diff --git a/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Constants.cs b/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Constants.cs
index 6e26ac8539..0881dd028f 100644
--- a/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Constants.cs
+++ b/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Constants.cs
@@ -9,15 +9,24 @@ internal static class Constants
///
/// Azure Key Vault Domain Name
///
- internal static readonly string[] AzureKeyVaultPublicDomainNames = new string[] {
- @"vault.azure.net", // default
- @"vault.azure.cn", // Azure China
- @"vault.usgovcloudapi.net", // US Government
- @"vault.microsoftazure.de", // Azure Germany
- @"managedhsm.azure.net", // public HSM vault
- @"managedhsm.azure.cn", // Azure China HSM vault
- @"managedhsm.usgovcloudapi.net", // US Government HSM vault
- @"managedhsm.microsoftazure.de" // Azure Germany HSM vault
+ internal static readonly string[] AzureKeyVaultPublicDomainNames =
+ new string[]
+ {
+ // Azure Key Vaults
+ "vault.azure.net", // Default
+ "vault.azure.cn", // China
+ "vault.usgovcloudapi.net", // US Government
+ "vault.microsoftazure.de", // Azure Germany
+ "vault.sovcloud-api.fr", // France (Bleu)
+ "vault.sovcloud-api.de", // Germany (Delos)
+
+ // Managed High Security Modules (HSM) Vaults
+ "managedhsm.azure.net",
+ "managedhsm.azure.cn",
+ "managedhsm.usgovcloudapi.net",
+ "managedhsm.microsoftazure.de",
+ "managedhsm.sovcloud-api.fr",
+ "managedhsm.sovcloud-api.de"
};
///
diff --git a/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Utils.cs b/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Utils.cs
index f71080ffab..ea7ffb4671 100644
--- a/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Utils.cs
+++ b/src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Utils.cs
@@ -138,7 +138,7 @@ internal static ArgumentException InvalidAKVPath(string masterKeyPath, bool isSy
internal static ArgumentException InvalidAKVUrl(string masterKeyPath) =>
new(string.Format(CultureInfo.InvariantCulture, Strings.InvalidAkvUrlTemplate, masterKeyPath), Constants.AeParamMasterKeyPath);
- internal static Exception InvalidAKVUrlTrustedEndpoints(string masterKeyPath, string endpoints) =>
+ internal static ArgumentException InvalidAKVUrlTrustedEndpoints(string masterKeyPath, string endpoints) =>
new ArgumentException(string.Format(CultureInfo.InvariantCulture, Strings.InvalidAkvKeyPathTrustedTemplate, masterKeyPath, endpoints),
Constants.AeParamMasterKeyPath);
}
diff --git a/src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/ExceptionTestAKVStore.cs b/src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/ExceptionTestAKVStore.cs
index 6cb20a4351..9f0b194fb7 100644
--- a/src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/ExceptionTestAKVStore.cs
+++ b/src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/ExceptionTestAKVStore.cs
@@ -182,7 +182,6 @@ public void InvalidCertificatePath()
string dummyPathWithOnlyHost = @"https://www.microsoft.com";
string invalidUrlErrorMessage = $@"Invalid url specified: '{dummyPathWithOnlyHost}'";
string dummyPathWithInvalidKey = @"https://www.microsoft.vault.azure.com/keys/dummykey/dummykeyid";
- string invalidTrustedEndpointErrorMessage = $@"Invalid Azure Key Vault key path specified: '{dummyPathWithInvalidKey}'. Valid trusted endpoints: vault.azure.net, vault.azure.cn, vault.usgovcloudapi.net, vault.microsoftazure.de, managedhsm.azure.net, managedhsm.azure.cn, managedhsm.usgovcloudapi.net, managedhsm.microsoftazure.de.\s+\(?Parameter (name: )?'?masterKeyPath('\))?";
Exception ex = Assert.Throws(
() => fixture.AkvStoreProvider.EncryptColumnEncryptionKey(dummyPathWithOnlyHost, MasterKeyEncAlgo, cek));
@@ -190,7 +189,7 @@ public void InvalidCertificatePath()
ex = Assert.Throws(
() => fixture.AkvStoreProvider.EncryptColumnEncryptionKey(dummyPathWithInvalidKey, MasterKeyEncAlgo, cek));
- Assert.Matches(invalidTrustedEndpointErrorMessage, ex.Message);
+ Assert.Matches(TrustedUrlsTest.MakeInvalidVaultErrorMessage(dummyPathWithInvalidKey), ex.Message);
ex = Assert.Throws(
() => fixture.AkvStoreProvider.DecryptColumnEncryptionKey(dummyPathWithOnlyHost, MasterKeyEncAlgo, encryptedCek));
@@ -198,7 +197,7 @@ public void InvalidCertificatePath()
