How to replace an expiring Client Secret without risking downtime?

Question

I am managing a Provider-Hosted SharePoint App/Add-in and the Client Secret that we use to authenticate with SharePoint is due for expiration soon. 3 years ago, when the previous Client Secret was about to expire, we created a new one using the process documented here: https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/replace-an-expiring-client-secret-in-a-sharepoint-add-in However, when the original Secret expired, the site went down, because the new Secret was not working for some unknown reason. We created a new Secret and waited 24 hours for it to propagate before the site resumed working.

In order to avoid an outage this time, I'd like to somehow validate that the new Secret is working before the old one expires. Problem is, according to the documentation and my personal experience:

1. The new Client Secret will not be valid/usable for 24 hours, because it must be propagated to SPO
2. The new Client Secret cannot be used until the old Client Secret has expired.

So if I create a new Client Secret, I have to wait until the old one expires to see if it is working and if I need to create a 2nd new Client Secret, I will have to wait an additional 24 hours to see if that works.

So how can I get a new Secret set up without risking a 24 hour or longer outage?

Answer 1

You can automate secret rotation with help of Azure Key Vault and Azure function.

below are high level steps

• Azure Function will be triggered by azure key vault's "Secret near expiry event".

• Azure function will have PowerShell or code that will generate and create new version of key in Azure key vault.

For more details refer this Microsoft docs

• Rotate keys in key vault
• PowerShell snippet to generate secret

$startDate = Get-Date
$endDate = $startDate.AddYears(3)
$aadAppsecret01 = New-AzureADApplicationPasswordCredential -ObjectId f254eafb-5a7a-4df4-b9f4-ec0b70d5717e -CustomKeyIdentifier "Secret01" -StartDate $startDate -EndDate $endDate

Answer 2

You need to create 2nd secret in advance (24h+) in Partner Portal. Then you'll have 2 secrets - currently working and new not used. You put them both in the config file of your application as in your article:

  <add key="ClientSecret" value="your new secret here" />
  <add key="SecondaryClientSecret" value="your old secret here" />

Thus, your app will know about both secrets and will work with SecondaryClientSecret until it expires and immediately change to ClientSecret after, as you created it in advance.