diff --git a/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-schemas.ts b/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-schemas.ts index 514ea815d..af5448467 100644 --- a/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-schemas.ts +++ b/backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-schemas.ts @@ -20,7 +20,7 @@ export const AzureClientSecretRotationGeneratedCredentialsSchema = z .max(2); const AzureClientSecretRotationParametersSchema = z.object({ - appId: z.string().trim().min(1, "Client ID Required").describe(SecretRotations.PARAMETERS.AZURE_CLIENT_SECRET.appId), + appId: z.string().trim().min(1, "App ID Required").describe(SecretRotations.PARAMETERS.AZURE_CLIENT_SECRET.appId), appName: z .string() .trim() diff --git a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-maps.ts b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-maps.ts index 4e585ce27..63eb5d6a3 100644 --- a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-maps.ts +++ b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-maps.ts @@ -3,7 +3,7 @@ import { AppConnection } from "@app/services/app-connection/app-connection-enums export const SECRET_ROTATION_NAME_MAP: Record = { [SecretRotation.PostgresCredentials]: "PostgreSQL Credentials", - [SecretRotation.MsSqlCredentials]: "Microsoft SQL Sever Credentials", + [SecretRotation.MsSqlCredentials]: "Microsoft SQL Server Credentials", [SecretRotation.Auth0ClientSecret]: "Auth0 Client Secret", [SecretRotation.AzureClientSecret]: "Azure Client Secret" }; diff --git a/backend/src/server/routes/v1/app-connection-routers/index.ts b/backend/src/server/routes/v1/app-connection-routers/index.ts index 4abffb478..179326cca 100644 --- a/backend/src/server/routes/v1/app-connection-routers/index.ts +++ b/backend/src/server/routes/v1/app-connection-routers/index.ts @@ -25,6 +25,7 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record { }; }; +const EXPIRATION_TIME = 300000; + export const getAzureConnectionAccessToken = async ( connectionId: string, appConnectionDAL: Pick, @@ -62,9 +64,10 @@ export const getAzureConnectionAccessToken = async ( })) as TAzureClientSecretsConnectionCredentials; const { expiresAt, refreshToken } = credentials; + const currentTime = Date.now(); // get new token if expired or less than 5 minutes until expiry - if (Date.now() < expiresAt - 300000) { + if (currentTime < expiresAt - EXPIRATION_TIME) { return credentials.accessToken; } @@ -82,7 +85,7 @@ export const getAzureConnectionAccessToken = async ( const updatedCredentials = { ...credentials, accessToken: data.access_token, - expiresAt: Date.now() + data.expires_in * 1000, + expiresAt: currentTime + data.expires_in * 1000, refreshToken: data.refresh_token }; @@ -102,6 +105,10 @@ export const validateAzureClientSecretsConnectionCredentials = async (config: TA const { INF_APP_CONNECTION_AZURE_CLIENT_ID, INF_APP_CONNECTION_AZURE_CLIENT_SECRET, SITE_URL } = getConfig(); + if (!SITE_URL) { + throw new InternalServerError({ message: "SITE_URL env var is required to complete Azure OAuth flow" }); + } + if (!INF_APP_CONNECTION_AZURE_CLIENT_ID || !INF_APP_CONNECTION_AZURE_CLIENT_SECRET) { throw new InternalServerError({ message: `Azure ${getAppConnectionMethodName(method)} environment variables have not been configured` diff --git a/backend/src/services/app-connection/azure-client-secrets/azure-client-secrets-connection-types.ts b/backend/src/services/app-connection/azure-client-secrets/azure-client-secrets-connection-types.ts index 6e7580149..fb20fbadd 100644 --- a/backend/src/services/app-connection/azure-client-secrets/azure-client-secrets-connection-types.ts +++ b/backend/src/services/app-connection/azure-client-secrets/azure-client-secrets-connection-types.ts @@ -1,4 +1,4 @@ -import z from "zod"; +import { z } from "zod"; import { DiscriminativePick } from "@app/lib/types"; diff --git a/backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-fns.ts b/backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-fns.ts index ee90b33ee..116597ec4 100644 --- a/backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-fns.ts +++ b/backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-fns.ts @@ -43,7 +43,7 @@ export const getAzureConnectionAccessToken = async ( appConnection.app !== AppConnection.AzureAppConfiguration && appConnection.app !