Skip to content

Commit 9494536

Browse files
LarryOstermanconniey
LarryOsterman
and
conniey
authored
Create initial implementation of machine generated Java sdk (Azure#18683)
* Initial checkpoint * Sync and Async codegen; Initial test results * Updates for sync and async generation * Added basic policy get test; refactored tests and enhanced things a lot * Policy Get and Set APIs * Completed preliminary test suite for MAA service * Added test and ci configuration * First minor change to readme * Added attestation to pom.xml * pom.xml file fixes * Deleted pom.xml.orig * Moved tests.yml; pom.xml version update * Updated maven checkstyle version * Added azure-security-attestation * Fixed a couple of version issues in pom.xml; updated version. * Another version try * Cleaned up tests after version number update * Use official version of nimbuds-jose-jwt instead of newest * Minor updates to readme.md, renamed readme.md for autorest to autorest.md * ClientUri for ClassifyClient is not optional * Enumerate resources for ci.yml * More CI changes * SpotBugs/CheckStyle fixes * More StyleCop changes * Final Checkstyle fixes * Added checkstyle exclusion for MAA generated code * Fixed path to archetype tests * Cleaned up MAA Checkstyle exceptions * Cleaned up MAA Checkstyle exceptions * Pull request feedback * One final? styleCheck fix * Corrected value of Location parameter * One more models exception * More pull request feedback items * Missed isolatedSigningKey in tests * Missed case in rename of azure-security-attestation to azure-security-attestation-service * Missed version_client.txt * Renamed back to azure-security-attestation since there are no other services with the -service suffix * Code review feedback * Added -service to attestation pom.xml * Hard coded certificates and keys for playback tests; Added exceptions in playback tests for bogus values in hard coded values * FIxed stupid typo in pom.xml * StyleCheck updates * Fixed typo in exceptions for models; fixed typo in autorest * SpotBugs exceptions go in the spotbugs exceptions file * Pull request feedback * Significant pull request feedback * Use assumeTrue to skip over invalid configurations * Removed en-us from links * Checkstyle fixes * Turned down error level in jacoco * Replacing with Mono.error and handle. * Updated session records to match current; updated snips in readme.md * Fixed playback tests after recent changes * Switched from .verifyComplete to .expectComplete/.verify to make steps explicit * Pull request feedback * Pull request feedback items Co-authored-by: Connie <conniey@microsoft.com>
1 parent e69c2d8 commit 9494536

File tree

172 files changed

+12289
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

172 files changed

+12289
-0
lines changed

‎eng/code-quality-reports/src/main/resources/checkstyle/checkstyle-suppressions.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -573,4 +573,11 @@ the main ServiceBusClientBuilder. -->
573573
<!-- Suppress checks in azure-core-experimental -->
574574
<suppress checks="com.azure.tools.checkstyle.checks.ExternalDependencyExposedCheck"
575575
files="com.azure.core.experimental.jsonpatch.(JsonPatchDocumentSerializer|JsonPatchOperationSerializer).java"/>
576+
577+
<!-- Suppress checks on AutoRest generated Attestation service code -->
578+
<suppress checks="(MissingJavadocMethod|EnforceFinalFields)"
579+
files=".*[/\\]azure[/\\]security[/\\]attestation[/\\]AttestationClientBuilder.java"/>
580+
<suppress checks="WhitespaceAround|ThrowFromClientLogger"
581+
files="com.azure.security.attestation.models.*\.java"/>
582+
576583
</suppressions>

‎eng/code-quality-reports/src/main/resources/spotbugs/spotbugs-exclude.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2477,4 +2477,10 @@
24772477
<Field name="data"/>
24782478
<Bug pattern="EI_EXPOSE_REP"/>
24792479
</Match>
2480+
2481+
<!-- Machine generated classes for MAA service generate spotBugs errors -->
2482+
<Match>
2483+
<Class name="~com.azure.security.attestation.models\.[\w]+"/>
2484+
<Bug pattern="PZLA_PREFER_ZERO_LENGTH_ARRAYS"/>
2485+
</Match>
24802486
</FindBugsFilter>

