From 70f62f547c463c4405ed18bc0850b5cdbaef0b8a Mon Sep 17 00:00:00 2001
From: Paul Medynski <31868385+paulmedynski@users.noreply.github.com>
Date: Tue, 15 Jul 2025 14:53:52 -0300
Subject: [PATCH 1/2] User Story 37940: Add new AKV URLs for FR and DE
- Added 4 new trusted AKV URLs.
---
.../AzureKeyVaultProvider/Constants.cs | 32 +++++++++++++------
1 file changed, 22 insertions(+), 10 deletions(-)
diff --git a/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Constants.cs b/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Constants.cs
index 6e26ac8539..a0e6b0762f 100644
--- a/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Constants.cs
+++ b/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Constants.cs
@@ -9,16 +9,28 @@ internal static class Constants
///
/// Azure Key Vault Domain Name
///
- internal static readonly string[] AzureKeyVaultPublicDomainNames = new string[] {
- @"vault.azure.net", // default
- @"vault.azure.cn", // Azure China
- @"vault.usgovcloudapi.net", // US Government
- @"vault.microsoftazure.de", // Azure Germany
- @"managedhsm.azure.net", // public HSM vault
- @"managedhsm.azure.cn", // Azure China HSM vault
- @"managedhsm.usgovcloudapi.net", // US Government HSM vault
- @"managedhsm.microsoftazure.de" // Azure Germany HSM vault
- };
+ internal static readonly string[] AzureKeyVaultPublicDomainNames =
+ [
+ // Azure Key Vaults
+ @"vault.azure.net", // Default
+ @"vault.azure.cn", // China
+ @"vault.usgovcloudapi.net", // US Government
+ @"vault.microsoftazure.de", // Azure Germany
+ @"vault.cloudapi.microsoft.scloud", // USSec
+ @"vault.cloudapi.eaglex.ic.gov", // USNat
+ @"vault.sovcloud-api.fr", // France (Bleu)
+ @"vault.sovcloud-api.de", // Germany (Delos)
+
+ // Managed High Security Modules (HSM) Vaults
+ @"managedhsm.azure.net",
+ @"managedhsm.azure.cn",
+ @"managedhsm.usgovcloudapi.net",
+ @"managedhsm.microsoftazure.de",
+ @"managedhsm.cloudapi.microsoft.scloud",
+ @"managedhsm.cloudapi.eaglex.ic.gov",
+ @"managedhsm.sovcloud-api.fr",
+ @"managedhsm.sovcloud-api.de",
+ ];
///
/// Always Encrypted Parameter names for exec handling
From 0c57efde0059c657f1bb543827206fd16e60b7d7 Mon Sep 17 00:00:00 2001
From: Paul Medynski <31868385+paulmedynski@users.noreply.github.com>
Date: Wed, 16 Jul 2025 15:17:23 -0300
Subject: [PATCH 2/2] User Story 37940: Add new AKV URLs for FR and DE
- Fixed existing manual tests and added unit tests.
