SMBUtil.writeInt4(this.originalMessageSize, aad, index);
        index += 4;

        // Reserved
        SMBUtil.writeInt2(0, aad, index);
        index += 2;

        // Flags
        SMBUtil.writeInt2(this.flags, aad, index);
        index += 2;

        // Session ID (8 bytes)
        SMBUtil.writeInt8(this.sessionId, aad, index);

        return aad;
    }

func (c *kesConn) GenerateKey(ctx context.Context, req *GenerateKeyRequest) (DEK, error) {
	aad, err := req.AssociatedData.MarshalText()
	if err != nil {
		return DEK{}, err
	}

	name := req.Name
	if name == "" {
		name = c.defaultKeyID
	}

	dek, err := c.client.GenerateKey(ctx, name, aad)
	if err != nil {
		if errors.Is(err, kes.ErrKeyNotFound) {
			return DEK{}, ErrKeyNotFound
		}

    }

    // Test backward compatibility: aad -> entraid mapping
    @Test
    public void test_getAuthenticator_aadMapsToEntraid() {
        // Register an authenticator with the new "entraid" name
        ComponentUtil.register(testAuthenticator, "entraidAuthenticator");

        // Use legacy "aad" SSO type
        currentSsoType = "aad";
        ssoManager = new SsoManager() {
            @Override

        // When
        byte[] aad = transformHeader.getAssociatedData();

        // Then
        assertEquals(52, aad.length); // AAD should be same size as transform header

        // Verify protocol ID (first 4 bytes) - 0xFD534D42 in little-endian
        assertEquals((byte) 0x42, aad[0]);
        assertEquals((byte) 0x4D, aad[1]);
        assertEquals((byte) 0x53, aad[2]);
        assertEquals((byte) 0xFD, aad[3]);

	aad, err := req.AssociatedData.MarshalText()
	if err != nil {
		return DEK{}, err
	}

	name := req.Name
	if name == "" {
		name = c.defaultKey
	}

	resp, err := c.client.GenerateKey(ctx, c.enclave, &kms.GenerateKeyRequest{
		Name:           name,
		AssociatedData: aad,
		Length:         32,
	})
	if err != nil {

     */
    protected SsoAuthenticator getAuthenticator() {
        String ssoType = getSsoType();
        // Backward compatibility: map legacy "aad" (Azure AD) to "entraid" (Entra ID)
        if ("aad".equals(ssoType)) {
            ssoType = "entraid";
        }
        final String name = ssoType + "Authenticator";
        if (ComponentUtil.hasComponent(name)) {

        final AEADBlockCipher cipher = createCCMCipher(true, nonce, associatedData.length, message.length);

        // Process AAD (not included in output)
        cipher.processAADBytes(associatedData, 0, associatedData.length);

        // Process message (will be encrypted)
        final byte[] output = new byte[cipher.getOutputSize(message.length)];

import com.google.common.cache.Cache;
import com.google.common.cache.CacheBuilder;
import com.microsoft.aad.msal4j.AuthorizationCodeParameters;
import com.microsoft.aad.msal4j.ConfidentialClientApplication;
import com.microsoft.aad.msal4j.IAuthenticationResult;
import com.microsoft.aad.msal4j.RefreshTokenParameters;
import com.microsoft.aad.msal4j.SilentParameters;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.JWTParser;

now supports using Azure network resources (Virtual Network, Load Balancer, Public IP, Route Table, Network Security Group, etc.) in different AAD Tenant and Subscription than those for the Kubernetes cluster. To use the feature, please reference https://kubernetes-sigs.github.io/cloud-provider-azure/install/configs/#host-network-resources-in-different-aad-tenant-and-subscription. ([#88384](https://github.com/kubernetes/kubernetes/pull/88384), [@bowen5](https://github.com/bowen5)) [SIG Cloud Provider]...

            public String getSystemProperty(final String key) {
                return systemPropMap.get(key);
            }
        };

        // Test fallback to legacy aad.permission.fields key
        systemPropMap.put("aad.permission.fields", "mail,displayName");
        String[] fields = fessConfig.getEntraIdPermissionFields();
        assertEquals(2, fields.length);
        assertEquals("mail", fields[0]);