Skip to content

Commit e4d64e5

Browse files
VeryEarlyVeryEarly
authored
Merge pull request #11072 from gkostal/policy-rc1
Added policy management cmdlets for Azure Attestation Service
2 parents 0c8bcf5 + 4a3e876 commit e4d64e5

32 files changed

+3845
-464
lines changed

‎src/Attestation/Attestation.Test/Attestation.Test.csproj

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
</PropertyGroup>
1212

1313
<ItemGroup>
14+
<PackageReference Include="Microsoft.Azure.Attestation" Version="0.9.0-preview" />
1415
<PackageReference Include="Microsoft.Azure.Management.Attestation" Version="0.10.0-preview" />
1516
</ItemGroup>
1617

‎src/Attestation/Attestation.Test/ScenarioTests/AttestationController.cs

Lines changed: 74 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
// See the License for the specific language governing permissions and
1212
// limitations under the License.
1313
// ----------------------------------------------------------------------------------
14-
14+
using Microsoft.Azure.Attestation;
1515
using Microsoft.Azure.Commands.Common.Authentication;
1616
using Microsoft.Azure.Management.Attestation;
1717
using Microsoft.Azure.ServiceManagement.Common.Models;
@@ -23,6 +23,7 @@
2323
using System.IO;
2424
using System.Linq;
2525
using Microsoft.Azure.Management.Internal.Resources;
26+
using Microsoft.IdentityModel.Clients.ActiveDirectory;
2627
using Microsoft.Rest.ClientRuntime.Azure.TestFramework;
2728

2829
namespace Microsoft.Azure.Commands.Attestation.Test
@@ -31,19 +32,13 @@ class AttestationController
3132
{
3233
private readonly EnvironmentSetupHelper _helper;
3334

34-
35-
public ResourceManagementClient ResourceClient { get; private set; }
36-
37-
public AttestationManagementClient AttestationManagementClient { get; private set; }
38-
3935
public static AttestationController NewInstance => new AttestationController();
4036

4137
public AttestationController()
4238
{
4339
_helper = new EnvironmentSetupHelper();
4440
}
4541

46-
4742
public void RunPowerShellTest(XunitTracingInterceptor logger, params string[] scripts)
4843
{
4944
var sf = new StackTrace().GetFrame(1);
@@ -58,14 +53,37 @@ public void RunPowerShellTest(XunitTracingInterceptor logger, params string[] sc
5853
// no custom cleanup
5954
null,
6055
callingClassType,
61-
mockName);
56+
mockName,
57+
true,
58+
false);
59+
}
60+
61+
public void RunDataPowerShellTest(XunitTracingInterceptor logger, params string[] scripts)
62+
{
63+
var sf = new StackTrace().GetFrame(1);
64+
var callingClassType = sf.GetMethod().ReflectedType?.ToString();
65+
var mockName = sf.GetMethod().Name;
66+
67+
logger.Information(string.Format("Test method entered: {0}.{1}", callingClassType, mockName));
68+
_helper.TracingInterceptor = logger;
69+
70+
RunPowerShellTestWorkflow(
71+
() => scripts,
72+
// no custom cleanup
73+
null,
74+
callingClassType,
75+
mockName,
76+
false,
77+
true);
6278
}
6379

6480
public void RunPowerShellTestWorkflow(
6581
Func<string[]> scriptBuilder,
6682
Action cleanup,
6783
string callingClassType,
68-
string mockName)
84+
string mockName,
85+
bool setupManagementClients,
86+
bool setupDataClient)
6987
{
7088
var providers = new Dictionary<string, string>
7189
{
@@ -82,8 +100,17 @@ public void RunPowerShellTestWorkflow(
82100
HttpMockServer.RecordsDirectory = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "SessionRecords");
83101
using (var context = MockContext.Start(callingClassType, mockName))
84102
{
85-
SetupManagementClients(context);
86-
_helper.SetupEnvironment(AzureModule.AzureResourceManager);
103+
if (setupManagementClients)
104+
{
105+
SetupManagementClients(context);
106+
_helper.SetupEnvironment(AzureModule.AzureResourceManager);
107+
}
108+
109+
if (setupDataClient)
110+
{
111+
SetupDataClient(context);
112+
}
113+
87114
var callingClassName =
88115
callingClassType.Split(new[] {"."}, StringSplitOptions.RemoveEmptyEntries).Last();
89116
_helper.SetupModules(AzureModule.AzureResourceManager,
@@ -109,9 +136,19 @@ public void RunPowerShellTestWorkflow(
109136
}
110137
private void SetupManagementClients(MockContext context)
111138
{
112-
ResourceClient = GetResourceManagementClient(context);
113-
AttestationManagementClient = GetAttestationManagementClient(context);
114-
_helper.SetupManagementClients(ResourceClient, AttestationManagementClient);
139+
_helper.SetupManagementClients(
140+
GetResourceManagementClient(context),
141+
GetAttestationManagementClient(context)
142+
);
143+
}
144+
145+
private void SetupDataClient(MockContext context)
146+
{
147+
_helper.SetupManagementClients(
148+
GetResourceManagementClient(context),
149+
GetAttestationManagementClient(context),
150+
GetAttestationClient(context)
151+
);
115152
}
116153

