Microsoft SQL Server

​

Prerequisites

1. Create two SQL Server logins and database users with the required permissions. We’ll refer to them as user-a and user-b.
2. Create another SQL Server login with permissions to alter logins for user-a and user-b. We’ll refer to this as the admin login.

-- Create the logins (at server level)
CREATE LOGIN [user-a] WITH PASSWORD = 'ComplexPassword1';
CREATE LOGIN [user-b] WITH PASSWORD = 'ComplexPassword2';

-- Create database users for the logins (in your specific database)
USE [YourDatabase];
CREATE USER [user-a] FOR LOGIN [user-a];
CREATE USER [user-b] FOR LOGIN [user-b];

-- Grant necessary permissions to the users
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::dbo TO [user-a];
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::dbo TO [user-b];

-- Create admin login with permission to alter other logins
CREATE LOGIN [admin] WITH PASSWORD = 'AdminComplexPassword';
CREATE USER [admin] FOR LOGIN [admin];

-- Grant permission to alter any login
GRANT ALTER ANY LOGIN TO [admin];

​

How it works

1. Encrova connects to your database using the provided admin login credentials.
2. A random value is generated and the password for user-a is updated with the new value.
3. The new password is then tested by logging into the database.
4. If test is successful, it’s saved to the output secret mappings so that rest of the system gets the newly rotated value(s).
5. The process is then repeated for user-b on the next rotation.
6. The cycle repeats until secret rotation is deleted/stopped.

​

Rotation Configuration

​

FAQ