UID2-4808 Add AKS protocol for `AzureCCCoreAttestationService` #374

cYKatherine · 2025-02-03T23:51:19Z

cYKatherine · 2025-02-04T05:59:33Z

src/test/java/com/uid2/shared/secure/AzureCCAksCoreAttestationServiceTest.java

+
+    @Test
+    public void testHappyPath() throws AttestationException {
+        var provider = new AzureCCAksCoreAttestationService(alwaysPassTokenValidator, alwaysPassPolicyValidator);


This file is exactly the same as src/test/java/com/uid2/shared/secure/AzureCCCoreAttestationServiceTest.java, except testing on AzureCCAksCoreAttestationService

cYKatherine · 2025-02-04T06:00:37Z

src/test/java/com/uid2/shared/secure/azurecc/PolicyValidatorTest.java

                .vmDebuggable(false)
                .runtimeData(generateBasicRuntimeData())
                .ccePolicyDigest(CCE_POLICY_DIGEST)
+                .azureProtocol("azure-cc")


By default set it to be azure-cc. Test AKS in the tests below.

Should we use MaaTokenPayload.AZURE_CC_ACI_PROTOCOL here?

cody-constine-ttd · 2025-02-04T22:31:28Z

src/main/java/com/uid2/shared/secure/AzureCCAksCoreAttestationService.java

+
+// CC stands for Confidential Container
+@Slf4j
+public class AzureCCAksCoreAttestationService extends AzureCCCoreAttestationServiceBase {


Do we actually need child classes for these? Could they just be one class that takes in the AZURE_CC_PROTOCOL?

src/test/java/com/uid2/shared/secure/azurecc/MaaTokenSignatureValidatorTest.java

src/main/java/com/uid2/shared/secure/azurecc/MaaTokenPayload.java

src/test/resources/com.uid2.shared/test/secure/azurecc/jwt_payload_aks.json

src/main/java/com/uid2/shared/secure/AzureCCCoreAttestationService.java

src/main/java/com/uid2/shared/secure/azurecc/MaaTokenPayload.java

src/test/java/com/uid2/shared/secure/AzureCCCoreAttestationServiceTest.java

src/test/java/com/uid2/shared/secure/azurecc/MaaTokenSignatureValidatorTest.java

mcollins-ttd · 2025-02-05T06:24:45Z

src/main/java/com/uid2/shared/secure/azurecc/IMaaTokenSignatureValidator.java

     * @throws AttestationException
     */
-    MaaTokenPayload validate(String tokenString) throws AttestationException;
+    MaaTokenPayload validate(String tokenString, String protocol) throws AttestationException;


Should we introduce an enum for the protocols instead of using a String?

src/main/java/com/uid2/shared/secure/AzureCCCoreAttestationService.java

src/test/java/com/uid2/shared/secure/azurecc/MaaTokenSignatureValidatorTest.java

src/test/java/com/uid2/shared/secure/AzureCCCoreAttestationServiceTest.java

src/test/java/com/uid2/shared/secure/azurecc/MaaTokenSignatureValidatorTest.java

mcollins-ttd · 2025-02-06T02:21:11Z

src/test/java/com/uid2/shared/secure/azurecc/PolicyValidatorTest.java

                .vmDebuggable(false)
                .runtimeData(generateBasicRuntimeData())
                .ccePolicyDigest(CCE_POLICY_DIGEST)
+                .azureProtocol("azure-cc")


Should we use MaaTokenPayload.AZURE_CC_ACI_PROTOCOL here?

src/test/java/com/uid2/shared/secure/azurecc/PolicyValidatorTest.java

src/test/java/com/uid2/shared/secure/AzureCCCoreAttestationServiceTest.java

#374)" This reverts commit 4d8dd46. # Conflicts: # pom.xml

…-aks-attestation Revert "UID2-4808 Add AKS protocol for `AzureCCCoreAttestationService`" (#374)

cYKatherine self-assigned this Feb 3, 2025

Add paraent class for AzureCCCoreAttestationService

27d93d5

cYKatherine force-pushed the kcc-UID2-4808-add-enclave-id-aks branch from 71335dc to 79b38c1 Compare February 4, 2025 00:19