117154
private static ResourceManagementClient GetResourceManagementClient(MockContext context)
@@ -123,5 +160,28 @@ private static AttestationManagementClient GetAttestationManagementClient(MockCo
123160
{
124161
return context.GetServiceClient<AttestationManagementClient>(TestEnvironmentFactory.GetTestEnvironment());
125162
}
163+
164+
private static AttestationClient GetAttestationClient(MockContext context)
165+
{
166+
string environmentConnectionString = Environment.GetEnvironmentVariable("TEST_CSM_ORGID_AUTHENTICATION");
167+
string accessToken = "fakefakefake";
168+
169+
// When recording, we should have a connection string passed into the code from the environment
170+
if (!string.IsNullOrEmpty(environmentConnectionString))
171+
{
172+
// Gather test client credential information from the environment
173+
var connectionInfo = new ConnectionString(Environment.GetEnvironmentVariable("TEST_CSM_ORGID_AUTHENTICATION"));
174+
string servicePrincipal = connectionInfo.GetValue<string>(ConnectionStringKeys.ServicePrincipalKey);
175+
string servicePrincipalSecret = connectionInfo.GetValue<string>(ConnectionStringKeys.ServicePrincipalSecretKey);
176+
string aadTenant = connectionInfo.GetValue<string>(ConnectionStringKeys.AADTenantKey);
177+
178+
// Create credentials
179+
var clientCredentials = new ClientCredential(servicePrincipal, servicePrincipalSecret);
180+
var authContext = new AuthenticationContext($"https://login.windows.net/{aadTenant}", TokenCache.DefaultShared);
181+
accessToken = authContext.AcquireTokenAsync("https://attest.azure.net", clientCredentials).Result.AccessToken;
182+
}
183+
184+
return new AttestationClient(new AttestationCredentials(accessToken), HttpMockServer.CreateInstance());
185+
}
126186
}
127187
}

‎src/Attestation/Attestation.Test/ScenarioTests/AttstationPolicyTests.cs

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.Azure.Commands.ScenarioTest;
16+
using Microsoft.Azure.ServiceManagement.Common.Models;
17+
using Microsoft.WindowsAzure.Commands.ScenarioTest;
18+
using Microsoft.WindowsAzure.Commands.Test.Utilities.Common;
19+
using Xunit;
20+
21+
namespace Microsoft.Azure.Commands.Attestation.Test.ScenarioTests
22+
{
23+
public class AttstationPolicyTests : RMTestBase
24+
{
25+
public XunitTracingInterceptor _logger;
26+
27+
public AttstationPolicyTests(Xunit.Abstractions.ITestOutputHelper output)
28+
{
29+
_logger = new XunitTracingInterceptor(output);
30+
XunitTracingInterceptor.AddToContext(_logger);
31+
TestExecutionHelpers.SetUpSessionAndProfile();
32+
}
33+
34+
[Fact]
35+
[Trait(Category.AcceptanceType, Category.CheckIn)]
36+
public void TestGetAttestationPolicy()
37+
{
38+
AttestationController.NewInstance.RunDataPowerShellTest(_logger, "Test-GetAttestationPolicy");
39+
}
40+
41+
[Fact]
42+
[Trait(Category.AcceptanceType, Category.CheckIn)]
43+
public void TestResetAttestationPolicy()
44+
{
45+
AttestationController.NewInstance.RunDataPowerShellTest(_logger, "Test-ResetAttestationPolicy");
46+
}
47+
48+
/// <summary>
49+
/// This test is categorized as LiveOnly since the Set-AzAttestationPolicy cmdlet retrieves and validates
50+
/// a signed JWT token from the service. A playback of a recording will result in failure, since the
51+
/// recorded JWT will have expired since the recording was generated.
52+
///
53+
/// On a related note, if one does try to create a recording of this test case, currently there's a
54+
/// conflict for the following two libraries used by the authentication code in this DLL
55+
/// (Microsoft.Azure.PowerShell.Cmdlets.Attestation.Test.dll) and the DLL used to implement the
56+
/// PowerShell cmdlets (Microsoft.Azure.PowerShell.Cmdlets.Attestation.dll). This DLL requires
57+
/// version 5.1.2 (indirectly through Microsoft.Rest.ClientRuntime.Azure.TestFramework) and the cmdlet
58+
/// DLL requires version 5.6.0 (indirectly through Microsoft.IdentityModel.JsonWebTokens.
59+
/// * Microsoft.IdentityModel.Tokens.dll
60+
/// * Microsoft.IdentityModel.Logging.dll
61+
///
62+
/// A work-around to record tests is to copy the 5.6.0 versions of the DLL's into the bin directory
63+
/// holding the Microsoft.Azure.PowerShell.Cmdlets.Attestation.Test.dll.
64+
/// </summary>
65+
[Fact]
66+
[Trait(Category.AcceptanceType, Category.LiveOnly)]
67+
public void TestSetAttestationPolicy()
68+
{
69+
AttestationController.NewInstance.RunDataPowerShellTest(_logger, "Test-SetAttestationPolicy");
70+
}
71+
}
72+
}