---
.../AzureKeyVaultProvider/Constants.cs | 32 ++---
.../add-ons/AzureKeyVaultProvider/Utils.cs | 2 +-
.../AlwaysEncrypted/ExceptionTestAKVStore.cs | 5 +-
.../AlwaysEncrypted/TrustedUrlsTest.cs | 133 ++++++++++++++++++
....Data.SqlClient.ManualTesting.Tests.csproj | 11 +-
5 files changed, 158 insertions(+), 25 deletions(-)
create mode 100644 src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/TrustedUrlsTest.cs
diff --git a/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Constants.cs b/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Constants.cs
index a0e6b0762f..a888d88e13 100644
--- a/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Constants.cs
+++ b/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Constants.cs
@@ -12,24 +12,24 @@ internal static class Constants
internal static readonly string[] AzureKeyVaultPublicDomainNames =
[
// Azure Key Vaults
- @"vault.azure.net", // Default
- @"vault.azure.cn", // China
- @"vault.usgovcloudapi.net", // US Government
- @"vault.microsoftazure.de", // Azure Germany
- @"vault.cloudapi.microsoft.scloud", // USSec
- @"vault.cloudapi.eaglex.ic.gov", // USNat
- @"vault.sovcloud-api.fr", // France (Bleu)
- @"vault.sovcloud-api.de", // Germany (Delos)
+ "vault.azure.net", // Default
+ "vault.azure.cn", // China
+ "vault.usgovcloudapi.net", // US Government
+ "vault.microsoftazure.de", // Azure Germany
+ "vault.cloudapi.microsoft.scloud", // USSec
+ "vault.cloudapi.eaglex.ic.gov", // USNat
+ "vault.sovcloud-api.fr", // France (Bleu)
+ "vault.sovcloud-api.de", // Germany (Delos)
// Managed High Security Modules (HSM) Vaults
- @"managedhsm.azure.net",
- @"managedhsm.azure.cn",
- @"managedhsm.usgovcloudapi.net",
- @"managedhsm.microsoftazure.de",
- @"managedhsm.cloudapi.microsoft.scloud",
- @"managedhsm.cloudapi.eaglex.ic.gov",
- @"managedhsm.sovcloud-api.fr",
- @"managedhsm.sovcloud-api.de",
+ "managedhsm.azure.net",
+ "managedhsm.azure.cn",
+ "managedhsm.usgovcloudapi.net",
+ "managedhsm.microsoftazure.de",
+ "managedhsm.cloudapi.microsoft.scloud",
+ "managedhsm.cloudapi.eaglex.ic.gov",
+ "managedhsm.sovcloud-api.fr",
+ "managedhsm.sovcloud-api.de"
];
///
diff --git a/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Utils.cs b/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Utils.cs
index f71080ffab..ea7ffb4671 100644
--- a/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Utils.cs
+++ b/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Utils.cs
@@ -138,7 +138,7 @@ internal static ArgumentException InvalidAKVPath(string masterKeyPath, bool isSy
internal static ArgumentException InvalidAKVUrl(string masterKeyPath) =>
new(string.Format(CultureInfo.InvariantCulture, Strings.InvalidAkvUrlTemplate, masterKeyPath), Constants.AeParamMasterKeyPath);
- internal static Exception InvalidAKVUrlTrustedEndpoints(string masterKeyPath, string endpoints) =>
+ internal static ArgumentException InvalidAKVUrlTrustedEndpoints(string masterKeyPath, string endpoints) =>
new ArgumentException(string.Format(CultureInfo.InvariantCulture, Strings.InvalidAkvKeyPathTrustedTemplate, masterKeyPath, endpoints),
Constants.AeParamMasterKeyPath);
}
diff --git a/src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/ExceptionTestAKVStore.cs b/src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/ExceptionTestAKVStore.cs
index 2465633a03..f7b5443689 100644
--- a/src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/ExceptionTestAKVStore.cs
+++ b/src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/ExceptionTestAKVStore.cs
@@ -182,7 +182,6 @@ public void InvalidCertificatePath()
string dummyPathWithOnlyHost = @"https://www.microsoft.com";
string invalidUrlErrorMessage = $@"Invalid url specified: '{dummyPathWithOnlyHost}'";
string dummyPathWithInvalidKey = @"https://www.microsoft.vault.azure.com/keys/dummykey/dummykeyid";
- string invalidTrustedEndpointErrorMessage = $@"Invalid Azure Key Vault key path specified: '{dummyPathWithInvalidKey}'. Valid trusted endpoints: vault.azure.net, vault.azure.cn, vault.usgovcloudapi.net, vault.microsoftazure.de, managedhsm.azure.net, managedhsm.azure.cn, managedhsm.usgovcloudapi.net, managedhsm.microsoftazure.de.\s+\(?Parameter (name: )?'?masterKeyPath('\))?";
