Skip to content

Security domain #13226

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 20 commits into from
Oct 19, 2020
Merged

Security domain #13226

merged 20 commits into from
Oct 19, 2020

Conversation

@isra-fel
Copy link
Member

@isra-fel isra-fel commented Oct 15, 2020

Description

Checklist

  • I have read the Submitting Changes section of CONTRIBUTING.md
  • The title of the PR is clear and informative
  • The appropriate ChangeLog.md file(s) has been updated:
    • For any service, the ChangeLog.md file can be found at src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md
    • A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header -- no new version header should be added
  • The PR does not introduce breaking changes
  • If applicable, the changes made in the PR have proper test coverage
  • For public API changes to cmdlets:
    • a cmdlet design review was approved for the changes in this repository (Microsoft internal only)
    • the markdown help files have been regenerated using the commands listed here

@BethanyZhou BethanyZhou marked this pull request as ready for review October 19, 2020 04:35
@BethanyZhou BethanyZhou self-assigned this Oct 19, 2020
isra-fel
isra-fel commented Oct 19, 2020
View reviewed changes
@isra-fel isra-fel marked this pull request as draft October 19, 2020 04:40
@isra-fel isra-fel marked this pull request as ready for review October 19, 2020 06:09
@isra-fel
Copy link
Member Author

isra-fel commented Oct 19, 2020 •
edited
Loading

Suppress Keys and Certificates;
Remove spaces in parameter set names
Merge PR

isra-fel
isra-fel commented Oct 19, 2020
View reviewed changes
Copy link
Member Author

@isra-fel isra-fel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

APPROVE

src/KeyVault/KeyVault/SecurityDomain/Cmdlets/SecurityDomainCmdlet.cs
protected const string ByInputObject = "By InputObject";
protected const string ByResourceId = "By Resource ID";

[Parameter(HelpMessage = "Name of the managed HSM.", Mandatory = true, ParameterSetName = ByName)]
Copy link
Member Author

@isra-fel isra-fel Oct 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

position

src/KeyVault/KeyVault/SecurityDomain/Cmdlets/RestoreSecurityDomain.cs

private void ValidateParameters()
{
if (Keys.Length < 2)
Copy link
Member Author

@isra-fel isra-fel Oct 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

use const

src/KeyVault/KeyVault/SecurityDomain/Models/SecurityDomainClient.cs

_uriHelper = new VaultUriHelper(
defaultContext.Environment.GetEndpoint(AzureEnvironment.Endpoint.AzureKeyVaultDnsSuffix),
defaultContext.Environment.GetEndpoint(ExtendedEndpoint.ManagedHsmServiceEndpointSuffix));
Copy link
Member Author