Fix UT

25ef824

cYKatherine force-pushed the kcc-UID2-4808-add-enclave-id-aks branch from 79b38c1 to 25ef824 Compare February 4, 2025 02:46

cYKatherine and others added 4 commits February 4, 2025 13:49

Change log info for different azureCcProtocol

78aa455

Remove wrong comment

4e0d4c4

Add unit tests for policy validator

faef366

[CI Pipeline] Released Snapshot version: 8.0.33-alpha-190-SNAPSHOT

68bc1e7

cYKatherine commented Feb 4, 2025

View reviewed changes

cYKatherine requested review from abuabraham-ttd, asloobq, cody-constine-ttd, sunnywu, thomasm-ttd and vishalegbert-ttd February 4, 2025 06:00

cody-constine-ttd reviewed Feb 4, 2025

View reviewed changes

Remove parent child hierarchy

7352bea

cYKatherine changed the title ~~UID2-4808 Add paraent class for AzureCCCoreAttestationService~~ UID2-4808 Add AKS protocol for AzureCCCoreAttestationService Feb 4, 2025

cYKatherine and others added 2 commits February 5, 2025 10:16

Add debug message

0c3957d

[CI Pipeline] Released Snapshot version: 8.0.34-alpha-191-SNAPSHOT

14572f8

sunnywu reviewed Feb 5, 2025

View reviewed changes

cYKatherine added 3 commits February 5, 2025 14:04

Change constant variable to AZURE_CC_ACI_PROTOCOL

3372d69

Rename jwt_payload_aci.json file

69a7fc0

Rename testAciPayload UT

623118f

sunnywu approved these changes Feb 5, 2025

View reviewed changes

cYKatherine requested a review from mcollins-ttd February 5, 2025 03:09

mcollins-ttd reviewed Feb 5, 2025

View reviewed changes

cYKatherine added 2 commits February 6, 2025 08:07

Use ParameterizedTest to test payload

b068084

Use String.format to format log message

40c518e

mcollins-ttd reviewed Feb 5, 2025

View reviewed changes

Use logback parameterized logging

9f806e6

cYKatherine force-pushed the kcc-UID2-4808-add-enclave-id-aks branch 3 times, most recently from c0056d8 to 8b3af91 Compare February 5, 2025 22:35

Throw AttestationClientException when protocol not valid

a34056a

cYKatherine force-pushed the kcc-UID2-4808-add-enclave-id-aks branch from 8b3af91 to a34056a Compare February 5, 2025 22:38

cYKatherine added 2 commits February 6, 2025 09:45

Refactor MaaTokenSignatureValidatorTest

b9c1cc7

Use @MethodSource("argumentProvider")

35851d1

mcollins-ttd reviewed Feb 6, 2025

View reviewed changes

Replace string with MaaTokenPayload contant

ed3c07d

cYKatherine force-pushed the kcc-UID2-4808-add-enclave-id-aks branch from ffeb876 to ed3c07d Compare February 6, 2025 02:39

mcollins-ttd reviewed Feb 6, 2025

View reviewed changes

src/test/java/com/uid2/shared/secure/AzureCCCoreAttestationServiceTest.java Outdated Show resolved Hide resolved

Fix typo

929dd0c

mcollins-ttd approved these changes Feb 6, 2025

View reviewed changes

cYKatherine merged commit 4d8dd46 into main Feb 6, 2025
3 checks passed

cYKatherine deleted the kcc-UID2-4808-add-enclave-id-aks branch February 6, 2025 02:58

mcollins-ttd added a commit that referenced this pull request Mar 18, 2025

Revert "UID2-4808 Add AKS protocol for AzureCCCoreAttestationService (

13ff31d

#374)" This reverts commit 4d8dd46. # Conflicts: # pom.xml

mcollins-ttd added a commit that referenced this pull request Mar 18, 2025

Merge pull request #402 from IABTechLab/mkc-UID2-4963-remove-azure-cc…

203a178

…-aks-attestation Revert "UID2-4808 Add AKS protocol for `AzureCCCoreAttestationService`" (#374)

UID2-4808 Add AKS protocol for AzureCCCoreAttestationService #374

UID2-4808 Add AKS protocol for AzureCCCoreAttestationService #374

Uh oh!

Conversation

cYKatherine commented Feb 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cYKatherine Feb 4, 2025

Choose a reason for hiding this comment

Uh oh!

cYKatherine Feb 4, 2025

Choose a reason for hiding this comment

Uh oh!

mcollins-ttd Feb 6, 2025

Choose a reason for hiding this comment

Uh oh!

cody-constine-ttd Feb 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mcollins-ttd Feb 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mcollins-ttd Feb 6, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

UID2-4808 Add AKS protocol for `AzureCCCoreAttestationService` #374

UID2-4808 Add AKS protocol for `AzureCCCoreAttestationService` #374

cYKatherine commented Feb 3, 2025 •

edited

Loading