Skip to content

Commit aefd723

Browse files
author
Javad Rahnama
authored
Test | Updating tests to acquire token from user-assigned managed identity (#2473)
1 parent c33bde2 commit aefd723

File tree

7 files changed

+16
-25
lines changed

7 files changed

+16
-25
lines changed

‎BUILDGUIDE.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -176,8 +176,6 @@ Manual Tests require the below setup to run:
176176
|AADSecurePrincipalSecret | (Optional) A Secret defined for a registered application which has been granted permission to the database defined in the AADPasswordConnectionString. | {Secret} |
177177
|AzureKeyVaultURL | (Optional) Azure Key Vault Identifier URL | `https://{keyvaultname}.vault.azure.net/` |
178178
|AzureKeyVaultTenantId | (Optional) The Azure Active Directory tenant (directory) Id of the service principal. | _{Tenant ID of Active Directory}_ |
179-
|AzureKeyVaultClientId | (Optional) "Application (client) ID" of an Active Directory registered application, granted access to the Azure Key Vault specified in `AZURE_KEY_VAULT_URL`. Requires the key permissions Get, List, Import, Decrypt, Encrypt, Unwrap, Wrap, Verify, and Sign. | _{Client Application ID}_ |
180-
|AzureKeyVaultClientSecret | (Optional) "Client Secret" of the Active Directory registered application, granted access to the Azure Key Vault specified in `AZURE_KEY_VAULT_URL` | _{Client Application Secret}_ |
181179
|SupportsIntegratedSecurity | (Optional) Whether or not the USER running tests has integrated security access to the target SQL Server.| `true` OR `false`|
182180
|LocalDbAppName | (Optional) If Local Db Testing is supported, this property configures the name of Local DB App instance available in client environment. Empty string value disables Local Db testing. | Name of Local Db App to connect to.|
183181
|LocalDbSharedInstanceName | (Optional) If LocalDB testing is supported and the instance is shared, this property configures the name of the shared instance of LocalDB to connect to. | Name of shared instance of LocalDB. |

‎src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/AKVUnitTests.cs

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,10 @@
33
// See the LICENSE file in the project root for more information.
44

55
using Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider;
6-
using Azure.Identity;
76
using Xunit;
87
using Azure.Security.KeyVault.Keys;
98
using System.Reflection;
109
using System;
11-
using System.Linq;
1210
using System.Collections.Generic;
1311
using System.Threading;
1412
using System.Diagnostics.Tracing;
@@ -86,8 +84,7 @@ public static void TokenCredentialTest()
8684
Guid activityId = Trace.CorrelationManager.ActivityId = Guid.NewGuid();
8785
using DataTestUtility.AKVEventListener AKVListener = new();
8886

89-
ClientSecretCredential clientSecretCredential = new ClientSecretCredential(DataTestUtility.AKVTenantId, DataTestUtility.AKVClientId, DataTestUtility.AKVClientSecret);
90-
SqlColumnEncryptionAzureKeyVaultProvider akvProvider = new SqlColumnEncryptionAzureKeyVaultProvider(clientSecretCredential);
87+
SqlColumnEncryptionAzureKeyVaultProvider akvProvider = new SqlColumnEncryptionAzureKeyVaultProvider(DataTestUtility.GetTokenCredential());
9188
byte[] encryptedCek = akvProvider.EncryptColumnEncryptionKey(DataTestUtility.AKVUrl, EncryptionAlgorithm, s_columnEncryptionKey);
9289
byte[] decryptedCek = akvProvider.DecryptColumnEncryptionKey(DataTestUtility.AKVUrl, EncryptionAlgorithm, encryptedCek);
9390

@@ -104,8 +101,7 @@ public static void TokenCredentialRotationTest()
104101
// SqlClientCustomTokenCredential implements a legacy authentication callback to request the access token from the client-side.
105102
SqlColumnEncryptionAzureKeyVaultProvider oldAkvProvider = new SqlColumnEncryptionAzureKeyVaultProvider(new SqlClientCustomTokenCredential());
106103

