WIP - Add HSM support to Key Vault

meta/runtime.yml

@@ -132,6 +132,7 @@ action_groups:
     - azure.azcollection.azure_rm_ipgroup_info
     - azure.azcollection.azure_rm_keyvault
     - azure.azcollection.azure_rm_keyvault_info
+    - azure.azcollection.azure_rm_keyvaultsecuritydomain
     - azure.azcollection.azure_rm_keyvaultkey
     - azure.azcollection.azure_rm_keyvaultkey_info
     - azure.azcollection.azure_rm_keyvaultsecret

plugins/module_utils/azure_rm_crypto_utils.py

@@ -0,0 +1,53 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+# --------------------------------------------------------------------------------------------
+
+
+import array
+import base64
+import hashlib
+import secrets
+
+from cryptography.hazmat.primitives.serialization import Encoding
+
+
+class Utils:
+    @staticmethod
+    def is_little_endian():
+        a = array.array('H', [1]).tobytes()
+        # little endian: b'\x01\x00'
+        # big endian: b'\x00\x01'
+        return a[0] == 1
+
+    @staticmethod
+    def convert_to_uint16(b: bytearray):
+        ret = [0 for _ in range(len(b) // 2)]
+        for i in range(0, len(b), 2):
+            byte_order = 'little' if Utils.is_little_endian() else 'big'
+            ret[i // 2] = int.from_bytes(bytearray([b[i], b[i + 1]]), byteorder=byte_order, signed=False)
+        return ret
+
+    @staticmethod
+    def get_random(cb):
+        ret = bytearray()
+        for _ in range(cb):
+            ret.append(secrets.randbits(8))
+        return ret
+
+    @staticmethod
+    def get_SHA256_thumbprint(cert):
+        public_bytes = cert.public_bytes(Encoding.DER)
+        return hashlib.sha256(public_bytes).digest()
+
+    @staticmethod
+    def security_domain_b64_url_encode_for_x5c(s):
+        return base64.b64encode(s).decode('ascii')
+
+    @staticmethod
+    def security_domain_b64_url_encode(s):
+        return base64.b64encode(s).decode('ascii').strip('=').replace('+', '-').replace('/', '_')
+
+
+if __name__ == '__main__':
+    print(Utils.convert_to_uint16(bytearray([40, 30, 20, 10])))

plugins/module_utils/vendored_sdks/__init__.py

@@ -0,0 +1,6 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+# --------------------------------------------------------------------------------------------
+# pylint: skip-file
+# flake8: noqa

plugins/module_utils/vendored_sdks/azure_keyvault_t1/__init__.py

@@ -0,0 +1,47 @@
+# coding=utf-8
+# --------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for
+# license information.
+#
+# Code generated by Microsoft (R) AutoRest Code Generator.
+# Changes may cause incorrect behavior and will be lost if the code is
+# regenerated.
+# --------------------------------------------------------------------------
+# pylint: skip-file
+# flake8: noqa
+from . import http_bearer_challenge_cache as HttpBearerChallengeCache
+from .http_challenge import HttpChallenge
+from .http_bearer_challenge import HttpBearerChallenge
+from .key_vault_authentication import KeyVaultAuthentication, KeyVaultAuthBase, AccessToken
+from .http_message_security import generate_pop_key
+from .key_vault_id import (KeyVaultId,
+                           KeyId,
+                           SecretId,
+                           CertificateId,
+                           CertificateIssuerId,
+                           CertificateOperationId,
+                           StorageAccountId,
+                           StorageSasDefinitionId)
+from .key_vault_client import KeyVaultClient
+from .version import VERSION
+
+__all__ = ['KeyVaultClient',
+           'KeyVaultId',
+           'KeyId',
+           'SecretId',
+           'CertificateId',
+           'CertificateIssuerId',
+           'CertificateOperationId',
+           'StorageAccountId',
+           'StorageSasDefinitionId',
+           'HttpBearerChallengeCache',
+           'HttpBearerChallenge',
+           'HttpChallenge',
+           'KeyVaultAuthentication',
+           'KeyVaultAuthBase',
+           'generate_pop_key',
+           'AccessToken']
+
+__version__ = VERSION
+