feature(secret-rotation): windows local account secret rotation by victorvhs017 · Pull Request #5269 · Infisical/infisical

victorvhs017 · 2026-01-26T05:11:47Z

Context

This PR implements Windows Local Account secret rotation using SMB/RPC. This is done using the samba-client package in the image due to the lack of native support in the Node.js ecosystem.

Key changes:

Added new Windows (SMB) App Connection for connecting to Windows servers via SMB3 with encryption
Implemented Windows Local Account rotation using rpcclient to change passwords via SMB/RPC
Created secure credential handling using temporary authentication files (avoiding command-line exposure)
Added username validation to prevent command injection (max 20 chars, Windows-compliant character set)
Updated all 5 Dockerfiles to include samba-client package
Added comprehensive documentation for the Windows connection and rotation

Steps to verify the change

Windows App Connection

Create an app connection with and without a custom gateway
Create an app connection for an account inside a Windows AD domain
Create an app connection on port 445 and on a custom port
Create an app connection through the API

Windows Secret Rotation

Create a secret rotation for each of the connections above
Create a secret rotation through the API
Create a secret rotation logging as root and as target
Test the secret rotation reconcile function

Documentation

Review the Windows App Connection documentation
Review the Windows Secret Rotation documentation

Type

Checklist

Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
Tested locally
Updated docs (if needed)
Read the contributing guide

…nd update related schemas

… and update schemas

…ation handling, and improve related schemas

…ated schemas to enforce character limits

maidul98 · 2026-01-26T05:12:11Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

…B and local account secret rotation

…es for enhanced clarity

…lated mappings

…tationItem for improved readability

greptile-apps · 2026-01-27T04:09:08Z

Greptile Overview

Greptile Summary

This PR implements Windows Local Account secret rotation using SMB/RPC protocol, adding a new app connection type and rotation provider. The implementation follows secure coding practices with comprehensive input validation and proper credential handling.

Key Changes

Added Windows (SMB) app connection with SMB3 encryption support
Implemented Windows local account password rotation via rpcclient
Created centralized SMB validation utilities preventing command injection
Added temporary authentication files with restrictive permissions (0o600) to avoid command-line credential exposure
Integrated dangerous character filtering for passwords (blocks ; | & \ $ ( )` and newlines)
Added reconcile functionality for out-of-sync credentials
Updated all 5 Dockerfiles to include samba-client package
Comprehensive documentation for both connection and rotation

Security Strengths

Uses RE2 regex throughout to prevent ReDoS attacks
Validates all user inputs (hostnames, domains, usernames, passwords) before use
Blocks local/private IP addresses for SSRF protection (when not using gateway)
Temporary auth files with owner-only permissions
Proper cleanup of auth files in finally blocks
Gateway proxy support for network isolation
Single-quote escaping for RPC password handling

Critical Issue Found

Missing privileged account protection: Unlike Unix rotation which blocks root/admin/administrator/sudo, this allows rotating built-in Windows privileged accounts like Administrator, potentially causing denial of service

Confidence Score: 4/5

This PR is generally safe to merge with one critical security issue that should be addressed
Score reflects strong security practices (RE2 regex, input validation, SSRF protection, secure credential handling) but deducted one point for missing privileged account protection that could allow rotating built-in Administrator accounts. The Unix/Linux rotation implementation correctly blocks privileged accounts, but Windows implementation lacks this safeguard.
backend/src/ee/services/secret-rotation-v2/windows-local-account-rotation/windows-local-account-rotation-fns.ts requires attention to add privileged account blocking

Important Files Changed

Filename	Overview
backend/src/lib/smb-rpc/smb-rpc-client.ts	Implements SMB RPC client with strong input validation, authentication file handling, and RE2 regex usage
backend/src/lib/validator/validate-smb.ts	Defines centralized SMB validation utilities with character validators and dangerous character blocking
backend/src/ee/services/secret-rotation-v2/windows-local-account-rotation/windows-local-account-rotation-fns.ts	Implements Windows password rotation with self-rotation and admin-managed modes, includes credential verification
backend/src/services/app-connection/smb/smb-connection-fns.ts	Implements SMB connection validation with gateway support and IP address blocking for SSRF protection
backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts	Integrates Windows rotation factory and extends reconcile function to support both Unix and Windows account rotations

greptile-apps

_{3 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

backend/src/lib/smb-rpc/smb-rpc-client.ts

backend/src/ee/routes/v2/secret-rotation-v2-routers/windows-local-account-rotation-router.ts

…ls and update regex handling in SMB RPC client

.../secret-rotation-v2/windows-local-account-rotation/windows-local-account-rotation-schemas.ts

backend/src/lib/api-docs/constants.ts

backend/src/lib/smb-rpc/smb-rpc-client.ts

docs/documentation/platform/secret-rotation/windows-local-account.mdx

akhilmhdh · 2026-01-27T17:17:37Z

Doing an application test shortly

…tion schemas to prevent command injection and improve security

…account and SMB connection schemas to improve security and clarity

…to block dangerous characters and improve security

…Windows local account schemas for improved security and consistency

victorvhs017 · 2026-01-28T14:11:14Z

@greptileai re-review this PR and update the summary

greptile-apps

_{5 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

...ices/secret-rotation-v2/windows-local-account-rotation/windows-local-account-rotation-fns.ts

…assword rotation for privileged accounts and improve password validation

… definitions in SMB and Windows local account schemas for improved clarity and security

