Skip to content

Commit a461dba

Browse files
vbabaninstIncMale
vbabanin
and
stIncMale
authored
Add unified, legacy, and prose tests for CSFLE multi-KMS support. (#1424)
JAVA-5275 --------- Co-authored-by: Valentin Kovalenko <[email protected]>
1 parent 01aff5a commit a461dba

16 files changed

+2411
-77
lines changed

‎.evergreen/.evg.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,8 @@ functions:
265265
env:
266266
AWS_ACCESS_KEY_ID: ${aws_access_key_id}
267267
AWS_SECRET_ACCESS_KEY: ${aws_secret_access_key}
268+
AWS_ACCESS_KEY_ID_AWS_KMS_NAMED: ${aws_access_key_id_2}
269+
AWS_SECRET_ACCESS_KEY_AWS_KMS_NAMED: ${aws_secret_access_key_2}
268270
AWS_DEFAULT_REGION: us-east-1
269271
AZURE_TENANT_ID: ${azure_tenant_id}
270272
AZURE_CLIENT_ID: ${azure_client_id}
@@ -709,6 +711,8 @@ functions:
709711
env:
710712
AWS_ACCESS_KEY_ID: ${aws_access_key_id}
711713
AWS_SECRET_ACCESS_KEY: ${aws_secret_access_key}
714+
AWS_ACCESS_KEY_ID_AWS_KMS_NAMED: ${aws_access_key_id_2}
715+
AWS_SECRET_ACCESS_KEY_AWS_KMS_NAMED: ${aws_secret_access_key_2}
712716
AWS_DEFAULT_REGION: us-east-1
713717
AZURE_TENANT_ID: ${azure_tenant_id}
714718
AZURE_CLIENT_ID: ${azure_client_id}

‎.evergreen/run-csfle-tests-with-mongocryptd.sh

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,20 +4,22 @@ set -o xtrace # Write all commands first to stderr
44
set -o errexit # Exit the script with error if any of the commands fail
55

66
# Supported/used environment variables:
7-
# MONGODB_URI Set the suggested connection MONGODB_URI (including credentials and topology info)
8-
# JAVA_VERSION Set the version of java to be used. Java versions can be set from the java toolchain /opt/java
9-
# AWS_ACCESS_KEY_ID The AWS access key identifier for client-side encryption
10-
# AWS_SECRET_ACCESS_KEY The AWS secret access key for client-side encryption
11-
# AWS_TEMP_ACCESS_KEY_ID The temporary AWS access key identifier for client-side encryption
12-
# AWS_TEMP_SECRET_ACCESS_KEY The temporary AWS secret access key for client-side encryption
13-
# AWS_TEMP_SESSION_TOKEN The temporary AWS session token for client-side encryption
14-
# AZURE_TENANT_ID The Azure tenant identifier for client-side encryption
15-
# AZURE_CLIENT_ID The Azure client identifier for client-side encryption
16-
# AZURE_CLIENT_SECRET The Azure client secret for client-side encryption
17-
# GCP_EMAIL The GCP email for client-side encryption
18-
# GCP_PRIVATE_KEY The GCP private key for client-side encryption
19-
# AZUREKMS_KEY_VAULT_ENDPOINT The Azure key vault endpoint for integration tests
20-
# AZUREKMS_KEY_NAME The Azure key name endpoint for integration tests
7+
# MONGODB_URI Set the suggested connection MONGODB_URI (including credentials and topology info)
8+
# JAVA_VERSION Set the version of java to be used. Java versions can be set from the java toolchain /opt/java
9+
# AWS_ACCESS_KEY_ID The AWS access key identifier for client-side encryption
10+
# AWS_SECRET_ACCESS_KEY The AWS secret access key for client-side encryption
11+
# AWS_ACCESS_KEY_ID_AWS_KMS_NAMED The AWS access key identifier for client-side encryption's named KMS provider.
12+
# AWS_SECRET_ACCESS_KEY_AWS_KMS_NAMED The AWS secret access key for client-side encryption's named KMS provider.
13+
# AWS_TEMP_ACCESS_KEY_ID The temporary AWS access key identifier for client-side encryption
14+
# AWS_TEMP_SECRET_ACCESS_KEY The temporary AWS secret access key for client-side encryption
15+
# AWS_TEMP_SESSION_TOKEN The temporary AWS session token for client-side encryption
16+
# AZURE_TENANT_ID The Azure tenant identifier for client-side encryption
17+
# AZURE_CLIENT_ID The Azure client identifier for client-side encryption
18+
# AZURE_CLIENT_SECRET The Azure client secret for client-side encryption
19+
# GCP_EMAIL The GCP email for client-side encryption
20+
# GCP_PRIVATE_KEY The GCP private key for client-side encryption
21+
# AZUREKMS_KEY_VAULT_ENDPOINT The Azure key vault endpoint for integration tests
22+
# AZUREKMS_KEY_NAME The Azure key name endpoint for integration tests
2123

2224
MONGODB_URI=${MONGODB_URI:-}
2325

‎.evergreen/run-tests.sh

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -4,28 +4,30 @@ set -o xtrace # Write all commands first to stderr
44
set -o errexit # Exit the script with error if any of the commands fail
55

66
# Supported/used environment variables:
7-
# AUTH Set to enable authentication. Values are: "auth" / "noauth" (default)
8-
# SSL Set to enable SSL. Values are "ssl" / "nossl" (default)
9-
# NETTY_SSL_PROVIDER The Netty TLS/SSL protocol provider. Ignored unless SSL is "ssl" and STREAM_TYPE is "netty". Values are "JDK", "OPENSSL", null (a.k.a. "" or '') (default).
10-
# MONGODB_URI Set the suggested connection MONGODB_URI (including credentials and topology info)
11-
# TOPOLOGY Allows you to modify variables and the MONGODB_URI based on test topology
12-
# Supported values: "server", "replica_set", "sharded_cluster"
13-
# COMPRESSOR Set to enable compression. Values are "snappy" and "zlib" (default is no compression)
14-
# STREAM_TYPE Set the stream type. Values are "nio2" or "netty". Defaults to "nio2".
15-
# JDK Set the version of java to be used. Java versions can be set from the java toolchain /opt/java
16-
# SLOW_TESTS_ONLY Set to true to only run the slow tests
17-
# AWS_ACCESS_KEY_ID The AWS access key identifier for client-side encryption
18-
# AWS_SECRET_ACCESS_KEY The AWS secret access key for client-side encryption
19-
# AWS_TEMP_ACCESS_KEY_ID The temporary AWS access key identifier for client-side encryption
20-
# AWS_TEMP_SECRET_ACCESS_KEY The temporary AWS secret access key for client-side encryption
21-
# AWS_TEMP_SESSION_TOKEN The temporary AWS session token for client-side encryption
22-
# AZURE_TENANT_ID The Azure tenant identifier for client-side encryption
23-
# AZURE_CLIENT_ID The Azure client identifier for client-side encryption
24-
# AZURE_CLIENT_SECRET The Azure client secret for client-side encryption
25-
# GCP_EMAIL The GCP email for client-side encryption
26-
# GCP_PRIVATE_KEY The GCP private key for client-side encryption
27-
# AZUREKMS_KEY_VAULT_ENDPOINT The Azure key vault endpoint for integration tests
28-
# AZUREKMS_KEY_NAME The Azure key name endpoint for integration tests
7+
# AUTH Set to enable authentication. Values are: "auth" / "noauth" (default)
8+
# SSL Set to enable SSL. Values are "ssl" / "nossl" (default)
9+
# NETTY_SSL_PROVIDER The Netty TLS/SSL protocol provider. Ignored unless SSL is "ssl" and STREAM_TYPE is "netty". Values are "JDK", "OPENSSL", null (a.k.a. "" or '') (default).
10+
# MONGODB_URI Set the suggested connection MONGODB_URI (including credentials and topology info)
11+
# TOPOLOGY Allows you to modify variables and the MONGODB_URI based on test topology
12+
# Supported values: "server", "replica_set", "sharded_cluster"
13+
# COMPRESSOR Set to enable compression. Values are "snappy" and "zlib" (default is no compression)
14+
# STREAM_TYPE Set the stream type. Values are "nio2" or "netty". Defaults to "nio2".
15+
# JDK Set the version of java to be used. Java versions can be set from the java toolchain /opt/java
16+
# SLOW_TESTS_ONLY Set to true to only run the slow tests
17+
# AWS_ACCESS_KEY_ID The AWS access key identifier for client-side encryption
18+
# AWS_SECRET_ACCESS_KEY The AWS secret access key for client-side encryption
19+
# AWS_ACCESS_KEY_ID_AWS_KMS_NAMED The AWS access key identifier for client-side encryption's named KMS provider.
20+
# AWS_SECRET_ACCESS_KEY_AWS_KMS_NAMED The AWS secret access key for client-side encryption's named KMS provider.
21+
# AWS_TEMP_ACCESS_KEY_ID The temporary AWS access key identifier for client-side encryption
22+
# AWS_TEMP_SECRET_ACCESS_KEY The temporary AWS secret access key for client-side encryption
23+
# AWS_TEMP_SESSION_TOKEN The temporary AWS session token for client-side encryption
24+
# AZURE_TENANT_ID The Azure tenant identifier for client-side encryption
25+
# AZURE_CLIENT_ID The Azure client identifier for client-side encryption
26+
# AZURE_CLIENT_SECRET The Azure client secret for client-side encryption
27+
# GCP_EMAIL The GCP email for client-side encryption
28+
# GCP_PRIVATE_KEY The GCP private key for client-side encryption
29+
# AZUREKMS_KEY_VAULT_ENDPOINT The Azure key vault endpoint for integration tests
30+
# AZUREKMS_KEY_NAME The Azure key name endpoint for integration tests
2931

