Bigfix by using Dev ops

Usage and Config Platform
1

I am working on personal project where Devops is leveraged for bigfix using jenkins, ansible, terra form and ci/CD pipelines. Has anyone implemented similar behaviour in there org. I would like to understand how token rotation is happening. For now I am using a simple operator account(LDAP) with rest api only privilege but I am looking to change this instead of token use

2

Just this week we turned on BigFix token auth and I updated one of my automations to use it. Working fine so far but it has already led to me putting in a ticket and then creating 2 ideas.

  1. BFP-I-652 - BigFix Token Auth - Policy for token maximum duration and disable non-expiring token
  2. BFP-I-653 - BigFix Token Auth - Automatic notification of token expiration

For many of the services in our org, such as Artifactory, certs, ITSM platform, github, it will email the user in advance of expiration. This is basically a requirement these days, as no one can keep track of all their expirations, nor build automations to keep them rotated.

In some cases this happens automatically, but not all. For example, our secrets management platform is hooked in to our container platform. When secrets rotate, it’s detected and containers automatically restart to with the updated info. But that all requires a “fully modern app” or workflow and that just doesn’t exist in every place and everytime :slight_smile:

We also build automations to rotate tokens, but that doesn’t apply to every single use case we have, but it can certainly help for import ones. That said, rotations can be quite different on different platforms so it’s a real challenge to manage. So if you have a solution, I would be happy to hear it :smiley:

1 Like
3

Yes we need to have some thing in place to rotate the tokens automatically. I asked this question during MCP webinar hosted by Rhonda, John Joe. Bigfix is a robust platform. I think this can be achieved

I am trying to see if we can figure it out instead of using manual rotation. We are still on 11.0.4 and I am trying to push for 11.0.6 where tokens are possible. I will keep working to see if there is a way for automatic rotation.

I don't want to login just for rotating the password or tokens. Guess I am lazy :yawning_face:

Thanks @DerrickD for your input. I will vote for this idea as soon as I am in office back tomorrow(IST time zone)

4

@ersaumitra10 you can use the Token route to manage / rotate the tokens:

https://developer.bigfix.com/rest-api/api/token.html

-Gus

1 Like
5

For those doing this, how do you wrangle API endpoints for the cloud-based workflow engines? Do you have additional/dedicated WebReports/API servers for those engines?

I'm just now thinking about this.

Thanks,
Andrew

6

This should help us here.