== AppConnection.AzureClientSecrets ) { - throw new BadRequestError({ message: `Connection with ID '${connectionId}' is not an Azure Key Vault connection` }); + throw new BadRequestError({ message: `Connection with ID '${connectionId}' is not a valid Azure connection` }); } const credentials = (await decryptAppConnectionCredentials({ diff --git a/docs/integrations/app-connections/azure-client-secrets.mdx b/docs/integrations/app-connections/azure-client-secrets.mdx index d18865a6d..9519b5d31 100644 --- a/docs/integrations/app-connections/azure-client-secrets.mdx +++ b/docs/integrations/app-connections/azure-client-secrets.mdx @@ -1,6 +1,6 @@ --- title: "Azure Client Secrets Connection" -description: "Learn how to configure a Azure Client Secrets Connection for Infisical." +description: "Learn how to configure an Azure Client Secrets Connection for Infisical." --- Infisical currently only supports one method for connecting to Azure, which is OAuth. @@ -32,7 +32,7 @@ Infisical currently only supports one method for connecting to Azure, which is O - For the Azure Connection to work with Client Secrets, you need to assign multiple permissions to the application. + For the Azure Connection to work with Client Secrets, you need to assign the following permission to the application. #### Azure Client Secrets permissions @@ -81,10 +81,10 @@ Infisical currently only supports one method for connecting to Azure, which is O You will then be redirected to Azure to grant Infisical access to your Azure account. Once granted, - you will redirect you back to Infisical's App Connections page. ![Azure Client Secrets + you will be redirected back to Infisical's App Connections page. ![Azure Client Secrets Authorization](/images/app-connections/azure/grant-access.png) - Your **Azure Client Secrets Connection** is now available for use. ![Assume Role AWS Connection](/images/app-connections/azure/client-secrets/oauth-connection.png) + Your **Azure Client Secrets Connection** is now available for use. ![Azure Client Secrets](/images/app-connections/azure/client-secrets/oauth-connection.png) diff --git a/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2SecretsMappingFields/AzureClientSecretRotationSecretsMappingFields.tsx b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2SecretsMappingFields/AzureClientSecretRotationSecretsMappingFields.tsx index 77a34d083..050fed171 100644 --- a/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2SecretsMappingFields/AzureClientSecretRotationSecretsMappingFields.tsx +++ b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2SecretsMappingFields/AzureClientSecretRotationSecretsMappingFields.tsx @@ -43,6 +43,7 @@ export const AzureClientSecretRotationSecretsMappingFields = () => { diff --git a/frontend/src/components/secret-rotations-v2/forms/schemas/index.ts b/frontend/src/components/secret-rotations-v2/forms/schemas/index.ts index e6b4bad6c..794377810 100644 --- a/frontend/src/components/secret-rotations-v2/forms/schemas/index.ts +++ b/frontend/src/components/secret-rotations-v2/forms/schemas/index.ts @@ -6,10 +6,10 @@ import { MsSqlCredentialsRotationSchema } from "@app/components/secret-rotations import { PostgresCredentialsRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/postgres-credentials-rotation-schema"; const SecretRotationUnionSchema = z.discriminatedUnion("type", [ - PostgresCredentialsRotationSchema, - MsSqlCredentialsRotationSchema, Auth0ClientSecretRotationSchema, - AzureClientSecretRotationSchema + AzureClientSecretRotationSchema, + PostgresCredentialsRotationSchema, + MsSqlCredentialsRotationSchema ]); export const SecretRotationV2FormSchema = SecretRotationUnionSchema; diff --git a/frontend/src/hooks/api/appConnections/types/index.ts b/frontend/src/hooks/api/appConnections/types/index.ts index dc398d0ab..047342fb1 100644 --- a/frontend/src/hooks/api/appConnections/types/index.ts +++ b/frontend/src/hooks/api/appConnections/types/index.ts @@ -80,6 +80,7 @@ export type TAppConnectionMap = { [AppConnection.GCP]: TGcpConnection; [AppConnection.AzureKeyVault]: TAzureKeyVaultConnection; [AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnection; + [AppConnection.AzureClientSecrets]: TAzureClientSecretsConnection; [AppConnection.Databricks]: TDatabricksConnection; [AppConnection.Humanitec]: THumanitecConnection; [AppConnection.TerraformCloud]: TTerraformCloudConnection; @@ -87,7 +88,6 @@ export type TAppConnectionMap = { [AppConnection.Postgres]: TPostgresConnection; [AppConnection.MsSql]: TMsSqlConnection; [AppConnection.Camunda]: TCamundaConnection; - [AppConnection.AzureClientSecrets]: TAzureClientSecretsConnection; [AppConnection.Windmill]: TWindmillConnection; [AppConnection.Auth0]: TAuth0Connection; }; diff --git a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AzureClientSecretsConnectionForm.tsx b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AzureClientSecretsConnectionForm.tsx index e1d978eac..b7ae7352e 100644 --- a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AzureClientSecretsConnectionForm.tsx +++ b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AzureClientSecretsConnectionForm.tsx @@ -83,15 +83,7 @@ export const AzureClientSecretsConnectionForm = ({ appConnection }: Props) => { } }; - let isMissingConfig: boolean; - - switch (selectedMethod) { - case AzureClientSecretsConnectionMethod.OAuth: - isMissingConfig = !oauthClientId; - break; - default: - throw new Error(`Unhandled Azure Connection method: ${selectedMethod}`); - } + const isMissingConfig = !oauthClientId; const methodDetails = getAppConnectionMethodDetails(selectedMethod);