mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-09 18:28:27 +00:00
Merge pull request #3440 from Infisical/feat/azureClientSecretsRotation
Feat/azure client secrets rotation
This commit is contained in:
Maidul Islam
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Available"
|
||||
openapi: "GET /api/v1/app-connections/azure-client-secrets/available"
|
||||
---
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/app-connections/azure-client-secrets"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Azure Client Secret Connections must be created through the Infisical UI.
|
||||
Check out the configuration docs for [Azure Client Secret Connections](/integrations/app-connections/azure-client-secrets) for a step-by-step
|
||||
guide.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/app-connections/azure-client-secrets/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/app-connections/azure-client-secrets/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/app-connections/azure-client-secrets/connection-name/{connectionName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/app-connections/azure-client-secrets"
|
||||
---
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/app-connections/azure-client-secrets/{connectionId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Azure Client Secret Connections must be updated through the Infisical UI.
|
||||
Check out the configuration docs for [Azure Client Secret Connections](/integrations/app-connections/azure-client-secrets) for a step-by-step
|
||||
guide.
|
||||
</Note>
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v2/secret-rotations/azure-client-secret"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Azure Client Secret Rotations](/documentation/platform/secret-rotation/azure-client-secret) to learn how to obtain the
|
||||
required parameters.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v2/secret-rotations/azure-client-secret/{rotationId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v2/secret-rotations/azure-client-secret/{rotationId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v2/secret-rotations/azure-client-secret/rotation-name/{rotationName}"
|
||||
---
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get Credentials by ID"
|
||||
openapi: "GET /api/v2/secret-rotations/azure-client-secret/{rotationId}/generated-credentials"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v2/secret-rotations/azure-client-secret"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Rotate Secrets"
|
||||
openapi: "POST /api/v2/secret-rotations/azure-client-secret/{rotationId}/rotate-secrets"
|
||||
---
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v2/secret-rotations/azure-client-secret/{rotationId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Azure Client Secret Rotations](/documentation/platform/secret-rotation/azure-client-secret) to learn how to obtain the
|
||||
required parameters.
|
||||
</Note>
|
||||
@@ -0,0 +1,142 @@
|
||||
---
|
||||
title: "Azure Client Secret"
|
||||
description: "Learn how to automatically rotate Azure Client Secrets."
|
||||
---
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Create an [Azure Client Secret Connection](/integrations/app-connections/azure-client-secrets).
|
||||
|
||||
## Create an Azure Client Secret Rotation in Infisical
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to your Secret Manager Project's Dashboard and select **Add Secret Rotation** from the actions dropdown.
|
||||
|
||||
|
||||
2. Select the **Azure Client Secret** option.
|
||||
|
||||
|
||||
3. Select the **Azure Connection** to use and configure the rotation behavior. Then click **Next**.
|
||||
|
||||
|
||||
- **Azure Connection** - the connection that will perform the rotation of the specified application's Client Secret.
|
||||
- **Rotation Interval** - the interval, in days, that once elapsed will trigger a rotation.
|
||||
- **Rotate At** - the local time of day when rotation should occur once the interval has elapsed.
|
||||
- **Auto-Rotation Enabled** - whether secrets should automatically be rotated once the rotation interval has elapsed. Disable this option to manually rotate secrets or pause secret rotation.
|
||||
|
||||
4. Select the Azure application whose Client Secret you want to rotate. Then click **Next**.
|
||||
|
||||
|
||||
5. Specify the secret names that the client credentials should be mapped to. Then click **Next**.
|
||||
|
||||
|
||||
- **Client ID** - the name of the secret that the application Client ID will be mapped to.
|
||||
- **Client Secret** - the name of the secret that the rotated Client Secret will be mapped to.
|
||||
|
||||
6. Give your rotation a name and description (optional). Then click **Next**.
|
||||
|
||||
|
||||
- **Name** - the name of the secret rotation configuration. Must be slug-friendly.
|
||||
- **Description** (optional) - a description of this rotation configuration.
|
||||
|
||||
7. Review your configuration, then click **Create Secret Rotation**.
|
||||
|
||||
|
||||
8. Your **Azure Client Secret** credentials are now available for use via the mapped secrets.
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an Azure Client Secret Rotation, make an API request to the [Create Azure
|
||||
Client Secret Rotation](/api-reference/endpoints/secret-rotations/azure-client-secret/create) API endpoint.
