Add kmip tests, use mongoCrypt snapshot #1406
Conversation
| @@ -128,6 +128,8 @@ public List<String> getKeyAltNames() { | |||
| * omitted, the driver creates a random 96 byte KMIP Secret Data managed object.</li> | |||
| * <li>endpoint: a String, the endpoint as a host with required port. e.g. "example.com:443". If endpoint is not provided, it | |||
| * defaults to the required endpoint from the KMS providers map.</li> | |||
| * <li>delegated: If true (recommended), the KMIP server must decrypt this key. If delegated is not provided, | |||
| * defaults to false. </li> | |||
There was a problem hiding this comment.
The Javadoc for the 'delegated' parameter currently highlights only decryption, probably referencing the spec comment, delegated: Optional<Boolean> // If true, this key should be decrypted by the KMIP server. However, the KMIP server is also involved in encrypting keys. For example, when we use the createDataKey() method to encrypt DEKs for storage in the database. The specification further also states that
If the delegated option is set to true (recommended), the KMIP server will instead perform encryption and
decryption locally
We should note in the Javadoc that when 'delegated' is set to true, the KMIP server manages both encryption and decryption.
There was a problem hiding this comment.
I noticed updates to legacy CSFLE tests in the following files: azureKMS.json, gcpKMS.json. (PR 1507) Could you share the rationale behind not including these changes in our current test suites?
JAVA-5300
Copies tests, updates docs, and uses the (erroneously named) 1.8.0-SNAPSHOT which has the
delegatedfeature available.See also, update/fix in: mongodb/specifications#1591