🚨 Rotate Join GitHub EntraId Secret Before 12/08/2024

ministryofjustice / operations-engineering

This repository is home to the Operations Engineering's tools and utilities for managing, monitoring, and optimising software development processes at the Ministry of Justice. • This repository is defined and managed in Terraform

https://user-guide.operations-engineering.service.justice.gov.uk/

MIT License

14 stars 5 forks source link

🚨 Rotate Join GitHub EntraId Secret Before 12/08/2024 #4667

Closed connormaglynn closed 3 months ago

connormaglynn commented 3 months ago

User Need

As a Member of Operations Engineering I want to rotate the Join GitHub EntraID Secret Used By Auth0 so that I ensure the service stays up and useable

Value

Will ensure the service doesn't go down once the secret expires

Functional Requirements (What):

[x] A new EntraID secret has been created and provided to the Join GitHub Auth0 Application

Non-Functional Requirements (How):

[x] Ensure secrets are not exposed publicly at any point

Acceptance Criteria:

[x] https://join-github.service.justice.gov.uk/ can still add users after 11/08/24

Notes:

tamsinforbes commented 3 months ago

[ ] Set up Dev Auth0 app, enterprise connection and MS Azure App registration and test with dev join github

tamsinforbes commented 3 months ago

MS Azure App registrations (awaiting approval to become live) MoJ Microsoft Authentication Dev MoJ Microsoft Authentication Prod Corresponding to Auth0 Apps (terraform) MoJ Microsoft Authentication Dev MoJ Microsoft Authentication Prod And Auth0 Authentication Enterprise Connections -> Microsoft Azure AD operations-engineering-dev operations-engineering-prod

connormaglynn commented 3 months ago

🆙 Update

EntraID secret has now been rotated and works as expected in production ✅
The old secret has been removed 🔥

👀 Remaining Work

@tamsinforbes has started separating out the dev and production environment integrations which will enable better testing of work like this in the future - I will create another ticket to capture this work. Due to this, I'll also de-scope this ticket to only care about production working since we are waiting for approvals of the new separated environments.