‎eng/versioning/version_client.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@ com.azure:azure-opentelemetry-exporter-azuremonitor;1.0.0-beta.2;1.0.0-beta.3
8686
com.azure:azure-quantum-jobs;1.0.0-beta.1;1.0.0-beta.1
8787
com.azure:azure-search-documents;11.1.3;11.2.0-beta.4
8888
com.azure:azure-search-perf;1.0.0-beta.1;1.0.0-beta.1
89+
com.azure:azure-security-attestation;1.0.0-beta.1;1.0.0-beta.1
8990
com.azure:azure-security-keyvault-administration;4.0.0-beta.3;4.0.0-beta.4
9091
com.azure:azure-security-keyvault-certificates;4.1.4;4.2.0-beta.3
9192
com.azure:azure-security-keyvault-keys;4.2.4;4.3.0-beta.4

‎pom.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@
1717
<!-- App Configuration -->
1818
<module>sdk/appconfiguration/azure-data-appconfiguration</module>
1919

20+
<!-- Attestation -->
21+
<module>sdk/attestation/azure-security-attestation</module>
22+
2023
<!-- Azure Communication Service -->
2124
<module>sdk/communication/azure-communication-administration</module>
2225
<module>sdk/communication/azure-communication-chat</module>
@@ -555,6 +558,7 @@
555558
<module>eng/jacoco-test-coverage</module>
556559
<module>sdk/anomalydetector</module>
557560
<module>sdk/appconfiguration</module>
561+
<module>sdk/attestation</module>
558562
<module>sdk/authorization</module>
559563
<module>sdk/batch</module>
560564
<module>sdk/boms</module>

‎sdk/attestation/azure-security-attestation/CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Release History
2+
3+
## 1.0.0-beta.1 (Unreleased)
4+
5+
- Initial release. Please see the README and wiki for information on the new design.

