Remove need to provide client secret when creating workspace and remove Directory.Read.All Dependency from automation admin #4775

marrobi · 2025-11-26T17:55:22Z

Summary

Removes the requirement for users to provide a client secret when creating workspaces and eliminates the Directory.Read.All Microsoft Graph permission from the automation admin identity.

Changes

Base workspace bundle 3.0.0: Terraform now creates, imports, and manages workspace Microsoft Entra ID applications automatically, including secret rotation via azuread_application_password resources
API simplification: Removed extract_workspace_auth_information function - workspace auth info is now handled through Terraform outputs
Removed parameters: client_secret, register_aad_application, scope_id, sp_id, app_role_id_*
New script: add_automation_admin_to_workspace_application.sh for adding automation admin as workspace app owner
Permission reduction: Directory.Read.All no longer required; only Application.ReadWrite.All, Group.Create, Group.Read.All, User.ReadBasic.All, DelegatedPermissionGrant.ReadWrite.All (depending on configuration)

Migration

Existing workspaces continue to work without changes
Upgrading: Ensure Application Admin owns the workspace app, then run upgrade - Terraform will import and manage secrets automatically (needs testing)
New workspaces: No client_secret needed; optionally provide client_id to reuse an existing app

Closes #2247

Fixes microsoft#4772

…robi/issue2247

github-actions · 2025-11-26T17:57:31Z

Unit Test Results

664 tests 664 ✅ 7s ⏱️
1 suites 0 💤
1 files 0 ❌

Results for commit 1fb42ea.

♻️ This comment has been updated with latest results.

Copilot

Pull request overview

This PR removes the requirement for users to provide a client secret when creating workspaces and eliminates the Directory.Read.All Microsoft Graph permission dependency from the automation admin identity. The changes introduce automatic workspace app provisioning/import via Terraform with built-in password rotation, simplify the API by removing the extract_workspace_auth_information function, and update all related documentation and scripts.

Key changes include:

Terraform now provisions or imports the workspace Entra ID app automatically with dual password rotation using azuread_application_password resources
API no longer requires Directory.Read.All permissions as workspace auth information is handled via Terraform outputs
Major version bump for base workspace bundle (2.8.0 → 3.0.0) due to breaking changes

Reviewed changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
templates/workspaces/base/terraform/workspace.tf	Adds import block for existing workspace apps and removes conditional AAD module creation
templates/workspaces/base/terraform/variables.tf	Removes register_aad_application and client_secret variables
templates/workspaces/base/terraform/providers.tf	Adds hashicorp/time provider for password rotation
templates/workspaces/base/terraform/outputs.tf	Simplifies outputs to always reference AAD module directly
templates/workspaces/base/terraform/keyvault.tf	Removes manual client_id and client_secret key vault secret resources
templates/workspaces/base/terraform/aad/variables.tf	Adds client_id variable, changes create_aad_groups type to bool
templates/workspaces/base/terraform/aad/providers.tf	Adds time provider requirement
templates/workspaces/base/terraform/aad/aad.tf	Implements dual password rotation with primary/secondary passwords and intelligent current password selection
templates/workspaces/base/terraform/.terraform.lock.hcl	Adds lock file entry for time provider v0.11.0
templates/workspaces/base/template_schema.json	Removes client_secret from schema and moves create_aad_groups to top level
templates/workspaces/base/porter.yaml	Major version bump to 3.0.0, removes register_aad_application and client_secret parameters
api_app/services/authentication.py	Removes extract_auth_information function
api_app/services/access_service.py	Removes extract_workspace_auth_information abstract method
api_app/services/aad_authentication.py	Removes _get_app_auth_info and extract_workspace_auth_information implementation
api_app/db/repositories/workspaces.py	Removes auth_info parameter from create_workspace_item
api_app/api/routes/workspaces.py	Removes extract_auth_information call and auth_info parameter
api_app/_version.py	Minor version bump to 0.25.5
api_app/tests_ma/test_services/test_aad_access_service.py	Removes tests for extract_workspace_auth_information
api_app/tests_ma/test_db/test_repositories/test_workpaces_repository.py	Updates test calls to remove auth_info parameter
api_app/tests_ma/test_api/test_routes/test_workspaces.py	Removes extract_auth_information mock patches
api_app/tests_ma/test_api/test_routes/test_workspace_users.py	Removes auth_info parameter from sample_workspace
docs/tre-developers/end-to-end-tests.md	Adds instructions for adding automation admin as workspace app owner
docs/tre-admins/setup-instructions/ui-install-base-workspace.md	Simplifies workspace app creation script usage
docs/tre-admins/setup-instructions/installing-base-workspace.md	Removes client_secret from workspace creation example
docs/tre-admins/setup-instructions/cicd-pre-deployment-steps.md	Removes TEST_WORKSPACE_APP_SECRET from required secrets
docs/tre-admins/identities/workspace.md	Removes client secret references and simplifies workspace app creation
docs/tre-admins/identities/application_admin.md	Updates required permissions from Directory.Read.All to Group.Read.All and User.ReadBasic.All
docs/tre-admins/environment-variables.md	Updates permission descriptions for auto workspace features
docs/tre-admins/auth.md	Updates permission descriptions and removes workspace_api_client_secret
devops/scripts/setup_local_debugging.sh	Removes TEST_WORKSPACE_APP_SECRET from environment setup
devops/scripts/create_aad_assets.sh	Removes Directory.Read.All from AUTO_WORKSPACE_APP_REGISTRATION permissions and removes automatic workspace app creation
devops/scripts/aad/wait_for_new_app_registration.sh	Minor cleanup removing echo statement
devops/scripts/aad/create_workspace_application.sh	Significantly simplified to only create minimal app registration without consent/permission setup
devops/scripts/aad/add_automation_admin_to_workspace_application.sh	New script for adding automation admin as workspace app owner
core/terraform/outputs.sh	Removes TEST_WORKSPACE_APP_SECRET from private.env
config_schema.json	Removes workspace_api_client_secret from schema
config.sample.yaml	Updates permission descriptions in comments

