You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CONTRIBUTING.md
+20-8Lines changed: 20 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -251,14 +251,26 @@ start mongocryptd on port 27020 and set the following:
251
251
252
252
*`MONGOC_TEST_MONGOCRYPTD_BYPASS_SPAWN=on`
253
253
254
-
KMS TLS tests for Client-Side Field Level Encryption require mock KMS servers to be running in the background according to the instructions given in the Client Side Encryption Tests specification.
255
-
The set of mock KMS servers running in the background and their corresponding port number, CA file, and cert file must be as follows:
256
-
257
-
| Port | CA File | Cert File |
258
-
| --- | --- | --- |
259
-
| 7999 | ca.pem | server.pem |
260
-
| 8000 | ca.pem | expired.pem |
261
-
| 8001 | ca.pem | wrong-host.pem |
254
+
KMS TLS tests for Client-Side Field Level Encryption require mock KMS servers to be running in the background.
255
+
256
+
The [Setup instructions](https://github.com/mongodb/specifications/tree/master/source/client-side-encryption/tests#setup-3) given in the Client Side Encryption Tests specification provide additional information.
257
+
258
+
The mock server scripts are located in the [mongodb-labs/drivers-evergreen-tools](https://github.com/mongodb-labs/drivers-evergreen-tools) in the [csfle directory](https://github.com/mongodb-labs/drivers-evergreen-tools/tree/master/.evergreen/csfle). The mock servers use certificates located in the [x509gen](https://github.com/mongodb-labs/drivers-evergreen-tools/tree/master/.evergreen/x509gen) directory.
259
+
260
+
The set of mock KMS servers running in the background and their corresponding invocation command must be as follows:
Copy file name to clipboardExpand all lines: src/libmongoc/doc/mongoc_auto_encryption_opts_set_kms_providers.rst
+33-4Lines changed: 33 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,23 +19,52 @@ Parameters
19
19
* ``opts``: The :symbol:`mongoc_auto_encryption_opts_t`
20
20
* ``kms_providers``: A :symbol:`bson_t` containing configuration for an external Key Management Service (KMS).
21
21
22
-
``kms_providers`` is a BSON document containing configuration for each KMS provider. Currently ``aws`` or ``local`` are supported. At least one must be specified.
22
+
``kms_providers`` is a BSON document containing configuration for each KMS provider. Currently ``aws``, ``local``, ``azure``, ``gcp``, and ``kmip`` are supported. At least one must be specified.
23
23
24
24
The format for "aws" is as follows:
25
25
26
26
.. code-block:: javascript
27
27
28
28
aws: {
29
-
accessKeyId:<string>,
30
-
secretAccessKey:<string>
29
+
accessKeyId:String,
30
+
secretAccessKey:String
31
31
}
32
32
33
33
The format for "local" is as follows:
34
34
35
35
.. code-block:: javascript
36
36
37
37
local: {
38
-
key:<96 byte BSON binary of subtype 0>// The master key used to encrypt/decrypt data keys.
38
+
key:<96 byte BSON binary of subtype 0> or String/* The master key used to encrypt/decrypt data keys. May be passed as a base64 encoded string. */
39
+
}
40
+
41
+
The format for "azure" is as follows:
42
+
43
+
.. code-block:: javascript
44
+
45
+
azure: {
46
+
tenantId:String,
47
+
clientId:String,
48
+
clientSecret:String,
49
+
identityPlatformEndpoint: Optional<String>/* Defaults to login.microsoftonline.com */
50
+
}
51
+
52
+
The format for "gcp" is as follows:
53
+
54
+
.. code-block:: javascript
55
+
56
+
gcp: {
57
+
email:String,
58
+
privateKey: byte[] or String, /* May be passed as a base64 encoded string. */
59
+
endpoint: Optional<String>/* Defaults to oauth2.googleapis.com */
Copy file name to clipboardExpand all lines: src/libmongoc/doc/mongoc_client_encryption_datakey_opts_set_masterkey.rst
+38-6Lines changed: 38 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,16 +23,48 @@ Parameters
23
23
Description
24
24
-----------
25
25
26
-
Setting the masterkey is required if using AWS KMS, and ``masterkey`` must have the form:
26
+
Setting the masterkey is required when creating a data key with the KMS providers: ``aws``, ``azure``, ``gcp``, and ``kmip``.
27
+
28
+
Setting the masterkey is prohibited with the KMS provider ``local``.
29
+
30
+
The format of ``masterkey`` for "aws" is as follows:
27
31
28
32
.. code-block:: javascript
29
33
30
34
{
31
-
region:<string>, // Required.
32
-
key:<string>, // Required. The Amazon Resource Name (ARN) to the AWS customer master key (CMK).
33
-
endpoint:<string>// Optional. An alternate host identifier to send KMS requests to. May include port number.
35
+
region:String,
36
+
key:String, /*The Amazon Resource Name (ARN) to the AWS customer master key (CMK).*/
37
+
endpoint:Optional<String>/*An alternate host identifier to send KMS requests to. May include port number. Defaults to "kms.<region>.amazonaws.com" */
34
38
}
35
39
36
-
The value of "endpoint" is a host name with optional port number separated by a colon. E.g. "kms.us-east-1.amazonaws.com" or "kms.us-east-1.amazonaws.com:443"
40
+
The format of ``masterkey`` for "azure" is as follows:
37
41
38
-
This function is only applicable for the "aws" KMS provider. It is not applicable for creating data keys with the "local" KMS provider (as configured in :symbol:`mongoc_client_encryption_opts_set_kms_providers()`).
42
+
.. code-block:: javascript
43
+
44
+
{
45
+
keyVaultEndpoint:String, /* Host with optional port. Example: "example.vault.azure.net". */
46
+
keyName:String,
47
+
keyVersion: Optional<String>/* A specific version of the named key, defaults to using the key's primary version. */
48
+
}
49
+
50
+
The format of ``masterkey`` for "gcp" is as follows:
51
+
52
+
.. code-block:: javascript
53
+
54
+
{
55
+
projectId:String,
56
+
location:String,
57
+
keyRing:String,
58
+
keyName:String,
59
+
keyVersion: Optional<String>, /* A specific version of the named key, defaults to using the key's primary version. */
60
+
endpoint: Optional<String>/* Host with optional port. Defaults to "cloudkms.googleapis.com". */
61
+
}
62
+
63
+
The format of ``masterkey`` for "kmip" is as follows:
64
+
65
+
.. code-block:: javascript
66
+
67
+
{
68
+
keyId: Optional<String>,
69
+
endpoint: Optional<String>/* Host with optional port. */
0 commit comments