ex = Assert.Throws(
() => fixture.AkvStoreProvider.DecryptColumnEncryptionKey(dummyPathWithInvalidKey, MasterKeyEncAlgo, encryptedCek));
- Assert.Matches(invalidTrustedEndpointErrorMessage, ex.Message);
+ Assert.Matches(TrustedUrlsTest.MakeInvalidVaultErrorMessage(dummyPathWithInvalidKey), ex.Message);
}
[InlineData(true)]
diff --git a/src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/TrustedUrlsTest.cs b/src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/TrustedUrlsTest.cs
new file mode 100644
index 0000000000..c815fbf346
--- /dev/null
+++ b/src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/TrustedUrlsTest.cs
@@ -0,0 +1,102 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System;
+using System.Reflection;
+using Azure.Core;
+using Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider;
+using Xunit;
+
+namespace Microsoft.Data.SqlClient.ManualTesting.Tests.AlwaysEncrypted
+{
+ public class TrustedUrlsTest
+ {
+ private readonly SqlColumnEncryptionAzureKeyVaultProvider _provider;
+ private readonly MethodInfo _method;
+
+ public TrustedUrlsTest()
+ {
+ _provider = new(new SqlClientCustomTokenCredential());
+
+ var assembly = typeof(SqlColumnEncryptionAzureKeyVaultProvider).Assembly;
+ var clazz = assembly.GetType("Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.SqlColumnEncryptionAzureKeyVaultProvider");
+ _method = clazz.GetMethod(
+ "ValidateNonEmptyAKVPath",
+ System.Reflection.BindingFlags.NonPublic |
+ System.Reflection.BindingFlags.Instance);
+ }
+
+ private static string MakeUrl(string vault)
+ {
+ return $"https://{vault}/keys/dummykey/dummykeyid";
+ }
+
+ public static string MakeInvalidVaultErrorMessage(string url)
+ {
+ return
+ $"Invalid Azure Key Vault key path specified: '{url}'. " +
+ "Valid trusted endpoints: " +
+ "vault.azure.net, " +
+ "vault.azure.cn, " +
+ "vault.usgovcloudapi.net, " +
+ "vault.microsoftazure.de, " +
+ "vault.sovcloud-api.fr, " +
+ "vault.sovcloud-api.de, " +
+ "managedhsm.azure.net, " +
+ "managedhsm.azure.cn, " +
+ "managedhsm.usgovcloudapi.net, " +
+ "managedhsm.microsoftazure.de, " +
+ "managedhsm.sovcloud-api.fr, " +
+ "managedhsm.sovcloud-api.de." +
+ @"\s+\(?Parameter (name: )?'?masterKeyPath('\))?";
+ }
+
+ [Theory]
+ [InlineData("www.microsoft.com")]
+ [InlineData("www.microsoft.vault.azure.com")]
+ [InlineData("vault.azure.net.io")]
+ public void InvalidVaults(string vault)
+ {
+ // Test that invalid key paths throw and contain the expected error
+ // message.
+ var url = MakeUrl(vault);
+
+ try
+ {
+ _method.Invoke(_provider, new object[] { url, false });
+ }
+ catch (TargetInvocationException ex)
+ {
+ // Unwrap the exception to get the actual ArgumentException thrown
+ var argEx = ex.InnerException as ArgumentException;
+ Assert.NotNull(argEx);
+ Assert.Matches(MakeInvalidVaultErrorMessage(url), argEx.Message);
+ }
+ }
+
+ [Theory]
+ // Normal vaults.
+ [InlineData("vault.azure.net")]
+ [InlineData("vault.azure.cn")]
+ [InlineData("vault.usgovcloudapi.net")]
+ [InlineData("vault.microsoftazure.de")]
+ [InlineData("vault.sovcloud-api.fr")]
+ [InlineData("vault.sovcloud-api.de")]
+ // HSM vaults.
+ [InlineData("managedhsm.azure.net")]
+ [InlineData("managedhsm.azure.cn")]
+ [InlineData("managedhsm.usgovcloudapi.net")]
+ [InlineData("managedhsm.microsoftazure.de")]
+ [InlineData("managedhsm.sovcloud-api.fr")]
+ [InlineData("managedhsm.sovcloud-api.de")]
+ // Vaults with prefixes.
+ [InlineData("foo.bar.vault.microsoftazure.de")]
+ [InlineData("baz.bar.foo.managedhsm.sovcloud-api.fr")]
+ public void ValidVaults(string vault)
+ {
+ // Test that valid vault key paths do not throw exceptions
+ _method.Invoke(_provider, new object[] { MakeUrl(vault), false });
+ }
+ }
+}
diff --git a/src/Microsoft.Data.SqlClient/tests/ManualTests/Microsoft.Data.SqlClient.ManualTesting.Tests.csproj b/src/Microsoft.Data.SqlClient/tests/ManualTests/Microsoft.Data.SqlClient.ManualTesting.Tests.csproj
index a5b217f1cd..99b350a411 100644
--- a/src/Microsoft.Data.SqlClient/tests/ManualTests/Microsoft.Data.SqlClient.ManualTesting.Tests.csproj
+++ b/src/Microsoft.Data.SqlClient/tests/ManualTests/Microsoft.Data.SqlClient.ManualTesting.Tests.csproj
@@ -37,21 +37,22 @@
-
-
-
-
-
+
+
+
+
+
+