107-
ClientSecretCredential clientSecretCredential = new ClientSecretCredential(DataTestUtility.AKVTenantId, DataTestUtility.AKVClientId, DataTestUtility.AKVClientSecret);
108-
SqlColumnEncryptionAzureKeyVaultProvider newAkvProvider = new SqlColumnEncryptionAzureKeyVaultProvider(clientSecretCredential);
104+
SqlColumnEncryptionAzureKeyVaultProvider newAkvProvider = new SqlColumnEncryptionAzureKeyVaultProvider(DataTestUtility.GetTokenCredential());
109105

110106
byte[] encryptedCekWithNewProvider = newAkvProvider.EncryptColumnEncryptionKey(DataTestUtility.AKVUrl, EncryptionAlgorithm, s_columnEncryptionKey);
111107
byte[] decryptedCekWithOldProvider = oldAkvProvider.DecryptColumnEncryptionKey(DataTestUtility.AKVUrl, EncryptionAlgorithm, encryptedCekWithNewProvider);
@@ -129,15 +125,14 @@ public static void ReturnSpecifiedVersionOfKeyWhenItIsNotTheMostRecentVersion()
129125
{
130126
string keyName = keyPathUri.Segments[2];
131127
string keyVersion = keyPathUri.Segments[3];
132-
ClientSecretCredential clientSecretCredential = new ClientSecretCredential(DataTestUtility.AKVTenantId, DataTestUtility.AKVClientId, DataTestUtility.AKVClientSecret);
133-
KeyClient keyClient = new KeyClient(vaultUri, clientSecretCredential);
128+
KeyClient keyClient = new KeyClient(vaultUri, DataTestUtility.GetTokenCredential());
134129
KeyVaultKey currentVersionKey = keyClient.GetKey(keyName);
135130
KeyVaultKey specifiedVersionKey = keyClient.GetKey(keyName, keyVersion);
136131

137132
//If specified versioned key is the most recent version of the key then we cannot test.
138133
if (!KeyIsLatestVersion(specifiedVersionKey, currentVersionKey))
139134
{
140-
SqlColumnEncryptionAzureKeyVaultProvider azureKeyProvider = new SqlColumnEncryptionAzureKeyVaultProvider(clientSecretCredential);
135+
SqlColumnEncryptionAzureKeyVaultProvider azureKeyProvider = new SqlColumnEncryptionAzureKeyVaultProvider(DataTestUtility.GetTokenCredential());
141136
// Perform an operation to initialize the internal caches
142137
azureKeyProvider.EncryptColumnEncryptionKey(DataTestUtility.AKVOriginalUrl, EncryptionAlgorithm, s_columnEncryptionKey);
143138

‎src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/TestFixtures/Setup/CertificateUtility.cs

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -141,8 +141,7 @@ internal static X509Certificate2 CreateCertificate()
141141

142142
private static async Task SetupAKVKeysAsync()
143143
{
144-
ClientSecretCredential clientSecretCredential = new ClientSecretCredential(DataTestUtility.AKVTenantId, DataTestUtility.AKVClientId, DataTestUtility.AKVClientSecret);
145-
KeyClient keyClient = new KeyClient(DataTestUtility.AKVBaseUri, clientSecretCredential);
144+
KeyClient keyClient = new KeyClient(DataTestUtility.AKVBaseUri, DataTestUtility.GetTokenCredential());
146145
AsyncPageable<KeyProperties> keys = keyClient.GetPropertiesOfKeysAsync();
147146
IAsyncEnumerator<KeyProperties> enumerator = keys.GetAsyncEnumerator();
148147

‎src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/DataTestUtility.cs

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@
2222
using System.Text;
2323
using System.Security.Principal;
2424
using System.Runtime.InteropServices;
25+
using Azure.Identity;
26+
using Azure.Core;
2527