‎sdk/attestation/azure-security-attestation/README.md‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
# Azure Attestation client library for Java
2+
3+
Microsoft Azure Attestation (preview) is a unified solution for remotely verifying the trustworthiness of a platform and integrity of the binaries running inside it. The service supports attestation of the platforms backed by Trusted Platform Modules (TPMs) alongside the ability to attest to the state of Trusted Execution Environments (TEEs) such as Intel® Software Guard Extensions (SGX) enclaves and Virtualization-based Security (VBS) enclaves.
4+
5+
Attestation is a process for demonstrating that software binaries were properly instantiated on a trusted platform. Remote relying parties can then gain confidence that only such intended software is running on trusted hardware. Azure Attestation is a unified customer-facing service and framework for attestation.
6+
7+
Azure Attestation enables cutting-edge security paradigms such as Azure Confidential computing and Intelligent Edge protection. Customers have been requesting the ability to independently verify the location of a machine, the posture of a virtual machine (VM) on that machine, and the environment within which enclaves are running on that VM. Azure Attestation will empower these and many additional customer requests.
8+
9+
Azure Attestation receives evidence from compute entities, turns them into a set of claims, validates them against configurable policies, and produces cryptographic proofs for claims-based applications (for example, relying parties and auditing authorities).
10+
11+
> NOTE: This is a preliminary SDK for the Microsoft Azure Attestation service. It provides all the essential functionality to access the Azure Attestation service, but requires a significant amount of infrastructure to work correctly.
12+
13+
14+
## Getting started
15+
### Adding the package to your project
16+
Maven dependency for the Azure Attestation library. Add it to your project's POM file.
17+
18+
[//]: # ({x-version-update-start;com.azure:azure-security-attestation;current})
19+
```xml
20+
<!-- Install the Azure Attestation SDK -->
21+
<dependency>
22+
<groupId>com.azure</groupId>
23+
<artifactId>azure-security-attestation</artifactId>
24+
<version>1.0.0-beta.1</version>
25+
</dependency>
26+
```
27+
[//]: # ({x-version-update-end})
28+
29+
### Prerequisites
30+
- A [Java Development Kit (JDK)][jdk_link], version 8 or later.
31+
- [Azure Subscription][azure_subscription]
32+
- An existing [Azure Attestation][azure_attestation]. If you need to create an attestation instance, you can use the [Azure Cloud Shell][azure_cloud_shell] to create one with this Azure CLI command. Replace `<your-resource-group-name>` and `<your-instance-name>` with your own, unique names:
33+
34+
```bash
35+
az attestation create --resource-group <your-resource-group-name> --name <your-key-vault-name>
36+
```
37+
38+
### Authenticate the client
39+
In order to interact with the Azure Attestation service, your client must present an Azure Active Directory bearer token to the service.
40+
41+
The simplest way of providing a bearer token is to use the `DefaultAzureCredential` authentication method by providing client secret credentials is being used in this getting started section but you can find more ways to authenticate with [azure-identity][azure_identity].
42+
43+
44+
## Key concepts
45+
46+
The Microsoft Azure Attestation service runs in two separate modes: "Isolated" and "AAD". When the service is running in "Isolated" mode, the customer needs to
47+
provide additional information beyond their authentication credentials to verify that they are authorized to modify the state of an attestation instance.
48+
49+
There are four major client types provided in this preview SDK:
50+
- [SGX and TPM enclave attestation.](#attestation)
51+
- [MAA Attestation Token signing certificate discovery and validation.](#attestation-token-signing-certificate-discovery-and-validation)
52+
- [Attestation Policy management.](#policy-management)
53+
- [Attestation policy management certificate management](#policy-management-certificate-management) (yes, policy management management).
54+
55+
Each attestation instance operates in one of two separate modes of operation:
56+
* AAD mode.
57+
* Isolated mode
58+
59+
In "AAD" mode, access to the service is controlled solely by Azure Role Based Access Control. In "Isolated" mode,
60+
the client is expected to provide additional evidence to prove that the client is authorized
61+
to modify the service.
62+
63+
Finally, each region in which the Microsoft Azure Attestation service is available supports a "shared" instance, which
64+
can be used to attest SGX enclaves which only need verification against the azure baseline (there are no policies applied to the shared instance). TPM attestation is not available in the shared instance.
65+
While the shared instance requires AAD authentication, it does not have any RBAC policies - any customer with a valid AAD bearer token can attest using the shared instance.
66+
67+
68+
### Attestation
69+
SGX or TPM attestation is the process of validating evidence collected from
70+
a trusted execution environment to ensure that it meets both the Azure baseline for that environment and customer defined policies applied to that environment.
71+
72+
### Attestation token signing certificate discovery and validation
73+