‎src/Attestation/Attestation.Test/ScenarioTests/AttstationPolicyTests.ps1

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
# ----------------------------------------------------------------------------------
2+
#
3+
# Copyright Microsoft Corporation
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
# ----------------------------------------------------------------------------------
14+
15+
<#
16+
.SYNOPSIS
17+
Test Get-AzAttestationPolicy
18+
#>
19+
#------------------------------Get-AzAttestationPolicy-----------------------------------
20+
function Test-GetAttestationPolicy
21+
{
22+
$unknownRGName = getAssetName
23+
$attestationProviderName = getAssetName
24+
$policyTemplateName = "SgxDisableDebugMode"
25+
$teeType = "SgxEnclave"
26+
27+
try
28+
{
29+
$rgName = Create-ResourceGroup
30+
$attestationCreated = New-AzAttestation -Name $attestationProviderName -ResourceGroupName $rgName.ResourceGroupName -AttestationPolicy $policyTemplateName
31+
32+
Assert-NotNull attestationCreated
33+
Assert-AreEqual $attestationProviderName $attestationCreated.Name
34+
Assert-NotNull attestationCreated.AttesUri
35+
Assert-NotNull attestationCreated.Id
36+
Assert-NotNull attestationCreated.Status
37+
38+
$getPolicy = Get-AzAttestationPolicy -Name $attestationProviderName -ResourceGroupName $rgName.ResourceGroupName -Tee $teeType
39+
Assert-NotNull $getPolicy
40+
}
41+
42+
finally
43+
{
44+
Clean-ResourceGroup $rgName.ResourceGroupName
45+
}
46+
}
47+
48+
<#
49+
.SYNOPSIS
50+
Test Reset-AzAttestationPolicy
51+
#>
52+
#------------------------------Reset-AzAttestationPolicy-----------------------------------
53+
function Test-ResetAttestationPolicy
54+
{
55+
$unknownRGName = getAssetName
56+
$attestationProviderName = getAssetName
57+
$policyTemplateName = "SgxDisableDebugMode"
58+
$teeType = "SgxEnclave"
59+
try
60+
{
61+
$rgName = Create-ResourceGroup
62+
$attestationCreated = New-AzAttestation -Name $attestationProviderName -ResourceGroupName $rgName.ResourceGroupName -AttestationPolicy $policyTemplateName
63+
64+
Assert-NotNull attestationCreated
65+
Assert-AreEqual $attestationProviderName $attestationCreated.Name
66+
Assert-NotNull attestationCreated.AttesUri
67+
Assert-NotNull attestationCreated.Id
68+
Assert-NotNull attestationCreated.Status
69+
70+
$getPolicy = Get-AzAttestationPolicy -Name $attestationProviderName -ResourceGroupName $rgName.ResourceGroupName -Tee $teeType
71+
Assert-NotNull $getPolicy
72+
$resetPolicyResponse = Reset-AzAttestationPolicy -Name $attestationProviderName -ResourceGroupName $rgName.ResourceGroupName -Tee $teeType -PassThru
73+
Assert-AreEqual $resetPolicyResponse $true
74+
}
75+
finally
76+
{
77+