Files not reviewed (1)

templates/workspaces/base/terraform/.terraform.lock.hcl: Language not supported

docs/tre-admins/auth.md

config.sample.yaml

templates/workspaces/base/porter.yaml

docs/tre-admins/identities/application_admin.md

docs/tre-admins/environment-variables.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 37 out of 38 changed files in this pull request and generated 6 comments.

Files not reviewed (1)

templates/workspaces/base/terraform/.terraform.lock.hcl: Language not supported

api_app/_version.py

templates/workspaces/base/terraform/aad/aad.tf

docs/tre-admins/identities/application_admin.md

docs/tre-admins/environment-variables.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

marrobi · 2026-01-14T12:22:44Z

/test-extended 596a707

github-actions · 2026-01-14T12:23:03Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/20993930675 (with refid 679d0163)

(in response to this comment from @marrobi)

marrobi · 2026-01-14T17:06:54Z

/test-extended 4442d7b

github-actions · 2026-01-14T17:07:20Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21002948067 (with refid 679d0163)

(in response to this comment from @marrobi)

github-actions · 2026-01-15T06:06:13Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21002948067 (with refid 679d0163)

(in response to this comment from @marrobi)

marrobi · 2026-01-20T11:21:46Z

/test-extended

github-actions · 2026-01-20T11:22:02Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21169627084 (with refid 679d0163)

(in response to this comment from @marrobi)

marrobi · 2026-01-21T09:06:00Z

/test-extended

github-actions · 2026-01-21T09:06:16Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21203529948 (with refid 679d0163)

(in response to this comment from @marrobi)

marrobi · 2026-01-22T11:43:32Z

/test-extended 0895032

github-actions · 2026-01-22T11:43:46Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21247157779 (with refid 679d0163)

(in response to this comment from @marrobi)

marrobi · 2026-01-22T13:54:28Z

/test-extended 43e1600

github-actions · 2026-01-22T13:54:46Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21251094929 (with refid 679d0163)

(in response to this comment from @marrobi)

marrobi · 2026-01-22T16:10:17Z

/test-extended 2aacf0e

github-actions · 2026-01-22T16:10:33Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21255656238 (with refid 679d0163)

(in response to this comment from @marrobi)

marrobi added 6 commits November 25, 2025 17:14

Use Group.Create instead of Group.ReadWrite.All for group creation

8a391ec

Fixes microsoft#4772

Deployment works, permetations need testing, and docs updating.

481daf8

Update scripts and docs.

