Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Java client encryption with AAP #19218

Merged

Conversation

simplynaveen20
Copy link
Member

@simplynaveen20 simplynaveen20 commented Feb 12, 2021

This PR is adding support for encryption/decryption on cosmos items with AAP library.
Public surface area discussion is pending , creating the PR to get things rolling.

There are three section which help in review this PR as it contains many file.

  1. Older encryption support is deleted (All the deleted files are from the previous encryption project, can be ignore during review).
  2. ClientEncrytionPolicy support on container level and ClientEncrytionKey support on database level can be reviewed separately in the cosmos project.
  3. Rest all the new files are in azure-cosmos-encryption project.

TODO:

  1. Public surface apis are not final and will be discussed internally with in the team, also we need to decide whether to merge encryption project with cosmos or leave it as a separate project. - Update[2/24] Finalized
  2. I will add more test coverage (e2e and mock both)to cover all the use cases. - Update[3/10] Added
  3. Perf testing is not in scope of this PR, benchmarking of encryption should go as separate work item.

Update[2/24] We will not have early load on a container in this PR , instead first item call will load the clientEncryptionKey and ClientEncryptionPolicy caches. We incorporate in future PR, if we feel the need

Sample for creating client -

 CosmosAsyncClient asyncClient =    new 
 CosmosClientBuilder().endpoint(endpoint).key(authKey).contentResponseOnWriteEnabled(true).buildAsyncClient();
 TokenCredential tokenCredentials = Program.getTokenCredential(configuration);
 AzureKeyVaultKeyStoreProvider encryptionKeyStoreProvider = new AzureKeyVaultKeyStoreProvider(tokenCredentials);
 CosmosEncryptionAsyncClient cosmosEncryptionAsyncClient = 
 CosmosEncryptionAsyncClient.buildEncryptionCosmosAsyncClient(asyncClient, encryptionKeyStoreProvider);

Sample for creating encryption database and container

CosmosEncryptionAsyncDatabase  cosmosEncryptionAsyncDatabase = cosmosEncryptionAsyncClient.getEncryptedCosmosAsyncDatabase(Program.databaseId);
CosmosEncryptionAsyncContainer cosmosEncryptionAsyncContainer = cosmosEncryptionAsyncDatabase.getCosmosEncryptionAsyncContainer(containerProperties.getId());

@abhijitpai
Copy link

static IllegalArgumentException invalidKeySize(String algorithmName, int actualKeylength, int expectedLength) {

I assume the next 3 are also no longer used.


Refers to: sdk/cosmos/azure-cosmos-encryption/src/main/java/com/azure/cosmos/encryption/implementation/EncryptionExceptionFactory.java:16 in b730734. [](commit_id = b730734, deletion_comment = False)

@abhijitpai
Copy link

public class CosmosEncryptionAlgorithm {

We got rid of this on .net so people can just use the constant from the AAP library.


Refers to: sdk/cosmos/azure-cosmos-encryption/src/main/java/com/azure/cosmos/encryption/models/CosmosEncryptionAlgorithm.java:10 in b730734. [](commit_id = b730734, deletion_comment = False)

@@ -32,10 +32,18 @@ Licensed under the MIT License.
<tag>HEAD</tag>
</scm>

<repositories>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can I get a little more context on why we are using this blob feed? If we have something that we need to consume for our builds we should try and use our Azure Devops java feed. https://dev.azure.com/azure-sdk/public/_packaging?_a=feed&feed=azure-sdk-for-java

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants