Join Log in
Score:0
Nordes avatar Server

Azure EventHub - Create 1 Service Principal per writer [OR] multiple certificates (1 per writer) over 1 Service Principal

co flag
Nordes

I was wondering for my scenario what would be best. I understand that usually you want only 1 Service Principal (SP) per application. Since I didn't find any clear answer about my scenario, here's the details.

However, let's assume the following:

  • I have a small app. installed at every customer I have (let's assume 100)
  • Each customer will be sending events to EventHub (send only)
  • The small app uses credentials to connect to my service in order to retrieve a key for event hub
  • My service connect to azure and when the small app request EventHub credentials I send back either a Secret/Certificate

So basically, should I:

  1. manage 1 SP per customer ?
  2. Create/manage many secret/certificate for an SP (1 per customer let's say)
  3. From my service use 1 SP + 1 certificate and use it to create a new token that would then be served for my small app
    • Draw back, from my understanding, we can't invalidate the token once it's being in use until it tries to reconnect

Note: Of course it's not about doing the 3 of them, only 1.

I saw the following on https://docs.microsoft.com/en-us/azure/event-hubs/authorize-access-shared-access-signature:

If your application needs to grant access to Event Hubs resources based on user or service identities, it should implement a security token service that issues SAS tokens after an authentication and access check.

so my guess would be that option 3 is the way to go

51
1 + 0
Score:1
avatar Server
ng flag
Sam Cogan

The most secure option is option 3, have your app generate a SAS token when the app needs it, and make it's lifetime as short as possible. That way if you do need to revoke access, the maximum delay is the lifetime of the SAS token.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.