Skip to content

Adds AKV Token Binding Managed Identity E2E tests#5829

Merged
gladjohn merged 4 commits intomainfrom
gladjohn/msi_v2_e2e_akv
Mar 20, 2026
Merged

Adds AKV Token Binding Managed Identity E2E tests#5829
gladjohn merged 4 commits intomainfrom
gladjohn/msi_v2_e2e_akv

Conversation

@gladjohn
Copy link
Contributor

This pull request extends the managed identity tests to include support for Azure Key Vault (AKV) mTLS Proof-of-Possession (PoP) token acquisition and resource calls with attestation. It also refactors existing tests to use more descriptive resource constants and adds a helper method for AKV secret retrieval.

AKV mTLS PoP Testing Enhancements:

  • Added a new test method AcquireTokenAndCallAKV_OnImdsV2_MtlsPoP_WithAttestation_Succeeds to validate mTLS PoP token acquisition and AKV secret retrieval with attestation, including certificate validation and proper error handling.

  • Introduced the CallAkvSecretAsync helper method to perform authenticated mTLS calls to the AKV secret endpoint, asserting successful response and secret value presence.

Resource Constant Refactoring:

  • Replaced the generic ArmScope constant with more descriptive GraphResource, AkvResource, and AkvSecretUrl constants for improved clarity and maintainability in test setup.

  • Updated existing tests to use the new GraphResource constant instead of ArmScope for managed identity token acquisition. [1] [2]

Imports Organization:

  • Reordered and grouped using statements for better readability and to support new AKV test functionality.

@gladjohn gladjohn requested a review from a team as a code owner March 10, 2026 02:44
Copilot AI review requested due to automatic review settings March 10, 2026 02:44
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR expands the IMDSv2 Managed Identity E2E test suite to validate Azure Key Vault (AKV) mTLS Proof-of-Possession (PoP) token acquisition and an authenticated AKV secret retrieval call using Credential Guard attestation. It also refactors resource constants for clarity.

Changes:

  • Added an AKV E2E test that acquires an attested mTLS PoP token and calls an AKV secret endpoint using the binding certificate.
  • Introduced an CallAkvSecretAsync helper to perform the token-bound mTLS HTTP call and validate the JSON response.
  • Renamed/refactored resource constants (ArmScopeGraphResource, plus new AkvResource/AkvSecretUrl) and reorganized using directives.

@gladjohn gladjohn requested review from RyAuld and trwalke March 16, 2026 21:07
@gladjohn gladjohn enabled auto-merge (squash) March 16, 2026 21:07
Copilot AI review requested due to automatic review settings March 20, 2026 15:01
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

@gladjohn gladjohn merged commit f36613e into main Mar 20, 2026
16 checks passed
@gladjohn gladjohn deleted the gladjohn/msi_v2_e2e_akv branch March 20, 2026 19:52
@RyAuld
Copy link
Contributor

RyAuld commented Mar 20, 2026

Confirmed KV resource is setup correctly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants