Skip to content

Operation Guide: Fallback Account (kaasowner) - Access & Password Rotation

Purpose

The purpose of this guide is to describe how to access the fallback/emergency account and how to execute password rotation. Rotation process is part of the Yearly Schedule, and it is the responsibility of the Product Owner (or delegate) to ensure it is rotated.

The fallback/emergency user (kaasowner), is a "Local user" in Confluent Cloud with highly privileged access (Platform Admin). This user also has a corresponding service account, that has been setup on Novo Nordisk's Azure Entra (Azure AD). This account is only supposed to be used in case SSO is not working and access to the Confluent Cloud UI is required.

Access to Confluent Cloud UI

Prerequisites

You must have the following accesses to retrieve and access fallback account. - NNG_UM_KAAS_emergency access permissions (for accessing Confluent Cloud password) - Access to MFA-paired device (Yubikey, phone etc.)

Process

  1. Retrieve login password from PIM safe NNG_UM_KAAS_emergency via pim.novonordisk.com (accounts -> files -> search "kaasowner@novonordisk.com").
  2. Login on Confluent Cloud with username "kaasowner@novonordisk.com" and password as retrieved in the above step.

You should now be logged in to the Confluent Cloud with the fallback/emergency account.

Password Rotation (Confluent Cloud UI password)

Prerequisites

You must have the following accesses to do the password rotation. - NNG_UM_KAAS_emergency access & edit permissions (for accesing Confluent Cloud password) - NNG_MG_KAAS_emergency access & edit permissions (for accesing Office365 account password) - Access to MFA-paired device (Yubikey, phone etc.)

Process

  1. Retrieve login password from safe NNG_UM_KAAS_emergency via pim.novonordisk.com (Accounts View -> search for "kaasowner@novonordisk.com").
  2. Login on Confluent Cloud with username kaasowner@novonordisk.com and password retrieved in step 1.
  3. Go to 'Accounts & Accesses' and click 'reset password'.
  4. Retrieve Office365 password for the service account "kaasowner" from safe NNG_MG_KAAS_emergency via pim.novonordisk.com.
  5. Open a new incognito browser window, and sign-in to https://portal.azure.com/#home with kaasowner@novonordisk.com and password retrieved in step 4 (for browser profile). Approve with MFA as prompted.
  6. In same window as step 5, open a new tab and go to Outlook. Access password reset mail sent from step 3 and reset the password*.
  7. Save the password on PIM
    • Logon to PIM and navigate to "Accounts View" under "Accounts".
    • Search for "kaasowner@novonordisk.com" within safe NNG_UM_KAAS_emergency.
    • Click "Change" under the section named "Compliance Status" (Note : The user journey for changing password can change in future. If in doubt check the PIM documentation on SharePoint).

Note: *Confluent Cloud | password requirements

Access to YubiKey (physical key)

The YubiKey associated with the shared Service Account named "kaasowner", has been physically stored in safe in DKLP office. The YubiKey PIN is stored with the key. A guide has been created in the form of a MS-Word document, which describes how to get the physical safe where the yubikey is stored. The document also specifies the code required to access the physical safe.

Prerequisites

You must have the following accesses to retrieve additional details about accessing the YubiKey. - NNG_UM_KAAS_emergency

Process

  • Log on to the PIM using your CORP user.
  • Select “Accounts – Files” in the menu on the left side of the screen. Then search for “Yubikey” in the search field located in the upper right corner of the screen. The files saved in the PIM store are shown in a list.
  • Select the guide for DK (Denmark) or IN (India) depending on your location (as of now the YubiKey is only available at DK).
    • DK - Guide to retrieve the Yubikey.docx
  • Retrieve the Yubikey based on the instruction in the file.