|
||||
|
||||
You will first need the **Client ID** and **Object ID** of the Azure application you want to rotate the secret for. This can be obtained from the Applications dashboard.
|
||||
|
||||
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://us.infisical.com/api/v2/secret-rotations/azure-client-secret \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-azure-rotation",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "my client secret rotation",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"environment": "dev",
|
||||
"secretPath": "/",
|
||||
"isAutoRotationEnabled": true,
|
||||
"rotationInterval": 30,
|
||||
"rotateAtUtc": {
|
||||
"hours": 0,
|
||||
"minutes": 0
|
||||
},
|
||||
"parameters": {
|
||||
"objectId": "...",
|
||||
"clientId": "...",
|
||||
"appName": "..."
|
||||
},
|
||||
"secretsMapping": {
|
||||
"clientId": "AZURE_CLIENT_ID",
|
||||
"clientSecret": "AZURE_CLIENT_SECRET"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"secretRotation": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-azure-rotation",
|
||||
"description": "my client secret rotation",
|
||||
"secretsMapping": {
|
||||
"clientId": "AZURE_CLIENT_ID",
|
||||
"clientSecret": "AZURE_CLIENT_SECRET"
|
||||
},
|
||||
"isAutoRotationEnabled": true,
|
||||
"activeIndex": 0,
|
||||
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-11-07T05:31:56Z",
|
||||
"updatedAt": "2023-11-07T05:31:56Z",
|
||||
"rotationInterval": 30,
|
||||
"rotationStatus": "success",
|
||||
"lastRotationAttemptedAt": "2023-11-07T05:31:56Z",
|
||||
"lastRotatedAt": "2023-11-07T05:31:56Z",
|
||||
"lastRotationJobId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"nextRotationAt": "2023-11-07T05:31:56Z",
|
||||
"connection": {
|
||||
"app": "azure",
|
||||
"name": "my-azure-connection",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"environment": {
|
||||
"slug": "dev",
|
||||
"name": "Development",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"folder": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"path": "/"
|
||||
},
|
||||
"rotateAtUtc": {
|
||||
"hours": 0,
|
||||
"minutes": 0
|
||||
},
|
||||
"lastRotationMessage": null,
|
||||
"type": "azure-client-secret",
|
||||
"parameters": {
|
||||
"objectId": "...",
|
||||
"appName": "...",
|
||||
"clientId": "..."
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 566 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 578 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 857 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 580 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 600 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 259 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 531 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 866 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 500 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 509 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 504 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 497 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 539 KiB |
@@ -0,0 +1,103 @@
|
||||
---
|
||||
title: "Azure Client Secrets Connection"
|
||||
description: "Learn how to configure an Azure Client Secrets Connection for Infisical."
|
||||
---
|
||||
|
||||
Infisical currently only supports one method for connecting to Azure, which is OAuth.
|
||||
|
||||
<Accordion title="Self-Hosted Instance">
|
||||
Using the Azure Client Secrets connection on a self-hosted instance of Infisical requires configuring an application in Azure
|
||||
and registering your instance with it.
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up Azure.
|
||||
|
||||
<Steps>
|
||||
<Step title="Create an application in Azure">
|
||||
Navigate to Azure Active Directory > App registrations to create a new application.
|
||||
|
||||
<Info>
|
||||
Azure Active Directory is now Microsoft Entra ID.
|
||||
</Info>
|
||||
|
||||
|
||||
|
||||
Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/organization/app-connections/azure/oauth/callback`.
|
||||
<Tip>
|
||||
The domain you defined in the Redirect URI should be equivalent to the `SITE_URL` configured in your Infisical instance.
|
||||
</Tip>
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Assign API permissions to the application">
|
||||
|
||||
For the Azure Connection to work with Client Secrets, you need to assign the following permission to the application.