Most responses from the MAA service are expressed in the form of a JSON Web Token. This token will be signed by a signing certificate
74+
issued by the MAA service for the specified instance. If the MAA service instance is running in a region where the service runs in an SGX enclave, then
75+
the certificate issued by the server can be verified using the [oe_verify_attestation_certificate() API](https://openenclave.github.io/openenclave/api/enclave_8h_a3b75c5638360adca181a0d945b45ad86.html).
76+
77+
### Policy Management
78+
Each attestation service instance has a policy applied to it which defines additional criteria which the customer has defined.
79+
80+
For more information on attestation policies, see [Attestation Policy](https://docs.microsoft.com/azure/attestation/author-sign-policy)
81+
82+
### Policy Management certificate management.
83+
When an attestation instance is running in "Isolated" mode, the customer who created the instance will have provided
84+
a policy management certificate at the time the instance is created. All policy modification operations require that the customer sign
85+
the policy data with one of the existing policy management certificates. The Policy Management Certificate Management APIs enable
86+
clients to "roll" the policy management certificates.
87+
88+
89+
## Examples
90+
91+
* [Attest an SGX enclave](#attest-sgx-enclave)
92+
* [Get attestation policy](#get-attestation-policy)
93+
* [Retrieve token validation certificates](#retrieve-token-certificates)
94+
95+
### Attest SGX Enclave
96+
97+
Use the `attestSgxEnclave` method to attest an SGX enclave.
98+
<!-- embedme src\samples\com\azure\security\attestation\ReadmeSamples.java#L36-L44 -->
99+
```java
100+
AttestSgxEnclaveRequest request = new AttestSgxEnclaveRequest();
101+
request.setQuote(decodedSgxQuote);
102+
RuntimeData runtimeData = new RuntimeData();
103+
runtimeData.setDataType(DataType.BINARY);
104+
runtimeData.setData(decodedRuntimeData);
105+
request.setRuntimeData(runtimeData);
106+
AttestationResponse response = client.attestSgxEnclave(request);
107+
108+
JWTClaimsSet claims = null;
109+
```
110+
111+
### Get attestation policy
112+
113+
The `attestationPolicyClient.get` method retrieves the attestation policy from the service.
114+
Attestation Policies are instanced on a per-attestation type basis, the `AttestationType` parameter defines the type to retrieve.
115+
The response to an attestation policy get is a JSON Web Token signed by the attestation service.
116+
The token contains an `x-ms-policy` claim, which in turn contains the secured (or unsecured) attestation policy document which was
117+
set by the customer.
118+
119+
The attestation policy document is a JSON Web Signature object, with a single field named `AttestationPolicy`, whose value is the actual policy document encoded in Base64Url.
120+
121+
<!-- embedme src\samples\com\azure\security\attestation\ReadmeSamples.java#L59-L84 -->
122+
```java
123+
124+
sponse policyResponse = client.get(AttestationType.SGX_ENCLAVE);
125+
testationToken(httpClient, clientUri, policyResponse.getToken())
126+
scribe(claims -> {
127+
if (claims != null) {
128+
129+
String policyDocument = claims.getClaims().get("x-ms-policy").toString();
130+
131+
JOSEObject policyJose = null;
132+
try {
133+
policyJose = JOSEObject.parse(policyDocument);
134+
} catch (ParseException e) {
135+
throw logger.logExceptionAsError(new RuntimeException(e.toString()));
136+
}
137+
assert policyJose != null;
138+
Map<String, Object> jsonObject = policyJose.getPayload().toJSONObject();
139+
if (jsonObject != null) {
140+
assertTrue(jsonObject.containsKey("AttestationPolicy"));
141+
String base64urlPolicy = jsonObject.get("AttestationPolicy").toString();
142+
143+
byte[] attestationPolicyUtf8 = Base64.getUrlDecoder().decode(base64urlPolicy);
144+
String attestationPolicy;
145+
attestationPolicy = new String(attestationPolicyUtf8, StandardCharsets.UTF_8);
146+
// Inspect the retrieved policy.
147+
}
148+
}
149+
```
150+
151+
### Retrieve Token Certificates
152+
153+
Use `SigningCertificatesClient.get` to retrieve the certificates which can be used to validate the token returned from the attestation service.
154+
155+
<!-- embedme src\samples\com\azure\security\attestation\ReadmeSamples.java#L89-L92 -->
156+
```java
157+
158+
AttestationClientBuilder attestationBuilder = getBuilder(httpClient, clientUri);
159+
160+
JsonWebKeySet certs = attestationBuilder.buildSigningCertificatesClient().get();
161+
```
162+
163+
## Troubleshooting
164+
165+
Troubleshooting information for the MAA service can be found [here](https://docs.microsoft.com/azure/attestation/troubleshoot-guide)
166+
## Next steps
167+
For more information about the Microsoft Azure Attestation service, please see our [documentation page](https://docs.microsoft.com/azure/attestation/).
168+
169+
## Contributing
170+
This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.
171+
172+
When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.
173+
174+
This project has adopted the [Microsoft Open Source Code of Conduct][microsoft_code_of_conduct]. For more information see the Code of Conduct FAQ or contact <opencode@microsoft.com> with any additional questions or comments.
175+
176+
177+
<!-- LINKS -->
178+
[style-guide-msft]: https://docs.microsoft.com/style-guide/capitalization
179+
180+
![Impressions](https://azure-sdk-impressions.azurewebsites.net/api/impressions/azure-sdk-for-java%2Fsdk%2Fattestation%2Fazure-security-attestation%2FREADME.png)

