Secure DevOps With Azure DevOps

This article provides step-by-step instructions for integrating Beyond Identity Secure DevOps with AWS DevOps, detailing how to configure the Authenticator, generate GPG keys, set repository paths, assign user groups, and enforce code signing and verification within CI/CD pipelines using AWS CodeCommit, CodeBuild, and CodePipeline.

This guide provides instructions on how to:

• Set up the Beyond Identity (BI) Authenticator to sign and verify code with Azure DevOps.

• Use the Beyond Identity Authenticator with GPG key entitlements to sign and verify code based on typical DevOps events, such as push and pull. This ensures the security of the SDLC process, with signature validation triggered automatically as part of the CI/CD pipeline.

• Generate a GPG key on the BI Authenticator, which can be used to sign multiple repositories; however, each repository can only be signed with one key.

• Ensure that the email used for signing is enrolled in the Beyond Identity tenant.

• Optionally require commits to be verified with biometrics, preventing local malware or developers from bypassing hygiene and security controls.

Secure DevOps is an add-on for Secure Workforce. Contact your Account Representative to add this feature to your environment.

Prerequisites

Azure Devops prerequisites

• A configured source code repository, project, and entitled users to pull, commit, and merge source code.

• (Optional) A configured CI/CD pipeline.

Beyond Identity prerequisites

• A Beyond Identity tenant configured for your organization and the ability to enroll users.

• An integration with your SSO provider. The instructions are different based on your SSO provider. Please refer to the integration guides available in the link below:
  https://supportcases.beyondidentity.com/hc/en-us/sections/6746815209111-Integration-Guides

• Any users who will sign the code must

  • Have a copy of the Beyond Identity authenticator installed.

  • Have enrolled a passkey with the tenant using the same email that will be used to sign the code.

Note the following:

• A Beyond Identity authenticator with GPG key entitlements can sign and verify code based on typical DevOps events like push, pull, etc. This is a powerful tool to ensure the security of the SDLC process. The event triggers the signature validation process as part of the CI/CD pipeline.

• A GPG key generated on the Beyond Identity Authenticator can be used to sign many repositories, but a repository can be signed with only one key.

Configure Beyond Identity for Azure DevOps

This section describes the tasks required to configure the Beyond Identity authenticator for users with SDO enabled.

• Generate a Key management token

• Get an authenticator entitlement to generate GPG keys

• Add groups and users (BI Admin console)

• Generate a GPG Key and set a repository path (Authenticator)

Generate a Key management token

Your Beyond Identity Representative will provide you with a key management token. This token will be used in the CI/CD pipeline as the value of BYNDID_KEY_MGMT_API_TOKEN in later steps.

Get an authenticator entitlement to generate GPG keys

A Beyond Identity SME will enable the following entitlements for your tenant in the Support console so users can begin using their authenticator for commit signing.

• Commit Signing - Enables users to generate GPG keys and configure repository paths. Signs and verifies the author of every commit using the authenticator to prevent unauthorized threats.

• Commit Signing with Biometrics (optional) - Requires users to provide biometrics as part of signing and verifying commit signing to prevent local malware from committing code or developers from bypassing hygiene and security controls.

Add groups and users (BI Admin console)

Once the entitlements are enabled, add groups using the names in this section to generate GPG keys, configure repository paths, and optionally require biometrics for commit signing.

Important: You must use the exact group name provided below for SDO to work.

1. Open the Groups page in the Admin console and click Add Group.

   1. Enter BI_SDO_GPG_Key_Creation for the group name.

      Important: You must use BI_SDO_GPG_Key_Creation as the exact name for Commit Signing to work.

   2. Enter an optional description and click Save Changes.

   3. Open the newly created group and then click Add Users to add any developers to this group.

2. Users added in the steps above will see a GPG Keys link in their authenticator as shown below.

3. Continue to the Generate a GPG Key and set a repository (Authenticator) section below for steps the development users will need to follow.

Generate a GPG Key and set a repository path (Authenticator)

1. On the Beyond Identity platform authenticator, click the GPG Keys link.

2. Click Create GPG key to create and configure GPG keys.

   

3. Ensure the email address matches the email configured to perform Git operations. You can ignore the expiration date.

4. Click Create. You should see the key in the Authenticator.

5. Set the repository path on the authenticator.

   1. In the authenticator, click the ellipses to the right of the GPG key and choose Set repository.
      
      
      

   2. Browse to the local path of the repository root and click Configure.

   3. Continue to Configure Azure DevOps below.

Configure Azure DevOps

1. Sign up for a new account.

2. Create and upload ssh keys for cloning a repository using SSH URL.

3. Sign into your Azure Devops organization with the account that has same email that will be used to code sign/verify.

4. Create a Project / Repository or request the repository owner add you to the Azure Devops organization that hosts project/repository and grant “Basic” access.

5. Configure the Azure Devops pipeline variable BYNDID_KEY_MGMT_API_TOKEN with the value generated in Generate a Key management token.

   1. Navigate to Your Azure Devops organization > project > Pipelines.

   2. Click the three vertical dots that will open More options, and select Edit.

      

   3. Click Variables and then click the + sign to create a new variable named BYNDID_KEY_MGMT_API_TOKEN.
      

   4. Check Keep this value secret. This variable is used in azure-pipelines.yml.

   5. Create an “azure-pipelines.yml” file in the repository root

trigger:

- master

jobs:

- job: VerifyCommitSignatureWithBeyondIdentity

container:

image: byndid/auth-commit-sig:0.4.1-debian

env: { API_TOKEN: $(BYNDID_KEY_MGMT_API_TOKEN)} # BYNDID_KEY_MGMT_API_TOKEN set as a pipeline secret variable

options: --entrypoint=""

steps:

- script: /bin/action

6. Clone the code to your local repository.

7. Change the code as required.

8. Commit with signing, similar to the following:
   git commit -v -S -m "Modified README commit with -S"

9. (Optional) If biometrics were enabled for signing, you will be prompted to provide biometric verification to complete the signing.

10. Push the code to Origin.

11. Verify a successful pipeline run:

    • Navigate to Your Azure Devops organization > project > Pipelines > Recent. You should see a green mark.
      

Appendix

Azure Devops prerequisites

• Create an account.

  • Use the same email account that you will use to code sign/verify.

• Create a repository.

• Sign in with the same email account that you will use to code sign/verify.

• You should have privileges to clone, modify, and commit changes.

Create an account

• Azure Devops: https://docs.Azure Devops.com/en/get-started/signing-up-for-Azure Devops/signing-up-for-a-new-Azure Devops-account

Create a repository

• Azure Devops: https://Azure Devops.com/new

Start using Git

• Git Tutorial: https://www.atlassian.com/git/tutorials/learn-git-with-bitbucket-cloud