Document ServiceControl / ServicePulse support for authentication and SSL/TLS #7947
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jasontaylordev
requested review from
warwickschroeder
and removed request for
warwickschroeder
jasontaylordev
force-pushed
the
genxp-3600-add-authentication
branch
from
ee39943 to
576ea1b
Compare
…steps and configuration examples
jasontaylordev
force-pushed
the
genxp-3600-add-authentication
branch
from
175b8ea to
604ff09
Compare
- Renamed "HTTPS" to "TLS" in menu.yaml and added "CORS" section. - Enhanced configuration documentation for HTTP to HTTPS redirection in audit and monitoring instances. - Added new settings for HTTPS port in ServiceControl configuration. - Introduced CORS configuration documentation for ServiceControl instances. - Updated authentication documentation to clarify the use of Microsoft Entra ID and other OIDC providers. - Added TLS configuration documentation detailing direct HTTPS and reverse proxy setups. - Improved overall security overview and deployment scenarios in the ServiceControl documentation.
|
|
||
| ## Security Considerations | ||
|
|
||
| ### Certificate Management |
Contributor
There was a problem hiding this comment.
This section seems more like dev notes than public documentation?
Maybe
Restrict read access to the certificate file to only the ServiceControl service account
can be expanded upon and belong here?
Contributor
There was a problem hiding this comment.
I've cleaned up that list a bit, but have left a couple that the customer should know about.
- ServiceControl supports PFX (PKCS#12) certificate files
- Store certificate files securely with appropriate file permissions
| - HSTS can be configured at either the reverse proxy level or in ServiceControl (but not both) | ||
| - HSTS is cached by browsers, so test carefully before enabling in production | ||
| - Start with a short max-age during initial deployment | ||
| - Consider the impact on subdomains before enabling `includeSubDomains` |
Contributor
There was a problem hiding this comment.
- HSTS should not be tested on localhost because browsers cache the policy, which could break other local development
- HSTS is disabled in Development environment (ASP.NET Core excludes localhost by default)
dev notes?
- HSTS can be configured at either the reverse proxy level or in ServiceControl (but not both)
- HSTS is cached by browsers, so test carefully before enabling in production
- Start with a short max-age during initial deployment
These should probably be documented and expanded upon
- Consider the impact on subdomains before enabling
includeSubDomains
I'm not sure what this means, maybe the considerations should be spelled out more?
Contributor
There was a problem hiding this comment.
I've taken a different approach and have removed the points altogether. I now have a short description of what HSTS is, and then a link that goes into more detail about the options.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.