClientSecretRotationFactory: TRotationFactory<
     } catch (error: unknown) {
       if (error instanceof AxiosError) {
         throw new BadRequestError({
-          message: `Failed to remove client secret with keyId ${clientId} from app ${appId}: ${
+          message: `Failed to remove client secret with keyId ${keyId} from app ${appId}: ${
             error.message || "Unknown error"
           }`
         });
@@ -129,7 +130,7 @@ export const azureClientSecretRotationFactory: TRotationFactory<
   ) => {
     if (!credentials?.length) return callback();
 
-    await Promise.all(credentials.map(({ clientId }) => revokeCredential(clientId)));
+    await Promise.all(credentials.map(({ keyId }) => revokeCredential(keyId)));
     return callback();
   };
 
@@ -141,9 +142,8 @@ export const azureClientSecretRotationFactory: TRotationFactory<
     callback
   ) => {
     const newCredentials = await $rotateClientSecret();
-
+    if (oldCredentials?.keyId) {
-    if (oldCredentials?.clientId) {
+      await revokeCredential(oldCredentials.keyId);
-      await revokeCredential(oldCredentials.clientId);
     }
 
     return callback(newCredentials);
@@ -154,7 +154,10 @@ export const azureClientSecretRotationFactory: TRotationFactory<
    */
   const getSecretsPayload: TRotationFactoryGetSecretsPayload<TAzureClientSecretRotationGeneratedCredentials> = ({
     clientSecret
-  }) => [{ key: secretsMapping.clientSecret, value: clientSecret }];
+  }) => [
+    { key: secretsMapping.clientSecret, value: clientSecret },
+    { key: secretsMapping.clientId, value: clientIdParam }
+  ];
 
   return {
     issueCredentials,

backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-schemas.ts

@@ -13,7 +13,8 @@ import { AppConnection } from "@app/services/app-connection/app-connection-enums
 export const AzureClientSecretRotationGeneratedCredentialsSchema = z
   .object({
     clientId: z.string(),
-    clientSecret: z.string()
+    clientSecret: z.string(),
+    keyId: z.string()
   })
   .array()
   .min(1)
@@ -21,7 +22,8 @@ export const AzureClientSecretRotationGeneratedCredentialsSchema = z
 
 const AzureClientSecretRotationParametersSchema = z.object({
   appId: z.string().trim().min(1, "App ID Required").describe(SecretRotations.PARAMETERS.AZURE_CLIENT_SECRET.appId),
-  appName: z.string().trim().describe(SecretRotations.PARAMETERS.AZURE_CLIENT_SECRET.appName).optional()
+  appName: z.string().trim().describe(SecretRotations.PARAMETERS.AZURE_CLIENT_SECRET.appName).optional(),
+  clientId: z.string().trim().describe(SecretRotations.PARAMETERS.AZURE_CLIENT_SECRET.clientId)
 });
 
 const AzureClientSecretRotationSecretsMappingSchema = z.object({

backend/src/lib/api-docs/constants.ts

@@ -2089,7 +2089,8 @@ export const SecretRotations = {
     },
     AZURE_CLIENT_SECRET: {
       appId: "The ID of the Azure Application to rotate the client secret for.",
-      appName: "The name of the Azure Application to rotate the client secret for."
+      appName: "The name of the Azure Application to rotate the client secret for.",
+      clientId: "The client ID of the Azure Application to rotate the client secret for."
     },
     LDAP_PASSWORD: {
       dn: "The Distinguished Name (DN) of the principal to rotate the password for."

docs/documentation/platform/secret-rotation/azure-client-secret.mdx

@@ -75,6 +75,7 @@ description: "Learn how to automatically rotate Azure Client Secrets."
             },
             "parameters": {
                 "appId": "...",
+                "clientId": "...",
                 "appName": "..."
             },
             "secretsMapping": {
@@ -131,7 +132,8 @@ description: "Learn how to automatically rotate Azure Client Secrets."
                 "type": "azure-client-secret",
                 "parameters": {
                     "appId": "...",
-                    "appName": "..."
+                    "appName": "...",
+                    "clientId": "..."
                 }
             }
         }

frontend/src/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/ViewAzureClientSecretRotationGeneratedCredentials.tsx

@@ -19,7 +19,7 @@ export const ViewAzureClientSecretRotationGeneratedCredentials = ({
     <ViewRotationGeneratedCredentialsDisplay
       activeCredentials={
         <>
-          <CredentialDisplay label="Secret ID">{activeCredentials?.clientId}</CredentialDisplay>
+          <CredentialDisplay label="Client ID">{activeCredentials?.clientId}</CredentialDisplay>
           <CredentialDisplay isSensitive label="Client Secret">
             {activeCredentials?.clientSecret}
           </CredentialDisplay>
@@ -27,7 +27,7 @@ export const ViewAzureClientSecretRotationGeneratedCredentials = ({
       }
       inactiveCredentials={
         <>
-          <CredentialDisplay label="Secret ID">{inactiveCredentials?.clientId}</CredentialDisplay>
+          <CredentialDisplay label="Client ID">{inactiveCredentials?.clientId}</CredentialDisplay>
           <CredentialDisplay isSensitive label="Client Secret">
             {inactiveCredentials?.clientSecret}
           </CredentialDisplay>

frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ParametersFields/AzureClientSecretRotationParametersFields.tsx

@@ -61,6 +61,7 @@ export const AzureClientSecretRotationParametersFields = () => {
             onChange={(option) => {
               onChange((option as SingleValue<TAzureClient>)?.id ?? null);
               setValue("parameters.appName", (option as SingleValue<TAzureClient>)?.name ?? "");
+              setValue("parameters.clientId", (option as SingleValue<TAzureClient>)?.appId ?? "");
             }}
             options={clients}
             placeholder="Select an application..."

frontend/src/components/secret-rotations-v2/forms/SecretRotationV2SecretsMappingFields/AzureClientSecretRotationSecretsMappingFields.tsx

@@ -16,6 +16,24 @@ export const AzureClientSecretRotationSecretsMappingFields = () => {
   const { rotationOption } = useSecretRotationV2Option(SecretRotation.AzureClientSecret);
 
   const items = [
+    {
+      name: "Client ID",
+      input: (
+        <Controller
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl isError={Boolean(error)} errorText={error?.message}>
+              <Input
+                value={value}
+                onChange={onChange}
+                placeholder={rotationOption?.template.secretsMapping.clientId}
+              />
+            </FormControl>
+          )}
+          control={control}
+          name="secretsMapping.clientId"
+        />
+      )
+    },
     {
       name: "Client Secret",
       input: (

frontend/src/components/secret-rotations-v2/forms/schemas/azure-client-secret-rotation-schema.ts

@@ -8,7 +8,8 @@ export const AzureClientSecretRotationSchema = z
     type: z.literal(SecretRotation.AzureClientSecret),
     parameters: z.object({
       appId: z.string().trim().min(1, "App ID required"),
-      appName: z.string().trim().min(1, "App Name required")
+      appName: z.string().trim().min(1, "App Name required"),
+      clientId: z.string().trim().min(1, "Client ID required")
     }),
     secretsMapping: z.object({
       clientId: z.string().trim().min(1, "Client ID required"),

frontend/src/hooks/api/appConnections/azure/types.ts

@@ -1,4 +1,5 @@
 export type TAzureClient = {
   name: string;
+  appId: string;
   id: string;
 };