3032
AUTH=${AUTH:-noauth}
3133
SSL=${SSL:-nossl}

‎driver-core/src/main/com/mongodb/AutoEncryptionSettings.java

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -293,9 +293,15 @@ public String getKeyVaultNamespace() {
293293
/**
294294
* Gets the map of KMS provider properties.
295295
*
296+
* <p> Multiple KMS providers can be specified within this map. Each KMS provider is identified by a unique key.
297+
* Keys are formatted as either {@code "KMS provider type"} or {@code "KMS provider type:KMS provider name"} (e.g., "aws" or "aws:myname").
298+
* The KMS provider name must only contain alphanumeric characters (a-z, A-Z, 0-9), underscores (_), and must not be empty.
296299
* <p>
297-
* Multiple KMS providers may be specified. The following KMS providers are supported: "aws", "azure", "gcp" and "local". The
298-
* kmsProviders map values differ by provider:
300+
* Supported KMS provider types include "aws", "azure", "gcp", and "local". The provider name is optional and allows
301+
* for the configuration of multiple providers of the same type under different names (e.g., "aws:name1" and
302+
* "aws:name2" could represent different AWS accounts).
303+
* <p>
304+
* The kmsProviders map values differ by provider type. The following properties are supported for each provider type:
299305
* </p>
300306
* <p>
301307
* For "aws", the properties are:
@@ -335,15 +341,15 @@ public String getKeyVaultNamespace() {
335341
* <ul>
336342
* <li>key: byte[] of length 96, the local key</li>
337343
* </ul>
338-
*
339344
* <p>
340345
* It is also permitted for the value of a kms provider to be an empty map, in which case the driver will first
341346
* </p>
342347
* <ul>
343348
* <li>use the {@link Supplier} configured in {@link #getKmsProviderPropertySuppliers()} to obtain a non-empty map</li>
344349
* <li>attempt to obtain the properties from the environment</li>
345350
* </ul>
346-
*
351+
* However, KMS providers containing a name (e.g., "aws:myname") do not support dynamically obtaining KMS properties from the {@link Supplier}
352+
* or environment.
347353
* @return map of KMS provider properties
348354
* @see #getKmsProviderPropertySuppliers()
349355
*/

‎driver-core/src/main/com/mongodb/ClientEncryptionSettings.java

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -216,9 +216,15 @@ public String getKeyVaultNamespace() {
216216
/**
217217
* Gets the map of KMS provider properties.
218218
*
219+
* <p> Multiple KMS providers can be specified within this map. Each KMS provider is identified by a unique key.
220+
* Keys are formatted as either {@code "KMS provider type"} or {@code "KMS provider type:KMS provider name"} (e.g., "aws" or "aws:myname").
221+
* The KMS provider name must only contain alphanumeric characters (a-z, A-Z, 0-9), underscores (_), and must not be empty.
219222
* <p>
220-
* Multiple KMS providers may be specified. The following KMS providers are supported: "aws", "azure", "gcp" and "local". The
221-
* kmsProviders map values differ by provider:
223+
* Supported KMS provider types include "aws", "azure", "gcp", and "local". The provider name is optional and allows
224+
* for the configuration of multiple providers of the same type under different names (e.g., "aws:name1" and
225+
* "aws:name2" could represent different AWS accounts).
226+
* <p>
227+
* The kmsProviders map values differ by provider type. The following properties are supported for each provider type:
222228
* </p>
223229
* <p>
224230
* For "aws", the properties are:
@@ -265,6 +271,8 @@ public String getKeyVaultNamespace() {
265271
* <li>use the {@link Supplier} configured in {@link #getKmsProviderPropertySuppliers()} to obtain a non-empty map</li>
266272
* <li>attempt to obtain the properties from the environment</li>
267273
* </ul>
274+
* However, KMS providers containing a name (e.g., "aws:myname") do not support dynamically obtaining KMS properties from the {@link Supplier}
275+
* or environment.
268276
* @return map of KMS provider properties
269277
* @see #getKmsProviderPropertySuppliers()
270278
*/