6904b72

Remove need for Directory.Read.All

c755f30

Rotating secret

9fd75cf

Merge branch 'main' of https://github.com/microsoft/AzureTRE into mar…

6114d09

…robi/issue2247

marrobi changed the title ~~Simplify Workspace Entra ID Automation and Remove Directory.Read.All Dependency~~ Remove need to provide client secret when creating workspace and remove Directory.Read.All Dependency Nov 26, 2025

marrobi linked an issue Nov 26, 2025 that may be closed by this pull request

Supply Workspace client secret without having to pass it in the API #2247

Open

3 tasks

marrobi changed the title ~~Remove need to provide client secret when creating workspace and remove Directory.Read.All Dependency~~ Remove need to provide client secret when creating workspace and remove Directory.Read.All Dependency from automation admin Nov 26, 2025

marrobi linked an issue Nov 27, 2025 that may be closed by this pull request

Add docs for rotating workspace app registration secrets. #2903

Open

Merge branch 'main' into marrobi/issue2247

e7479bd

marrobi requested a review from Copilot November 27, 2025 10:34

Copilot started reviewing on behalf of marrobi November 27, 2025 10:35 View session

Copilot finished reviewing on behalf of marrobi November 27, 2025 10:38

Copilot AI reviewed Nov 27, 2025

View reviewed changes

marrobi requested review from Copilot and removed request for Copilot November 27, 2025 10:42

Update docs/tre-admins/auth.md

1b9c090

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started reviewing on behalf of marrobi November 27, 2025 10:43 View session

marrobi and others added 3 commits November 27, 2025 10:44

Update docs/tre-admins/identities/application_admin.md

ccf5aee

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update docs/tre-admins/environment-variables.md

f93845e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update docs/tre-admins/identities/application_admin.md

b79940f

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot finished reviewing on behalf of marrobi November 27, 2025 10:47

Copilot finished reviewing on behalf of marrobi November 27, 2025 10:48

Copilot AI reviewed Nov 27, 2025

View reviewed changes

Update templates/workspaces/base/terraform/aad/aad.tf

173ebd1

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

marrobi assigned Copilot Nov 27, 2025

marrobi added 2 commits January 14, 2026 11:58

Remove passowrd rotation

d41bd73

remvoe wait_for

596a707

Attempt fix e2e tests

4442d7b

Merge branch 'main' into marrobi/issue2247

b75ce2f

Merge branch 'main' into marrobi/issue2247

47d6ca8

Add functions to manage token retrieval and role propagation checks

0895032

marrobi added 4 commits January 22, 2026 12:35

Fix linting

3ac17c1

fix linting

066f79e

stop linting remote modules

4e897f2

Merge branch 'main' into marrobi/issue2247

43e1600

marrobi added 4 commits January 22, 2026 14:06

fix tflint rules

cee5e3a

Modify tflint rules

26e1f24

Fix role assignment for service principals in group membership

31dcb0f

up version

2aacf0e

Raise error on failed group membership assignment

1fb42ea

Remove need to provide client secret when creating workspace and remove Directory.Read.All Dependency from automation admin #4775

Are you sure you want to change the base?

Remove need to provide client secret when creating workspace and remove Directory.Read.All Dependency from automation admin #4775

Uh oh!

Conversation

marrobi commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Migration

Uh oh!

github-actions bot commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Unit Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

marrobi commented Jan 14, 2026

Uh oh!

github-actions bot commented Jan 14, 2026

Uh oh!

marrobi commented Jan 14, 2026

Uh oh!

github-actions bot commented Jan 14, 2026

Uh oh!

github-actions bot commented Jan 15, 2026

Uh oh!

marrobi commented Jan 20, 2026

Uh oh!

github-actions bot commented Jan 20, 2026

Uh oh!

marrobi commented Jan 21, 2026

Uh oh!

github-actions bot commented Jan 21, 2026

Uh oh!

marrobi commented Jan 22, 2026

Uh oh!

github-actions bot commented Jan 22, 2026

Uh oh!

marrobi commented Jan 22, 2026

Uh oh!

github-actions bot commented Jan 22, 2026

Uh oh!

marrobi commented Jan 22, 2026

Uh oh!

github-actions bot commented Jan 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

marrobi commented Nov 26, 2025 •

edited

Loading

github-actions bot commented Nov 26, 2025 •

edited

Loading