Clean-ResourceGroup $rgName.ResourceGroupName
78+
}
79+
}
80+
81+
<#
82+
.SYNOPSIS
83+
Test Set-AzAttestationPolicy
84+
#>
85+
#------------------------------Set-AzAttestationPolicy-----------------------------------
86+
# DO NOT RECORD/PLAYBACK THIS TEST, IT WILL FAIL DUE TO AN EXPIRING JWT TOKEN!
87+
#------------------------------Set-AzAttestationPolicy-----------------------------------
88+
function Test-SetAttestationPolicy
89+
{
90+
$unknownRGName = getAssetName
91+
$attestationProviderName = getAssetName
92+
$policyTemplateName = "SgxDisableDebugMode"
93+
$teeType = "SgxEnclave"
94+
$policyDocument = "eyJhbGciOiJub25lIn0.eyJBdHRlc3RhdGlvblBvbGljeSI6ICJ7XHJcbiAgICBcIiR2ZXJzaW9uXCI6IDEsXHJcbiAgICBcIiRhbGxvdy1kZWJ1Z2dhYmxlXCIgOiB0cnVlLFxyXG4gICAgXCIkY2xhaW1zXCI6W1xyXG4gICAgICAgIFwiaXMtZGVidWdnYWJsZVwiICxcclxuICAgICAgICBcInNneC1tcnNpZ25lclwiLFxyXG4gICAgICAgIFwic2d4LW1yZW5jbGF2ZVwiLFxyXG4gICAgICAgIFwicHJvZHVjdC1pZFwiLFxyXG4gICAgICAgIFwic3ZuXCIsXHJcbiAgICAgICAgXCJ0ZWVcIixcclxuICAgICAgICBcIk5vdERlYnVnZ2FibGVcIlxyXG4gICAgXSxcclxuICAgIFwiTm90RGVidWdnYWJsZVwiOiB7XCJ5ZXNcIjp7XCIkaXMtZGVidWdnYWJsZVwiOnRydWUsIFwiJG1hbmRhdG9yeVwiOnRydWUsIFwiJHZpc2libGVcIjpmYWxzZX19LFxyXG4gICAgXCJpcy1kZWJ1Z2dhYmxlXCIgOiBcIiRpcy1kZWJ1Z2dhYmxlXCIsXHJcbiAgICBcInNneC1tcnNpZ25lclwiIDogXCIkc2d4LW1yc2lnbmVyXCIsXHJcbiAgICBcInNneC1tcmVuY2xhdmVcIiA6IFwiJHNneC1tcmVuY2xhdmVcIixcclxuICAgIFwicHJvZHVjdC1pZFwiIDogXCIkcHJvZHVjdC1pZFwiLFxyXG4gICAgXCJzdm5cIiA6IFwiJHN2blwiLFxyXG4gICAgXCJ0ZWVcIiA6IFwiJHRlZVwiXHJcbn0ifQ."
95+
96+
# Prevent this script from inadvertantly running in Record or Playback modes
97+
if (((Get-ChildItem Env:\HttpRecorderMode).Value -eq "Playback") -or ((Get-ChildItem Env:\HttpRecorderMode).Value -eq "Record"))
98+
{
99+
return
100+
}
101+
102+
try
103+
{
104+
$rgName = Create-ResourceGroup
105+
$attestationCreated = New-AzAttestation -Name $attestationProviderName -ResourceGroupName $rgName.ResourceGroupName -AttestationPolicy $policyTemplateName
106+
107+
Assert-NotNull attestationCreated
108+
Assert-AreEqual $attestationProviderName $attestationCreated.Name
109+
Assert-NotNull attestationCreated.AttesUri
110+
Assert-NotNull attestationCreated.Id
111+
Assert-NotNull attestationCreated.Status
112+
113+
# NOTE: Set-AzAttestionPolicy does not work in recording/playback mode because the recorded JWT token expires and then fails validation
114+
$setPolicyResponse = Set-AzAttestationPolicy -Name $attestationProviderName -ResourceGroupName $rgName.ResourceGroupName -Tee $teeType -Policy $policyDocument -PassThru
115+
Assert-AreEqual $setPolicyResponse $true
116+
}
117+
118+
finally
119+
{
120+
Clean-ResourceGroup $rgName.ResourceGroupName
121+
}
122+
}

0 commit comments

Comments
 (0)