@isra-fel isra-fel Oct 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

redesign helper
use only one suffix

src/KeyVault/KeyVault/help/Restore-AzManagedHsmSecurityDomain.md Outdated

### Example 1
```powershell
PS C:\> $keys = @{PublicKey = "C:\Users\yeliu\code\azure-powershell\src\KeyVault\SecurityDomain.Test\test\sd1.cer"; PrivateKey = "C:\Users\yeliu\code\azure-powershell\src\KeyVault\SecurityDomain.Test\test\sd1.key"},
Copy link
Member Author

@isra-fel isra-fel Oct 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use relative path to simplify example

Copy link
Member Author

@isra-fel isra-fel Oct 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Describe Keys members

@BethanyZhou BethanyZhou merged commit 928d94f into Azure:bez/managedHsm Oct 19, 2020
@isra-fel isra-fel mentioned this pull request Oct 20, 2020
Merged
10 tasks
erich-wang pushed a commit that referenced this pull request Oct 20, 2020
@BethanyZhou @isra-fel
[KeyVault] Managed HSM (#13259)
12b7118 
* Enable MHSM Management via *-AzKeyVault (#12575)

* Support creating a MHSM pool.

* Supporting querying MHSM objects

* Support deleting MHSM

* Support updating mhsm

* Add test cases

* Hide unavailable services

* Add test cases

* expose EnablePurgeProtection for MHSM

* correct indent of ps1xml

* upload localfeed

* Hide enablePurgeProtection

* Update ChangeLog.md and help.md

* Modify codes according to comments

* Update help.md

* Update VaultCreationParameters.cs

* Update get-azkeyvault.md

* Update KeyVaultManagementTests.ps1

* Record scenario test for Managed Hsm (#12631)

* Record scenario tests for managed hsm

* add default parameter set for

* Re-record scenario tests.

* [KeyVault] Update to official SDK (#12767)

* local 3.1.0 sdk

* Use production key vault mgmt sdk

* remove security domain from format xml

* combine track 1&2 sdk (#13018)

* combine track 1&2 sdk

* update azure.core to 1.5.0

* add exception; revert addkeyvaultkey

* add dll to psd1

* fix exception

* Detach managed hsm from key vault command (#13187)

* get managed hsm

* new managed hsm

* remove managed hsm

* update help.md

* update managed hsm

* add online version for new help.md

* Convert mhsm test to liveonly

* add test record

* Support data plane of managed HSM (#13216)

* create managed hsm key

* get managed hsm key

* remove managed hsm key

* update managed hsm key

* undo managed hsm key removal

* back up and restore managed hsm key

* add help.md

* import/download managed hsm RSA key

* Update help.md

* Update changelog.md

* suppress signature issues

* Update all help markdowns

* add logger for track2sdk

* add metadata for oct-HSM

Co-authored-by: Yeming Liu <Yeming.Liu@microsoft.com>

* Limit KeyType to be required only when create managed HSM key (#13242)

* limit KeyType to be required only when create managed HSM key

* add pester test

* Security domain (#13226)

* wip

* wip

* wip

* wip

* wip

* wip

* support securestring

* wip

* wip

* wip

* generate docs

* docs & error handling

* move crypto alg inside security domain

* resource strings

* remove extra code

* write help markdown

* resolve relative path to absolute path

* suppress signature issues

Co-authored-by: Yeming Liu <yeliu@microsoft.com>
Co-authored-by: Beisi Zhou <zhoubeisi@gmail.com>
Co-authored-by: Beisi Zhou <zazbs@qq.com>

* remove pfx file

* full backup restore + rbac (#13261)

Co-authored-by: Yeming Liu <yeliu@microsoft.com>

* small fixes

changelog; azure.core; sdk version; online version; breaking change csv;
shared assembly conflict; failed tests;

* license of BouncyCastle.NetCore

* remove local feed

Co-authored-by: Yeming Liu <Yeming.Liu@microsoft.com>
Co-authored-by: Yeming Liu <yeliu@microsoft.com>
isra-fel added a commit that referenced this pull request Oct 21, 2020
@BethanyZhou @isra-fel
[KeyVault] Managed HSM (#13259)
746145d 
* Enable MHSM Management via *-AzKeyVault (#12575)

* Support creating a MHSM pool.

* Supporting querying MHSM objects

* Support deleting MHSM

* Support updating mhsm

* Add test cases

* Hide unavailable services

* Add test cases

* expose EnablePurgeProtection for MHSM

* correct indent of ps1xml

* upload localfeed

* Hide enablePurgeProtection

* Update ChangeLog.md and help.md

* Modify codes according to comments

* Update help.md

* Update VaultCreationParameters.cs

* Update get-azkeyvault.md

* Update KeyVaultManagementTests.ps1

* Record scenario test for Managed Hsm (#12631)

* Record scenario tests for managed hsm

* add default parameter set for

* Re-record scenario tests.

* [KeyVault] Update to official SDK (#12767)

* local 3.1.0 sdk

* Use production key vault mgmt sdk

* remove security domain from format xml

* combine track 1&2 sdk (#13018)

* combine track 1&2 sdk

* update azure.core to 1.5.0

* add exception; revert addkeyvaultkey

* add dll to psd1

* fix exception

* Detach managed hsm from key vault command (#13187)

* get managed hsm

* new managed hsm

* remove managed hsm

* update help.md

* update managed hsm

* add online version for new help.md

* Convert mhsm test to liveonly

* add test record

* Support data plane of managed HSM (#13216)

* create managed hsm key