2628
namespace Microsoft.Data.SqlClient.ManualTesting.Tests
2729
{
@@ -41,8 +43,6 @@ public static class DataTestUtility
4143
public static readonly string AKVUrl = null;
4244
public static readonly string AKVOriginalUrl = null;
4345
public static readonly string AKVTenantId = null;
44-
public static readonly string AKVClientId = null;
45-
public static readonly string AKVClientSecret = null;
4646
public static readonly string LocalDbAppName = null;
4747
public static readonly string LocalDbSharedInstanceName = null;
4848
public static List<string> AEConnStrings = new List<string>();
@@ -194,8 +194,6 @@ static DataTestUtility()
194194
}
195195

196196
AKVTenantId = c.AzureKeyVaultTenantId;
197-
AKVClientId = c.AzureKeyVaultClientId;
198-
AKVClientSecret = c.AzureKeyVaultClientSecret;
199197

200198
if (EnclaveEnabled)
201199
{
@@ -458,7 +456,14 @@ public static bool IsNotAzureServer()
458456
// Ref: https://feedback.azure.com/forums/307516-azure-synapse-analytics/suggestions/17858869-support-always-encrypted-in-sql-data-warehouse
459457
public static bool IsAKVSetupAvailable()
460458
{
461-
return !string.IsNullOrEmpty(AKVUrl) && !string.IsNullOrEmpty(AKVClientId) && !string.IsNullOrEmpty(AKVClientSecret) && !string.IsNullOrEmpty(AKVTenantId) && IsNotAzureSynapse();
459+
return !string.IsNullOrEmpty(AKVUrl) && !string.IsNullOrEmpty(UserManagedIdentityClientId) && !string.IsNullOrEmpty(AKVTenantId) && IsNotAzureSynapse();
460+
}
461+
462+
private static readonly DefaultAzureCredential s_defaultCredential = new(new DefaultAzureCredentialOptions { ManagedIdentityClientId = UserManagedIdentityClientId });
463+
464+
public static TokenCredential GetTokenCredential()
465+
{
466+
return s_defaultCredential;
462467
}
463468

464469
public static bool IsTargetReadyForAeWithKeyStore()

‎src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/SqlClientCustomTokenCredential.cs

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -106,9 +106,7 @@ public static async Task<AccessToken> AzureActiveDirectoryAuthenticationCallback
106106
string authorityHost = authority.Remove(separatorIndex + 1);
107107
string audience = authority.Substring(separatorIndex + 1);
108108
TokenCredentialOptions tokenCredentialOptions = new TokenCredentialOptions() { AuthorityHost = new Uri(authorityHost) };
109-
ClientSecretCredential clientSecretCredential = s_clientSecretCredentials.GetOrAdd(authority + "|--|" + resource,
110-
new ClientSecretCredential(audience, DataTestUtility.AKVClientId, DataTestUtility.AKVClientSecret, tokenCredentialOptions));
111-
AccessToken accessToken = await clientSecretCredential.GetTokenAsync(tokenRequestContext, cts.Token).ConfigureAwait(false);
109+
AccessToken accessToken = await DataTestUtility.GetTokenCredential().GetTokenAsync(tokenRequestContext, cts.Token).ConfigureAwait(false);
112110
return accessToken;
113111
}
114112
}

‎src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.TestUtilities/Config.cs

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,6 @@ public class Config
2222
public string AADServicePrincipalSecret = null;
2323
public string AzureKeyVaultURL = null;
2424
public string AzureKeyVaultTenantId = null;
25-
public string AzureKeyVaultClientId = null;
26-
public string AzureKeyVaultClientSecret = null;
2725
public string LocalDbAppName = null;
2826
public string LocalDbSharedInstanceName = null;
2927
public bool EnclaveEnabled = false;

‎src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.TestUtilities/config.default.json

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,6 @@
1313
"AADServicePrincipalSecret": "",
1414
"AzureKeyVaultURL": "",
1515
"AzureKeyVaultTenantId": "",
16-
"AzureKeyVaultClientId": "",
17-
"AzureKeyVaultClientSecret": "",
1816
"SupportsIntegratedSecurity": true,
1917
"LocalDbAppName": "",
2018
"LocalDbSharedInstanceName": "",

0 commit comments

Comments
 (0)