‎sdk/attestation/azure-security-attestation/pom.xml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0"
2+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
5+
<parent>
6+
<groupId>com.azure</groupId>
7+
<artifactId>azure-client-sdk-parent</artifactId>
8+
<version>1.7.0</version> <!-- {x-version-update;com.azure:azure-client-sdk-parent;current} -->
9+
<relativePath>../../parents/azure-client-sdk-parent</relativePath>
10+
</parent>
11+
12+
<groupId>com.azure</groupId>
13+
<artifactId>azure-security-attestation</artifactId>
14+
<version>1.0.0-beta.1</version> <!-- {x-version-update;com.azure:azure-security-attestation;current} -->
15+
16+
<name>Microsoft Azure SDK for Attestation</name>
17+
<description>This package contains Microsoft Azure SDK for the Microsoft Azure Attestation service.</description>
18+
19+
<distributionManagement>
20+
<site>
21+
<id>azure-java-build-docs</id>
22+
<url>${site.url}/site/${project.artifactId}</url>
23+
</site>
24+
</distributionManagement>
25+
26+
<scm>
27+
<url>https://github.com/Azure/azure-sdk-for-java</url>
28+
</scm>
29+
30+
<dependencies>
31+
<dependency>
32+
<groupId>com.azure</groupId>
33+
<artifactId>azure-core</artifactId>
34+
<version>1.12.0</version> <!-- {x-version-update;com.azure:azure-core;dependency} -->
35+
</dependency>
36+
<!-- Test dependencies -->
37+
<dependency>
38+
<groupId>org.junit.jupiter</groupId>
39+
<artifactId>junit-jupiter-api</artifactId>
40+
<version>5.6.3</version> <!-- {x-version-update;org.junit.jupiter:junit-jupiter-api;external_dependency} -->
41+
<scope>test</scope>
42+
</dependency>
43+
<dependency>
44+
<groupId>org.junit.jupiter</groupId>
45+
<artifactId>junit-jupiter-engine</artifactId>
46+
<version>5.6.3</version> <!-- {x-version-update;org.junit.jupiter:junit-jupiter-engine;external_dependency} -->
47+
<scope>test</scope>
48+
</dependency>
49+
<dependency>
50+
<groupId>org.junit.jupiter</groupId>
51+
<artifactId>junit-jupiter-params</artifactId>
52+
<version>5.6.3</version> <!-- {x-version-update;org.junit.jupiter:junit-jupiter-params;external_dependency} -->
53+
<scope>test</scope>
54+
</dependency>
55+
<dependency>
56+
<groupId>com.azure</groupId>
57+
<artifactId>azure-core-test</artifactId>
58+
<version>1.5.2</version> <!-- {x-version-update;com.azure:azure-core-test;dependency} -->
59+
<scope>test</scope>
60+
</dependency>
61+
<dependency>
62+
<groupId>com.azure</groupId>
63+
<artifactId>azure-core-http-okhttp</artifactId>
64+
<version>1.4.1</version> <!-- {x-version-update;com.azure:azure-core-http-okhttp;dependency} -->
65+
<scope>test</scope>
66+
</dependency>
67+
<dependency>
68+
<groupId>com.azure</groupId>
69+
<artifactId>azure-identity</artifactId>
70+
<version>1.2.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
71+
<scope>test</scope>
72+
</dependency>
73+
<dependency>
74+
<groupId>com.nimbusds</groupId>
75+
<artifactId>nimbus-jose-jwt</artifactId>
76+
<version>8.19</version> <!-- {x-version-update;com.nimbusds:nimbus-jose-jwt;external_dependency} -->
77+
<scope>test</scope>
78+
</dependency>
79+
</dependencies>
80+
81+
<properties>
82+
<jacoco.min.linecoverage>0.10</jacoco.min.linecoverage>
83+
<jacoco.min.branchcoverage>0.10</jacoco.min.branchcoverage>
84+
</properties>
85+
86+
<build>
87+
<plugins>
88+
<plugin>
89+
<groupId>org.jacoco</groupId>
90+
<artifactId>jacoco-maven-plugin</artifactId>
91+
<version>0.8.5</version> <!-- {x-version-update;org.jacoco:jacoco-maven-plugin;external_dependency} -->
92+
<configuration>
93+
</configuration>
94+
</plugin>
95+
</plugins>
96+
</build>
97+
<profiles>
98+
<profile>
99+
<id>java-lts</id>
100+
<activation>
101+
<jdk>[11,)</jdk>
102+
</activation>
103+
<build>
104+
<plugins>
105+
<plugin>
106+
<!-- Needed to prevent a java.lang.reflect error from fasterxml -->
107+
<groupId>org.apache.maven.plugins</groupId>
108+
<artifactId>maven-surefire-plugin</artifactId>
109+
<version>3.0.0-M3</version> <!-- {x-version-update;org.apache.maven.plugins:maven-surefire-plugin;external_dependency} -->
110+
<configuration>
111+
<argLine>
112+
--add-opens com.azure.security.attestation/com.azure.security.attestation=ALL-UNNAMED
113+
--add-opens com.azure.security.attestation/com.azure.security.attestation.models=ALL-UNNAMED
114+
--add-opens com.azure.security.attestation/com.azure.security.attestation.models=com.fasterxml.jackson.databind
115+
</argLine>
116+
</configuration>
117+
</plugin>
118+
</plugins>
119+
</build>
120+
</profile>
121+
</profiles>
122+
</project>

0 commit comments

Comments
 (0)