⭐️ extend microsoft entra id application resource to search for expiring credentials

[chris-rock]

This PR adds a new applicability to quickly identify expiring credentials for Microsoft Entra ID Application Registrations.

First we connect to our Microsoft 365 account via shell cnspec shell ms365 --tenant-id bb22a034-d544-4b9e-a222-6a166840f64c

Quickly see all application in Entra ID

Just type microsoft.applications and you see an overview of all applications and if the application has expired credentials.

cnspec> microsoft.applications
microsoft.applications: [
  0: microsoft.application id="0030c47a-6318-431a-9f85-1b051484c7cf" displayName="chis-mac-testing" hasExpiredCredentials=true
]
cnspec>

Verify an specific application has no expired credentials

For applications it is essential that attached credentials are valid. This can easily be tested via:

cncnspec> microsoft.application(name: "chis-testing").hasExpiredCredentials
[ok] value: true

List all application with expired credentials

For operations, it is important to see easily all applications that have expired credentials. This can easily be achieved via:

cnspec> microsoft.applications.none(hasExpiredCredentials)
[failed] [].none()
  actual:   [
    0: microsoft.application displayName="chis-mac-testing" id="0030c47a-6318-431a-9f85-1b051484c7cf" hasExpiredCredentials=true
  ]

Ensure no client secrets are used

To verify that no applications use client secrets run the following queries:

cnspec> microsoft.applications.none(secrets != empty)
[failed] [].none()
  actual:   [
    0: microsoft.application displayName="chis-mac-testing" id="0030c47a-6318-431a-9f85-1b051484c7cf" hasExpiredCredentials=true {
      secrets: [
        0: microsoft.application microsoft.passwordCredential id = 0030c47a-6318-431a-9f85-1b051484c7cf
      ]
    }
  ]

Application details

We extended the details for applications:

microsoft.application(name: "chis-mac-testing") { * }
microsoft.application: {
  appId: "0030c47a-6318-431a-9f85-1b051484c7cf"
  hasExpiredCredentials: true
  createdAt: 2022-10-08 20:47:57 +0200 CEST
  identifierUris: []
  tags: [
    0: "tag1"
  ]
  name: "chis-mac-testing"
  secrets: [
    0: microsoft.passwordCredential description="Password uploaded on Fri Jul 05 2024" expires=2025-01-01 10:37:17.872 +0100 CET keyId="0030c47a-6318-431a-9f85-1b051484c7cf"
  ]
  certificates: [
    0: microsoft.keyCredential thumbprint="1CECDD980A4F255D399E6C9625C13FBF872CD994" description="O=example, L=SF, S=CA, C=US" expires=2023-10-08 17:42:09 +0200 CEST keyId="8173c250-6909-47af-a56f-6332223eee1a"
  ]
  info: []
  publisherDomain: "exmple.onmicrosoft.com"
  notes: "internal notes"
  createdDateTime: 2022-10-08 20:47:57 +0200 CEST
  description: "description value"
  id: "0030c47a-6318-431a-9f85-1b051484c7cf"
}

[github-actions]

Test Results

3 097 tests   3 096 ✅  1m 27s ⏱️
  370 suites      1 💤
   28 files        0 ❌

Results for commit 8418a8c.

[afiune]

Sweeeeet!! Any way we can have some unit testing at all? 🤔

[chris-rock]

That would require us to mock the azure api. Seems like azure does not have this.