ministryofjustice / find-moj-data

Find MOJ data service • This repository is defined and managed in Terraform

MIT License

5 stars 0 forks source link

Tech Services work for AAD in new environments #139

Open seanprivett opened 6 months ago

seanprivett commented 6 months ago

History

The last time we needed to create an AAD App on the production tennant we were required to follow the change process below.

Application first created and tested in the dev AAD tenant (labs and tech services)
CAB change raised to implement application in the Prod Tennant. The raising and subsequent approval of the change is subject to an approximate one week lead time. (tech services)
Production implementation and testing following on from successful CAB approval (Implementation - Tech services, Testing - Labs)

Possible Options

Reuse existing apps
Create one app for multiple environments

New app registrations required:

2X DataHub (preprod, test)
3X find-moj-data (dev, preprod, test)

mitchdawson1982 commented 6 months ago

Created find-moj-data-dev, test & preprod, and data-platform-datahub-test, preprod in the prod tennant so that they can be replicated in dev for testing prior to the change.
Jacob Khoo no longer works for the MOJ so I have had to chase around looking for an alternative contact.
Awaiting a response from David Marshall
Have gone around the houses trying to get a valid contact, it appears that Lee Parker-Walsh might be our guy, he is off returning Monday 24th March.
Having spoken to Matt White this morning he has advised emailing idam@justice.gov.uk & idamteam@justice.gov.uk which I have done.
Update: Currently being handled by Shakeel.Mohammed@justice.gov.uk, awaiting outcome of his review into the request.
Change being raised for implementation next week

mitchdawson1982 commented 5 months ago

The tech services changes have been implemented and the two new Datahub Entra apps have been tested successfully. I have validated that the find-moj-data apps are identical in their configuration to the tested datahub ones, but as we are not in a position to test these yet (no AD on the front end) I wont test these in the same way.