|
||||
|
||||
#### Azure Client Secrets permissions
|
||||
|
||||
Set the API permissions of the Azure application to include the following permissions:
|
||||
- Microsoft Graph
|
||||
- `Application.ReadWrite.All`
|
||||
- `Application.ReadWrite.OwnedBy`
|
||||
- `Application.ReadWrite.All` (Delegated)
|
||||
- `Directory.ReadWrite.All` (Delegated)
|
||||
- `User.Read` (Delegated)
|
||||
- Azure App Configuration
|
||||
- `KeyValue.Delete` (Delegated)
|
||||
- `KeyValue.Read` (Delegated)
|
||||
- `KeyValue.Write` (Delegated)
|
||||
- Access Key Vault
|
||||
- `user_impersonation` (Delegated)
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Add your application credentials to Infisical">
|
||||
Obtain the **Application (Client) ID** and **Directory (Tenant) ID** (this will be used later in the Infisical connection) in Overview and generate a **Client Secret** in Certificate & secrets for your Azure application.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Back in your Infisical instance, add two new environment variables for the credentials of your Azure application.
|
||||
|
||||
- `INF_APP_CONNECTION_AZURE_CLIENT_ID`: The **Application (Client) ID** of your Azure application.
|
||||
- `INF_APP_CONNECTION_AZURE_CLIENT_SECRET`: The **Client Secret** of your Azure application.
|
||||
|
||||
Once added, restart your Infisical instance and use the Azure Client Secrets connection.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Accordion>
|
||||
|
||||
## Setup Azure Connection in Infisical
|
||||
|
||||
<Steps>
|
||||
<Step title="Navigate to App Connections">
|
||||
Navigate to the **App Connections** tab on the **Organization Settings** page. 
|
||||
</Step>
|
||||
<Step title="Add Connection">
|
||||
Select the **Azure Connection** option from the connection options modal. 
|
||||
</Step>
|
||||
<Step title="Authorize Connection">
|
||||
Fill in the **Tenant ID** field with the Directory (Tenant) ID you obtained in the previous step.
|
||||
|
||||
Now select the **OAuth** method and click **Connect to Azure**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Grant Access">
|
||||
You will then be redirected to Azure to grant Infisical access to your Azure account. Once granted,
|
||||
you will be redirected back to Infisical's App Connections page. 
|
||||
</Step>
|
||||
<Step title="Connection Created">
|
||||
Your **Azure Client Secrets Connection** is now available for use. 
|
||||
</Step>
|
||||
</Steps>
|
||||
@@ -181,6 +181,7 @@
|
||||
"documentation/platform/secret-rotation/overview",
|
||||
"documentation/platform/secret-rotation/auth0-client-secret",
|
||||
"documentation/platform/secret-rotation/aws-iam-user-secret",
|
||||
"documentation/platform/secret-rotation/azure-client-secret",
|
||||
"documentation/platform/secret-rotation/ldap-password",
|
||||
"documentation/platform/secret-rotation/mssql-credentials",
|
||||
"documentation/platform/secret-rotation/postgres-credentials"
|
||||
@@ -430,6 +431,7 @@
|
||||
"integrations/app-connections/auth0",
|
||||
"integrations/app-connections/aws",
|
||||
"integrations/app-connections/azure-app-configuration",
|
||||
"integrations/app-connections/azure-client-secrets",
|
||||
"integrations/app-connections/azure-key-vault",
|
||||
"integrations/app-connections/camunda",
|
||||
"integrations/app-connections/databricks",
|
||||
@@ -887,6 +889,19 @@
|
||||
"api-reference/endpoints/secret-rotations/aws-iam-user-secret/update"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Azure Client Secret",
|
||||
"pages": [
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/create",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/delete",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/get-by-id",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/get-by-name",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/get-generated-credentials-by-id",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/list",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/rotate-secrets",
|
||||
"api-reference/endpoints/secret-rotations/azure-client-secret/update"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "LDAP Password",
|
||||
"pages": [
|
||||
@@ -980,6 +995,18 @@
|
||||
"api-reference/endpoints/app-connections/azure-app-configuration/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Azure Client Secret",
|
||||
"pages": [
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/list",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/available",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/get-by-id",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/get-by-name",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/create",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/update",
|
||||
"api-reference/endpoints/app-connections/azure-client-secret/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Azure Key Vault",
|
||||
"pages": [
|
||||
|
||||
Reference in New Issue
Block a user