Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Azure secrets engine to use MS Graph #12629

Merged
merged 4 commits into from Sep 29, 2021
Merged

Update Azure secrets engine to use MS Graph #12629

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
700a041
Update Azure secrets engine to use MS Graph
pcman312 Sep 24, 2021
f9356d2
Add changelog
pcman312 Sep 24, 2021
27d7190
Add docs for MS graph
pcman312 Sep 24, 2021
ff2a7e2
Merge branch 'main' into azure-ms-graph
pcman312 Sep 28, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 3 additions & 0 deletions changelog/12629.txt
View file
Open in desktop
@@ -0,0 +1,3 @@
```release-note:improvement
secrets/azure: Adds support for using Microsoft Graph API since Azure Active Directory API is being removed in 2022. [#67](https://github.com/hashicorp/vault-plugin-secrets-azure/pull/67)
```
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Expand Up @@ -107,7 +107,7 @@ require (
github.com/hashicorp/vault-plugin-mock v0.16.1
github.com/hashicorp/vault-plugin-secrets-ad v0.10.0
github.com/hashicorp/vault-plugin-secrets-alicloud v0.9.0
github.com/hashicorp/vault-plugin-secrets-azure v0.10.0
github.com/hashicorp/vault-plugin-secrets-azure v0.6.3-0.20210924190759-58a034528e35
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know why this is going to 0.6.3, but the commit hash is correct.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the repo needs to be tagged to v0.11.0 and we add that here. Thoughts?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was going to wait on tagging the repo since I'm going to be working on root credential rotation next. I can tag it now though if you prefer?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah good point, let's wait on tagging.

github.com/hashicorp/vault-plugin-secrets-gcp v0.10.2
github.com/hashicorp/vault-plugin-secrets-gcpkms v0.9.0
github.com/hashicorp/vault-plugin-secrets-kv v0.5.7-0.20210811133805-e060c2307b24
Expand Down
2 changes: 2 additions & 0 deletions go.sum
View file
Open in desktop
Expand Up @@ -751,6 +751,8 @@ github.com/hashicorp/vault-plugin-secrets-ad v0.10.0 h1:iMS1SfIQtPfvPbw24W8HbNBb
github.com/hashicorp/vault-plugin-secrets-ad v0.10.0/go.mod h1:4AN/0ynq1Krn7LhwzoP/roj9JRdxiuptPpktq7ftLjo=
github.com/hashicorp/vault-plugin-secrets-alicloud v0.9.0 h1:EhTRXoWCjM3suD1atK97R2wWHBr/aacYByRnjzZvFCI=
github.com/hashicorp/vault-plugin-secrets-alicloud v0.9.0/go.mod h1:SSkKpSTOMnX84PfgYiWHgwVg+YMhxHNjo+YCJGNBoZk=
github.com/hashicorp/vault-plugin-secrets-azure v0.6.3-0.20210924190759-58a034528e35 h1:EOw71K6RZcteApYrO4TfJeDcppRzOyCNRO7I66RzMbk=
github.com/hashicorp/vault-plugin-secrets-azure v0.6.3-0.20210924190759-58a034528e35/go.mod h1:Tqe5hI33oQ+bHLy/dE4zmvcJD1afRnjsrc5SjUgqvZ8=
github.com/hashicorp/vault-plugin-secrets-azure v0.10.0 h1:pJTWKVHYqfnlB3xg3XnnF9BOpj2/J7LC/e0RgiwkwKI=
github.com/hashicorp/vault-plugin-secrets-azure v0.10.0/go.mod h1:4jCVjTG809NCQ8mrSnbBtX17gX1Iush+558BVO6MJeo=
github.com/hashicorp/vault-plugin-secrets-gcp v0.10.2 h1:+DtlYJTsrFRInQpAo09KkYN64scrextjBiTSunpluo8=
Expand Down
11 changes: 10 additions & 1 deletion website/content/api-docs/secret/azure.mdx
View file
Open in desktop
Expand Up @@ -36,6 +36,14 @@ service principals. Environment variables will override any parameters set in th
environment variable. If not specified, Vault will use Azure Public Cloud.
- `password_policy` `(string: "")` - Specifies a [password policy](/docs/concepts/password-policies) to
use when creating dynamic credentials. Defaults to generating an alphanumeric password if not set.
- `use_microsoft_graph_api` `(bool: false)` - Indicates whether the secrets engine should use the
[Microsoft Graph API](https://docs.microsoft.com/en-us/graph/use-the-api). If set to false, this will use the Azure
Active Directory API which has been [deprecated by Microsoft and will be removed in 2022](https://docs.microsoft.com/en-us/graph/migrate-azure-ad-graph-faq).

If set to true, the user specified via the `client_id` and `client_secret` will need to have the following permissions
under the Microsoft Graph API: `Application.ReadWrite.All`, `Directory.ReadWrite.All`, and `Group.ReadWrite.All`.

Aside from the permissions listed above, setting this to true should be transparent to users.

### Sample Payload

Expand All @@ -46,7 +54,8 @@ service principals. Environment variables will override any parameters set in th
"client_id": "e607c4...",
"client_secret": "9a6346...",
"environment": "AzureGermanCloud",
"password_policy": "azure_policy"
"password_policy": "azure_policy",
"use_microsoft_graph_api": true
}
```

Expand Down
6 changes: 6 additions & 0 deletions website/content/docs/secrets/azure.mdx
View file
Open in desktop
Expand Up @@ -21,6 +21,12 @@ If an existing service principal is specified as part of the role configuration,
a new password will be dynamically generated instead of a new service principal.
The password will be deleted when the lease is revoked.

~> Microsoft has deprecated their Azure Active Directory API and will be removing it in
2022. If you are currently using this secret engine, you will need to update the
credentials to include Microsoft Graph API permissions and specify the
`use_microsoft_graph_api` configuration value as true. See the
[API Docs](/api-docs/secret/azure#use_microsoft_graph_api) for more details.

## Setup

Most secrets engines must be configured in advance before they can perform their
Expand Down