UID2-4808 Add AKS protocol for AzureCCCoreAttestationService
#374
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cYKatherine
force-pushed
the
kcc-UID2-4808-add-enclave-id-aks
branch
from
71335dc to
79b38c1
Compare
cYKatherine
force-pushed
the
kcc-UID2-4808-add-enclave-id-aks
branch
from
79b38c1 to
25ef824
Compare
cYKatherine
commented
Feb 4, 2025
|
|
||
| @Test | ||
| public void testHappyPath() throws AttestationException { | ||
| var provider = new AzureCCAksCoreAttestationService(alwaysPassTokenValidator, alwaysPassPolicyValidator); |
There was a problem hiding this comment.
This file is exactly the same as src/test/java/com/uid2/shared/secure/AzureCCCoreAttestationServiceTest.java, except testing on AzureCCAksCoreAttestationService
cYKatherine
commented
Feb 4, 2025
| @@ -97,6 +97,7 @@ private MaaTokenPayload generateBasicPayload() { | |||
| .vmDebuggable(false) | |||
| .runtimeData(generateBasicRuntimeData()) | |||
| .ccePolicyDigest(CCE_POLICY_DIGEST) | |||
| .azureProtocol("azure-cc") | |||
There was a problem hiding this comment.
By default set it to be azure-cc. Test AKS in the tests below.
There was a problem hiding this comment.
Should we use MaaTokenPayload.AZURE_CC_ACI_PROTOCOL here?
cYKatherine
requested review from
thomasm-ttd,
asloobq,
sunnywu,
cody-constine-ttd,
vishalegbert-ttd and
abuabraham-ttd
|
|
||
| // CC stands for Confidential Container | ||
| @Slf4j | ||
| public class AzureCCAksCoreAttestationService extends AzureCCCoreAttestationServiceBase { |
There was a problem hiding this comment.
Do we actually need child classes for these? Could they just be one class that takes in the AZURE_CC_PROTOCOL?
cYKatherine
changed the title
AzureCCCoreAttestationServiceAzureCCCoreAttestationService
sunnywu
reviewed
Feb 5, 2025
src/test/java/com/uid2/shared/secure/azurecc/MaaTokenSignatureValidatorTest.java
Show resolved
Hide resolved
src/main/java/com/uid2/shared/secure/azurecc/MaaTokenPayload.java
Outdated
Show resolved
Hide resolved
src/test/resources/com.uid2.shared/test/secure/azurecc/jwt_payload_aks.json
Show resolved
Hide resolved
sunnywu
approved these changes
Feb 5, 2025
mcollins-ttd
reviewed
Feb 5, 2025
src/main/java/com/uid2/shared/secure/AzureCCCoreAttestationService.java
Outdated
Show resolved
Hide resolved
src/main/java/com/uid2/shared/secure/azurecc/MaaTokenPayload.java
Outdated
Show resolved
Hide resolved
src/test/java/com/uid2/shared/secure/AzureCCCoreAttestationServiceTest.java
Outdated
Show resolved
Hide resolved
src/test/java/com/uid2/shared/secure/azurecc/MaaTokenSignatureValidatorTest.java
Outdated
Show resolved
Hide resolved
mcollins-ttd
reviewed
Feb 5, 2025
| @@ -10,5 +10,5 @@ public interface IMaaTokenSignatureValidator { | |||
| * @return Parsed token payload. | |||
| * @throws AttestationException | |||
| */ | |||
| MaaTokenPayload validate(String tokenString) throws AttestationException; | |||
| MaaTokenPayload validate(String tokenString, String protocol) throws AttestationException; | |||
There was a problem hiding this comment.
Should we introduce an enum for the protocols instead of using a String?
mcollins-ttd
reviewed
Feb 5, 2025
src/main/java/com/uid2/shared/secure/AzureCCCoreAttestationService.java
Outdated
Show resolved
Hide resolved
src/main/java/com/uid2/shared/secure/AzureCCCoreAttestationService.java
Outdated
Show resolved
Hide resolved
src/test/java/com/uid2/shared/secure/azurecc/MaaTokenSignatureValidatorTest.java
Outdated
Show resolved
Hide resolved
cYKatherine
force-pushed
the
kcc-UID2-4808-add-enclave-id-aks
branch
3 times, most recently
from
c0056d8 to
8b3af91
Compare
cYKatherine
force-pushed
the
kcc-UID2-4808-add-enclave-id-aks
branch
from
8b3af91 to
a34056a
Compare
mcollins-ttd
reviewed
Feb 6, 2025
src/test/java/com/uid2/shared/secure/AzureCCCoreAttestationServiceTest.java
Outdated
Show resolved
Hide resolved
src/test/java/com/uid2/shared/secure/azurecc/MaaTokenSignatureValidatorTest.java
Outdated
Show resolved
Hide resolved
| @@ -97,6 +97,7 @@ private MaaTokenPayload generateBasicPayload() { | |||
| .vmDebuggable(false) | |||
| .runtimeData(generateBasicRuntimeData()) | |||
| .ccePolicyDigest(CCE_POLICY_DIGEST) | |||
| .azureProtocol("azure-cc") | |||
There was a problem hiding this comment.
Should we use MaaTokenPayload.AZURE_CC_ACI_PROTOCOL here?
src/test/java/com/uid2/shared/secure/azurecc/PolicyValidatorTest.java
Outdated
Show resolved
Hide resolved
cYKatherine
force-pushed
the
kcc-UID2-4808-add-enclave-id-aks
branch
from
ffeb876 to
ed3c07d
Compare
mcollins-ttd
reviewed
Feb 6, 2025
src/test/java/com/uid2/shared/secure/AzureCCCoreAttestationServiceTest.java
Outdated
Show resolved
Hide resolved
mcollins-ttd
approved these changes
Feb 6, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
AzureCCCoreAttestationService#374azure-cc-aksto allowed protocols uid2-admin#368