Can I set a client secret/certificate to never expire?

Question

I have a LibreChat application that uses Microsoft OpenID Connect (Microsoft 365 login) for authentication.

For this, I created an app registration in Microsoft Entra ID (Azure AD) and configured authentication using a client ID and client secret. However, I can only configure the client secret expiration for a maximum of 2 years.

The problem is:

• When the client secret expires, the login to my application fails

This directly impacts my production system

Manual rotation of the client secret introduces operational risk

I would like to understand the available options to avoid this issue:

Is there any way to configure a client secret to never expire?

If not, can I use a certificate instead of a client secret for OpenID Connect authentication?

If I use a certificate, can it be configured with no expiration or very long validity?

What is the Microsoft-recommended best practice for production applications that need long-term authentication without downtime?

My goal is to ensure secure, stable authentication without unexpected production outages due to credential expiration.

Any guidance or recommendations would be appreciated.I have a LibreChat application that uses Microsoft OpenID Connect (Microsoft 365 login) for authentication.

For this, I created an app registration in Microsoft Entra ID (Azure AD) and configured authentication using a client ID and client secret.
However, I can only configure the client secret expiration for a maximum of 2 years.

The problem is:

When the client secret expires, the login to my application fails

This directly impacts my production system

Manual rotation of the client secret introduces operational risk

I would like to understand the available options to avoid this issue:

Is there any way to configure a client secret to never expire?

If not, can I use a certificate instead of a client secret for OpenID Connect authentication?

If I use a certificate, can it be configured with no expiration or very long validity?

What is the Microsoft-recommended best practice for production applications that need long-term authentication without downtime?

My goal is to ensure secure, stable authentication without unexpected production outages due to credential expiration.

Any guidance or recommendations would be appreciated.

Answer 1

What is the Microsoft-recommended best practice for production applications that need long-term authentication without downtime?

Use a managed identity if you want long term access w/o downtime, otherwise all secrets (Cert or client secret) have an expiration. Its not a good practice to never rotate those for obvious reasons of course.

Answer 2

Hey Aswin, I totally understand your concern regarding the client secret expiration for your LibreChat application. Here’s a breakdown of your questions and the options available:

Client Secret Expiration

1. Expiration Policy: Unfortunately, Microsoft has set a maximum duration for client secrets to be no longer than 2 years due to security policies. You cannot configure a client secret to never expire. The recommendation is to use a shorter validity, ideally less than 12 months to minimize security risks.
2. Manual Rotation Risks: Since manual rotation can introduce operational risks and potentially cause login failures when secrets expire, it is essential to have a proactive monitoring or automation strategy in place.

Using a Certificate Instead

1. Certificate Option: You can absolutely use a certificate instead of a client secret for OpenID Connect authentication. Certificates generally provide a more secure alternative, as they can be less susceptible to certain types of attacks.
2. Expiration: However, like client secrets, certificates also have their limitations. The default expiration for certificates is set for 3 years; you cannot set them to never expire. While you could theoretically create a self-signed certificate with very long validity, it’s recommended to rotate it regularly (every 180 days is often advised for security reasons).

Best Practices for Long-Term Authentication

• Utilize Automated Notifications: While there’s no built-in notification feature for client secret expiration, consider scripting a notification system using Azure Logic Apps or PowerShell that alerts you before secrets or certificates are about to expire. You can refer to PowerShell sample scripts to create alerts.
• Rotation Automation: If possible, implement an automation strategy for rotating certificates or secrets through a service like Azure Key Vault. This method enhances security by managing secrets in a dedicated vault and automating their rotation.
• Secure Configuration: Follow Microsoft’s recommendations for managing application credentials and consider policies that enforce secure practices. Resources like Best practices for the Microsoft identity platform can provide additional insights.

Summary

While you can't avoid expiration altogether, using certificates can mitigate the risks associated with client secrets. Regular rotation and proactive management are key to ensuring stable authentication for your application.

Additional Questions

• Are you currently using the Azure Key Vault, or are you open to implementing it for secure secret management?
• Would scripting the renewal and notification process align with your operational capabilities?

I hope this helps clarify things! Let me know if you have any further questions or need more details.

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.