* get managed hsm key

* remove managed hsm key

* update managed hsm key

* undo managed hsm key removal

* back up and restore managed hsm key

* add help.md

* import/download managed hsm RSA key

* Update help.md

* Update changelog.md

* suppress signature issues

* Update all help markdowns

* add logger for track2sdk

* add metadata for oct-HSM

Co-authored-by: Yeming Liu <Yeming.Liu@microsoft.com>

* Limit KeyType to be required only when create managed HSM key (#13242)

* limit KeyType to be required only when create managed HSM key

* add pester test

* Security domain (#13226)

* wip

* wip

* wip

* wip

* wip

* wip

* support securestring

* wip

* wip

* wip

* generate docs

* docs & error handling

* move crypto alg inside security domain

* resource strings

* remove extra code

* write help markdown

* resolve relative path to absolute path

* suppress signature issues

Co-authored-by: Yeming Liu <yeliu@microsoft.com>
Co-authored-by: Beisi Zhou <zhoubeisi@gmail.com>
Co-authored-by: Beisi Zhou <zazbs@qq.com>

* remove pfx file

* full backup restore + rbac (#13261)

Co-authored-by: Yeming Liu <yeliu@microsoft.com>

* small fixes

changelog; azure.core; sdk version; online version; breaking change csv;
shared assembly conflict; failed tests;

* license of BouncyCastle.NetCore

* remove local feed

Co-authored-by: Yeming Liu <Yeming.Liu@microsoft.com>
Co-authored-by: Yeming Liu <yeliu@microsoft.com>
dingmeng-xue added a commit that referenced this pull request Oct 22, 2020
@isra-fel @BethanyZhou @dingmeng-xue
Managed HSM (#13287)
bc3b625 
Force merge after CI passed

* [KeyVault] Managed HSM (#13259)

* Enable MHSM Management via *-AzKeyVault (#12575)

* Support creating a MHSM pool.

* Supporting querying MHSM objects

* Support deleting MHSM

* Support updating mhsm

* Add test cases

* Hide unavailable services

* Add test cases

* expose EnablePurgeProtection for MHSM

* correct indent of ps1xml

* upload localfeed

* Hide enablePurgeProtection

* Update ChangeLog.md and help.md

* Modify codes according to comments

* Update help.md

* Update VaultCreationParameters.cs

* Update get-azkeyvault.md

* Update KeyVaultManagementTests.ps1

* Record scenario test for Managed Hsm (#12631)

* Record scenario tests for managed hsm

* add default parameter set for

* Re-record scenario tests.

* [KeyVault] Update to official SDK (#12767)

* local 3.1.0 sdk

* Use production key vault mgmt sdk

* remove security domain from format xml

* combine track 1&2 sdk (#13018)

* combine track 1&2 sdk

* update azure.core to 1.5.0

* add exception; revert addkeyvaultkey

* add dll to psd1

* fix exception

* Detach managed hsm from key vault command (#13187)

* get managed hsm

* new managed hsm

* remove managed hsm

* update help.md

* update managed hsm

* add online version for new help.md

* Convert mhsm test to liveonly

* add test record

* Support data plane of managed HSM (#13216)

* create managed hsm key

* get managed hsm key

* remove managed hsm key

* update managed hsm key

* undo managed hsm key removal

* back up and restore managed hsm key

* add help.md

* import/download managed hsm RSA key

* Update help.md

* Update changelog.md

* suppress signature issues

* Update all help markdowns

* add logger for track2sdk

* add metadata for oct-HSM

Co-authored-by: Yeming Liu <Yeming.Liu@microsoft.com>

* Limit KeyType to be required only when create managed HSM key (#13242)

* limit KeyType to be required only when create managed HSM key

* add pester test

* Security domain (#13226)

* wip

* wip

* wip

* wip

* wip

* wip

* support securestring

* wip

* wip

* wip

* generate docs

* docs & error handling

* move crypto alg inside security domain

* resource strings

* remove extra code

* write help markdown

* resolve relative path to absolute path

* suppress signature issues

Co-authored-by: Yeming Liu <yeliu@microsoft.com>
Co-authored-by: Beisi Zhou <zhoubeisi@gmail.com>
Co-authored-by: Beisi Zhou <zazbs@qq.com>

* remove pfx file

* full backup restore + rbac (#13261)

Co-authored-by: Yeming Liu <yeliu@microsoft.com>

* small fixes

changelog; azure.core; sdk version; online version; breaking change csv;
shared assembly conflict; failed tests;

* license of BouncyCastle.NetCore

* remove local feed

Co-authored-by: Yeming Liu <Yeming.Liu@microsoft.com>
Co-authored-by: Yeming Liu <yeliu@microsoft.com>

* use portable.bouncycastle

* bug fix...

...replace bouncycastle lib;
fix security domain issue on windows powershell

* Add pester test for RBAC and full-backup managed HSM

* fix dll list

* support relative path when restoring SD

* update license (bouncycastle.netcore -> portable)

* remove dependency Microsoft.IdentityModel.Tokens

Co-authored-by: Beisi Zhou <zhoubeisi@gmail.com>
Co-authored-by: Yeming Liu <yeliu@microsoft.com>
Co-authored-by: Beisi Zhou <zazbs@qq.com>
Co-authored-by: Dingmeng Xue <dixue@microsoft.com>
@isra-fel isra-fel deleted the security-domain branch November 27, 2020 07:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@BethanyZhou BethanyZhou

Labels

needs-review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@isra-fel @azuresdkci @BethanyZhou