Exception ex = Assert.Throws(
() => _fixture.AkvStoreProvider.EncryptColumnEncryptionKey(dummyPathWithOnlyHost, MasterKeyEncAlgo, cek));
@@ -190,7 +189,7 @@ public void InvalidCertificatePath()
ex = Assert.Throws(
() => _fixture.AkvStoreProvider.EncryptColumnEncryptionKey(dummyPathWithInvalidKey, MasterKeyEncAlgo, cek));
- Assert.Matches(invalidTrustedEndpointErrorMessage, ex.Message);
+ Assert.Matches(TrustedUrlsTest.MakeInvalidVaultErrorMessage(dummyPathWithInvalidKey), ex.Message);
ex = Assert.Throws(
() => _fixture.AkvStoreProvider.DecryptColumnEncryptionKey(dummyPathWithOnlyHost, MasterKeyEncAlgo, encryptedCek));
@@ -198,7 +197,7 @@ public void InvalidCertificatePath()
ex = Assert.Throws(
() => _fixture.AkvStoreProvider.DecryptColumnEncryptionKey(dummyPathWithInvalidKey, MasterKeyEncAlgo, encryptedCek));
- Assert.Matches(invalidTrustedEndpointErrorMessage, ex.Message);
+ Assert.Matches(TrustedUrlsTest.MakeInvalidVaultErrorMessage(dummyPathWithInvalidKey), ex.Message);
}
[InlineData(true)]
diff --git a/src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/TrustedUrlsTest.cs b/src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/TrustedUrlsTest.cs
new file mode 100644
index 0000000000..a526eec22b
--- /dev/null
+++ b/src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/TrustedUrlsTest.cs
@@ -0,0 +1,133 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System;
+using System.Reflection;
+using Azure.Core;
+using Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider;
+using Xunit;
+
+namespace Microsoft.Data.SqlClient.ManualTesting.Tests.AlwaysEncrypted;
+
+public class TrustedUrlsTest
+{
+ private readonly SqlColumnEncryptionAzureKeyVaultProvider _provider;
+ private readonly MethodInfo _method;
+
+ public TrustedUrlsTest()
+ {
+ _provider = new(new SqlClientCustomTokenCredential());
+
+ var assembly = typeof(SqlColumnEncryptionAzureKeyVaultProvider).Assembly;
+ var clazz = assembly.GetType("Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.SqlColumnEncryptionAzureKeyVaultProvider");
+ _method = clazz.GetMethod(
+ "ValidateNonEmptyAKVPath",
+ System.Reflection.BindingFlags.NonPublic |
+ System.Reflection.BindingFlags.Instance);
+ }
+
+ public const string InvalidVaultKeyPathErrorMessage =
+ @"Invalid Azure Key Vault key path specified: 'https://www.microsoft.com'. " +
+ "Valid trusted endpoints: " +
+ "vault.azure.net, " +
+ "vault.azure.cn, " +
+ "vault.usgovcloudapi.net, " +
+ "vault.microsoftazure.de, " +
+ "vault.cloudapi.microsoft.scloud, " +
+ "vault.cloudapi.eaglex.ic.gov, " +
+ "vault.sovcloud-api.fr, " +
+ "vault.sovcloud-api.de, " +
+ "managedhsm.azure.net, " +
+ "managedhsm.azure.cn, " +
+ "managedhsm.usgovcloudapi.net, " +
+ "managedhsm.microsoftazure.de, " +
+ "managedhsm.cloudapi.microsoft.scloud, " +
+ "managedhsm.cloudapi.eaglex.ic.gov, " +
+ "managedhsm.sovcloud-api.fr, " +
+ "managedhsm.sovcloud-api.de." +
+ @"\s+\(?Parameter (name: )?'?masterKeyPath('\))?";
+
+ private static string MakeUrl(string vault)
+ {
+ return $"https://{vault}/keys/dummykey/dummykeyid";
+ }
+
+ public static string MakeInvalidVaultErrorMessage(string url)
+ {
+ return
+ $"Invalid Azure Key Vault key path specified: '{url}'. " +
+ "Valid trusted endpoints: " +
+ "vault.azure.net, " +
+ "vault.azure.cn, " +
+ "vault.usgovcloudapi.net, " +
+ "vault.microsoftazure.de, " +
+ "vault.cloudapi.microsoft.scloud, " +
+ "vault.cloudapi.eaglex.ic.gov, " +
+ "vault.sovcloud-api.fr, " +
+ "vault.sovcloud-api.de, " +
+ "managedhsm.azure.net, " +
+ "managedhsm.azure.cn, " +
+ "managedhsm.usgovcloudapi.net, " +
+ "managedhsm.microsoftazure.de, " +
+ "managedhsm.cloudapi.microsoft.scloud, " +
+ "managedhsm.cloudapi.eaglex.ic.gov, " +
+ "managedhsm.sovcloud-api.fr, " +
+ "managedhsm.sovcloud-api.de." +
+ @"\s+\(?Parameter (name: )?'?masterKeyPath('\))?";
+ }
+
+ [Theory]
+ [InlineData("www.microsoft.com")]
+ [InlineData("www.microsoft.vault.azure.com")]
+ [InlineData("vault.azure.net.io")]
+ public void InvalidVaults(string vault)
+ {
+ // Test that invalid key paths throw and contain the expected error
+ // message.