‎driver-core/src/main/com/mongodb/client/model/vault/DataKeyOptions.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -95,22 +95,22 @@ public List<String> getKeyAltNames() {
9595
* The masterKey identifies a KMS-specific key used to encrypt the new data key.
9696
* </p>
9797
* <p>
98-
* If the kmsProvider is "aws" the master key is required and must contain the following fields:
98+
* If the kmsProvider type is "aws" the master key is required and must contain the following fields:
9999
* </p>
100100
* <ul>
101101
* <li>region: a String containing the AWS region in which to locate the master key</li>
102102
* <li>key: a String containing the Amazon Resource Name (ARN) to the AWS customer master key</li>
103103
* </ul>
104104
* <p>
105-
* If the kmsProvider is "azure" the master key is required and must contain the following fields:
105+
* If the kmsProvider type is "azure" the master key is required and must contain the following fields:
106106
* </p>
107107
* <ul>
108108
* <li>keyVaultEndpoint: a String with the host name and an optional port. Example: "example.vault.azure.net".</li>
109109
* <li>keyName: a String</li>
110110
* <li>keyVersion: an optional String, the specific version of the named key, defaults to using the key's primary version.</li>
111111
* </ul>
112112
* <p>
113-
* If the kmsProvider is "gcp" the master key is required and must contain the following fields:
113+
* If the kmsProvidertype type is "gcp" the master key is required and must contain the following fields:
114114
* </p>
115115
* <ul>
116116
* <li>projectId: a String</li>
@@ -121,7 +121,7 @@ public List<String> getKeyAltNames() {
121121
* <li>endpoint: an optional String, with the host with optional port. Defaults to "cloudkms.googleapis.com".</li>
122122
* </ul>
123123
* <p>
124-
* If the kmsProvider is "kmip" the master key is required and must contain the following fields:
124+
* If the kmsProvider type is "kmip" the master key is required and must contain the following fields:
125125
* </p>
126126
* <ul>
127127
* <li>keyId: optional String, keyId is the KMIP Unique Identifier to a 96 byte KMIP Secret Data managed object. If keyId is
@@ -133,7 +133,7 @@ public List<String> getKeyAltNames() {
133133
* to false.</li>
134134
* </ul>
135135
* <p>
136-
* If the kmsProvider is "local" the masterKey is not applicable.
136+
* If the kmsProvider type is "local" the masterKey is not applicable.
137137
* </p>
138138
* @return the master key document
139139
*/

‎driver-core/src/main/com/mongodb/client/model/vault/RewrapManyDataKeyOptions.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -73,22 +73,22 @@ public RewrapManyDataKeyOptions masterKey(final BsonDocument masterKey) {
7373
* The masterKey identifies a KMS-specific key used to encrypt the new data key.
7474
* </p>
7575
* <p>
76-
* If the kmsProvider is "aws" the master key is required and must contain the following fields:
76+
* If the kmsProvider type is "aws" the master key is required and must contain the following fields:
7777
* </p>
7878
* <ul>
7979
* <li>region: a String containing the AWS region in which to locate the master key</li>
8080
* <li>key: a String containing the Amazon Resource Name (ARN) to the AWS customer master key</li>
8181
* </ul>
8282
* <p>
83-
* If the kmsProvider is "azure" the master key is required and must contain the following fields:
83+
* If the kmsProvider type is "azure" the master key is required and must contain the following fields:
8484
* </p>
8585
* <ul>
8686
* <li>keyVaultEndpoint: a String with the host name and an optional port. Example: "example.vault.azure.net".</li>
8787
* <li>keyName: a String</li>
8888
* <li>keyVersion: an optional String, the specific version of the named key, defaults to using the key's primary version.</li>
8989
* </ul>
9090
* <p>
91-
* If the kmsProvider is "gcp" the master key is required and must contain the following fields:
91+
* If the kmsProvider type is "gcp" the master key is required and must contain the following fields:
9292
* </p>
9393
* <ul>
9494
* <li>projectId: a String</li>
@@ -99,7 +99,7 @@ public RewrapManyDataKeyOptions masterKey(final BsonDocument masterKey) {
9999
* <li>endpoint: an optional String, with the host with optional port. Defaults to "cloudkms.googleapis.com".</li>
100100
* </ul>
101101
* <p>
102-
* If the kmsProvider is "kmip" the master key is required and must contain the following fields:
102+
* If the kmsProvider type is "kmip" the master key is required and must contain the following fields:
103103
* </p>
104104
* <ul>
105105
* <li>keyId: optional String, keyId is the KMIP Unique Identifier to a 96 byte KMIP Secret Data managed object. If keyId is
@@ -108,7 +108,7 @@ public RewrapManyDataKeyOptions masterKey(final BsonDocument masterKey) {
108108
* defaults to the required endpoint from the KMS providers map.</li>
109109
* </ul>
110110
* <p>
111-
* If the kmsProvider is "local" the masterKey is not applicable.
111+
* If the kmsProvider type is "local" the masterKey is not applicable.
112112
* </p>
113113
* @return the master key document
114114
*/

0 commit comments

Comments
 (0)