SMBUtil.writeInt4(this.originalMessageSize, aad, index);
        index += 4;

        // Reserved
        SMBUtil.writeInt2(0, aad, index);
        index += 2;

        // Flags
        SMBUtil.writeInt2(this.flags, aad, index);
        index += 2;

        // Session ID (8 bytes)
        SMBUtil.writeInt8(this.sessionId, aad, index);

        return aad;
    }

func (c *kesConn) GenerateKey(ctx context.Context, req *GenerateKeyRequest) (DEK, error) {
	aad, err := req.AssociatedData.MarshalText()
	if err != nil {
		return DEK{}, err
	}

	name := req.Name
	if name == "" {
		name = c.defaultKeyID
	}

	dek, err := c.client.GenerateKey(ctx, name, aad)
	if err != nil {
		if errors.Is(err, kes.ErrKeyNotFound) {
			return DEK{}, ErrKeyNotFound
		}

    }

    // Test backward compatibility: aad -> entraid mapping
    @Test
    public void test_getAuthenticator_aadMapsToEntraid() {
        // Register an authenticator with the new "entraid" name
        ComponentUtil.register(testAuthenticator, "entraidAuthenticator");

        // Use legacy "aad" SSO type
        currentSsoType = "aad";
        ssoManager = new SsoManager() {
            @Override

	aad, err := req.AssociatedData.MarshalText()
	if err != nil {
		return DEK{}, err
	}

	name := req.Name
	if name == "" {
		name = c.defaultKey
	}

	resp, err := c.client.GenerateKey(ctx, c.enclave, &kms.GenerateKeyRequest{
		Name:           name,
		AssociatedData: aad,
		Length:         32,
	})
	if err != nil {

        final AEADBlockCipher cipher = createCCMCipher(true, nonce, associatedData.length, message.length);

        // Process AAD (not included in output)
        cipher.processAADBytes(associatedData, 0, associatedData.length);

        // Process message (will be encrypted)
        final byte[] output = new byte[cipher.getOutputSize(message.length)];

now supports using Azure network resources (Virtual Network, Load Balancer, Public IP, Route Table, Network Security Group, etc.) in different AAD Tenant and Subscription than those for the Kubernetes cluster. To use the feature, please reference https://kubernetes-sigs.github.io/cloud-provider-azure/install/configs/#host-network-resources-in-different-aad-tenant-and-subscription. ([#88384](https://github.com/kubernetes/kubernetes/pull/88384), [@bowen5](https://github.com/bowen5)) [SIG Cloud Provider]...

            public String getSystemProperty(final String key) {
                return systemPropMap.get(key);
            }
        };

        // Test fallback to legacy aad.permission.fields key
        systemPropMap.put("aad.permission.fields", "mail,displayName");
        String[] fields = fessConfig.getEntraIdPermissionFields();
        assertEquals(2, fields.length);
        assertEquals("mail", fields[0]);

import org.codelibs.fess.sso.entraid.EntraIdAuthenticator;
import org.codelibs.fess.util.ComponentUtil;
import org.lastaflute.web.login.credential.LoginCredential;

import com.microsoft.aad.msal4j.IAccount;
import com.microsoft.aad.msal4j.IAuthenticationResult;

/**
 * Microsoft Entra ID credential implementation for Fess authentication.
 * Provides login credential functionality using Entra ID authentication results.
 */

     * Uses new entraid.permission.fields key with fallback to legacy aad.permission.fields.
     * @return Array of permission field names.
     */
    default String[] getEntraIdPermissionFields() {
        String value = getSystemProperty("entraid.permission.fields", null);
        if (StringUtil.isBlank(value)) {
            value = getSystemProperty("aad.permission.fields", "mail");
        }

* Fix AAD support for Azure sovereign cloud in kubectl ([#72143](https://github.com/kubernetes/kubernetes/pull/72143), [@karataliu](https://github.com/karataliu))