+ var url = MakeUrl(vault);
+
+ try
+ {
+ _method.Invoke(_provider, new object[] { url, false });
+ }
+ catch (TargetInvocationException ex)
+ {
+ // Unwrap the exception to get the actual ArgumentException thrown
+ var argEx = ex.InnerException as ArgumentException;
+ Assert.NotNull(argEx);
+ var expected = MakeInvalidVaultErrorMessage(url);
+ Console.WriteLine("Actual: " + argEx.Message);
+ Console.WriteLine("Expected: " + expected);
+ Assert.Matches(expected, argEx.Message);
+ }
+ }
+
+ [Theory]
+ // Normal vaults.
+ [InlineData("vault.azure.net")]
+ [InlineData("vault.azure.cn")]
+ [InlineData("vault.usgovcloudapi.net")]
+ [InlineData("vault.microsoftazure.de")]
+ [InlineData("vault.cloudapi.microsoft.scloud")]
+ [InlineData("vault.cloudapi.eaglex.ic.gov")]
+ [InlineData("vault.sovcloud-api.fr")]
+ [InlineData("vault.sovcloud-api.de")]
+ // HSM vaults.
+ [InlineData("managedhsm.azure.net")]
+ [InlineData("managedhsm.azure.cn")]
+ [InlineData("managedhsm.usgovcloudapi.net")]
+ [InlineData("managedhsm.microsoftazure.de")]
+ [InlineData("managedhsm.cloudapi.microsoft.scloud")]
+ [InlineData("managedhsm.cloudapi.eaglex.ic.gov")]
+ [InlineData("managedhsm.sovcloud-api.fr")]
+ [InlineData("managedhsm.sovcloud-api.de")]
+ // Vaults with prefixes.
+ [InlineData("foo.bar.vault.microsoftazure.de")]
+ [InlineData("baz.bar.foo.managedhsm.sovcloud-api.fr")]
+ public void ValidVaults(string vault)
+ {
+ // Test that valid vault key paths do not throw exceptions
+ _method.Invoke(_provider, new object[] { MakeUrl(vault), false });
+ }
+}
diff --git a/src/Microsoft.Data.SqlClient/tests/ManualTests/Microsoft.Data.SqlClient.ManualTesting.Tests.csproj b/src/Microsoft.Data.SqlClient/tests/ManualTests/Microsoft.Data.SqlClient.ManualTesting.Tests.csproj
index 7bd503c5b9..98f790aac1 100644
--- a/src/Microsoft.Data.SqlClient/tests/ManualTests/Microsoft.Data.SqlClient.ManualTesting.Tests.csproj
+++ b/src/Microsoft.Data.SqlClient/tests/ManualTests/Microsoft.Data.SqlClient.ManualTesting.Tests.csproj
@@ -36,22 +36,23 @@
-
-
-
-
-
+
+
+
+
+
+