…n regarding administrator privileges

…for consistency and clarity

…ums and schemas

Victor Santos added 6 commits January 21, 2026 18:07

windows local account secret rotation

c79a16b

feat: add SMB connection support for Windows local account rotation a…

6ed7a46

…nd update related schemas

feat: enhance Windows local account rotation with username validation…

1c9ae22

… and update schemas

Merge branch 'main' into feature/windows-local-account-secret-rotation

5c5be1d

feat: update SMB connection to Windows terminology, enhance authentic…

4b143c1

…ation handling, and improve related schemas

feat: refine Windows local account username validation and update rel…

de77352

…ated schemas to enforce character limits

mintlify bot deployed to staging - docs January 26, 2026 05:14 View deployment

feat: add Windows connection support and enhance documentation for SM…

045f758

…B and local account secret rotation

mintlify bot deployed to staging - docs January 27, 2026 01:22 View deployment

feat: reorganize Windows local account documentation and add new imag…

9cd1bc5

…es for enhanced clarity

mintlify bot deployed to staging - docs January 27, 2026 03:25 View deployment

victorvhs017 changed the title ~~Feature/windows local account secret rotation~~ feature(secret-rotation): windows local account secret rotation Jan 27, 2026

Victor Santos added 3 commits January 27, 2026 00:37

feat: add SMB connection option to app connection types and update re…

1da70a5

…lated mappings

refactor: streamline ProjectPermissionCan component usage in SecretRo…

a3eceee

…tationItem for improved readability

refactor: update SMB RPC exports for improved type handling and clarity

f7371ba

victorvhs017 marked this pull request as ready for review January 27, 2026 04:04

greptile-apps bot reviewed Jan 27, 2026

View reviewed changes

backend/src/lib/smb-rpc/smb-rpc-client.ts Outdated Show resolved Hide resolved

backend/src/lib/smb-rpc/smb-rpc-client.ts Outdated Show resolved Hide resolved

backend/src/ee/routes/v2/secret-rotation-v2-routers/windows-local-account-rotation-router.ts Outdated Show resolved Hide resolved

fix: clarify description for Windows Local Account rotation credentia…

64f80ee

…ls and update regex handling in SMB RPC client

victorvhs017 requested a review from akhilmhdh January 27, 2026 04:17

akhilmhdh reviewed Jan 27, 2026

View reviewed changes

Victor Santos added 3 commits January 27, 2026 21:03

refactor: enhance validation for Windows local account and SMB connec…

bb86726

…tion schemas to prevent command injection and improve security

refactor: consolidate and enhance validation rules for Windows local …

d71ccf2

…account and SMB connection schemas to improve security and clarity

refactor: enhance Windows local account password requirements schema …

32c7807

…to block dangerous characters and improve security

mintlify bot deployed to staging - docs January 28, 2026 13:26 View deployment

refactor: implement centralized SMB validation utilities and enhance …

b4701c7

…Windows local account schemas for improved security and consistency

greptile-apps bot reviewed Jan 28, 2026

View reviewed changes

...ices/secret-rotation-v2/windows-local-account-rotation/windows-local-account-rotation-fns.ts Show resolved Hide resolved

...ices/secret-rotation-v2/windows-local-account-rotation/windows-local-account-rotation-fns.ts Show resolved Hide resolved

refactor: enhance Windows local account rotation schemas to prevent p…

49e0ec4

…assword rotation for privileged accounts and improve password validation

mintlify bot deployed to staging - docs January 28, 2026 16:21 View deployment

Victor Santos added 2 commits January 28, 2026 15:21

refactor: update password validation messages and dangerous character…

c822f5a

… definitions in SMB and Windows local account schemas for improved clarity and security

docs: clarify requirements for Windows local account password rotatio…

99c9a3d

…n regarding administrator privileges

mintlify bot deployed to staging - docs January 28, 2026 18:25 View deployment

refactor: rename Windows references to SMB in documentation and code …

1c3359e

…for consistency and clarity

victorvhs017 requested a review from akhilmhdh January 28, 2026 21:13

mintlify bot deployed to staging - docs January 28, 2026 21:16 View deployment

akhilmhdh previously approved these changes Jan 29, 2026

View reviewed changes

Victor Santos added 2 commits January 29, 2026 10:57

Merge branch 'main' into feature/windows-local-account-secret-rotation

35eb829

fix(secret-rotation): add missing comma for WindowsLocalAccount in en…

f3dcf7a

…ums and schemas

victorvhs017 dismissed akhilmhdh’s stale review via f3dcf7a January 29, 2026 13:57

mintlify bot deployed to staging - docs January 29, 2026 14:01 View deployment

akhilmhdh approved these changes Jan 29, 2026

View reviewed changes

victorvhs017 merged commit 447fa32 into main Jan 29, 2026
18 of 20 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feature(secret-rotation): windows local account secret rotation#5269

feature(secret-rotation): windows local account secret rotation#5269
victorvhs017 merged 22 commits intomainfrom
feature/windows-local-account-secret-rotation

victorvhs017 commented Jan 26, 2026 •

edited

Loading

Uh oh!

maidul98 commented Jan 26, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Jan 27, 2026 •

edited

Loading

Uh oh!

greptile-apps bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

akhilmhdh commented Jan 27, 2026

Uh oh!

victorvhs017 commented Jan 28, 2026

Uh oh!

greptile-apps bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

victorvhs017 commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Steps to verify the change

Type

Checklist

Uh oh!

maidul98 commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

greptile-apps bot commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Overview

Greptile Summary

Key Changes

Security Strengths

Critical Issue Found

Confidence Score: 4/5

Important Files Changed

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

akhilmhdh commented Jan 27, 2026

Uh oh!

victorvhs017 commented Jan 28, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

victorvhs017 commented Jan 26, 2026 •

edited

Loading

maidul98 commented Jan 26, 2026 •

edited

Loading

greptile-apps bot commented Jan 27, 2026 •

edited

Loading