conjur-api 6.2.0.pre.802 → 6.2.0.pre.806

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fc34dbf11e2c9189c0b8583c7442b11ef2f5afb47c160570d2873bebf8e4caa5
-  data.tar.gz: 5dc92b0ce02f936ee1c44ec09dd8a44bb86cbe13da116f0679aaf63d86f8e660
+  metadata.gz: 4eb698cae0bb3c7abf0e8f8283ef11c7c2ef5790fdb144d3aa6ccb8a75cb2146
+  data.tar.gz: 4dcb5fca7170062cfa751d52f830fcaaa9244d218064d1e064988a69ab8912c4
 SHA512:
-  metadata.gz: bc1c204249a7c8345bf6142c3c3279f59346568cedca381a5cd52c7d472f3d667f174eae78b84690bd4063605aaa3b5adff6348d4b3ab840a1bbb36a5b296f44
-  data.tar.gz: 4a565eb2017e1fe8b824d899580b5a6509149a5ed1be172cbdbfea9fc33f13bdd9e81c244030a9454e05a57550e9b9a60791137dd4984aa61cfb3eade99ba038
+  metadata.gz: bbe620e6fcb2653eb04f7a8355a3155e1e98f32f9f5c52818c5b208aae9cb121ccc9e23e575755135a8a91729af08af3ab2a5444584ea10422dea3d3c8d9bedd
+  data.tar.gz: 445c664bf985458b7139c14af8552f603778fe9c31f400fe3e4513b5e7aaa92c5182a7128427f4303171ea4f66ac6d5df3c426fa3a29f3efa89688edabf886c9

data/VERSION

@@ -1 +1 @@
-6.2.0-802
+6.2.0-806

data/lib/conjur/api/authn_cert.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+require 'openssl'
+require 'json'
+
+module Conjur
+  class API
+    # Authenticator that uses mutual TLS (authn-cert) to obtain Conjur access tokens.
+    # The client certificate is presented during the TLS handshake; an empty POST
+    # to the authn-cert endpoint returns a Conjur access token.
+    #
+    # Two modes:
+    # - Request mode: +host_id+ is provided; Conjur validates the cert matches the host.
+    # - SPIFFE mode:  +host_id+ is nil; Conjur derives the host from the cert's SPIFFE SAN URI.
+    class CertAuthenticator
+      include TokenExpiration
+
+      attr_reader :account, :service_id, :cert, :key, :host_id
+
+      def initialize(account, service_id, cert, key, host_id = nil)
+        @account    = account
+        @service_id = service_id
+        @cert       = cert
+        @key        = key
+        @host_id    = host_id
+        update_token_born
+      end
+
+      def refresh_token
+        Conjur::API.authenticate_cert(service_id, cert, key, account: account, host_id: host_id).tap do
+          update_token_born
+        end
+      end
+    end
+
+    class << self
+      # Create a new {Conjur::API} instance authenticated via client certificate (authn-cert / mTLS).
+      #
+      # The +cert+ and +key+ arguments may each be:
+      # * An already-loaded OpenSSL object (+OpenSSL::X509::Certificate+ / +OpenSSL::PKey::PKey+)
+      # * A file path (String) — the file will be read and parsed
+      # * A PEM-encoded string — parsed directly
+      #
+      # @param [String] service_id the authn-cert service ID configured in Conjur
+      # @param [OpenSSL::X509::Certificate, String] cert client certificate
+      # @param [OpenSSL::PKey::PKey, String] key client private key
+      # @param [String] account The organization account.
+      # @param [String, nil] host_id Conjur host path for request mode (e.g. "host/workloads/vm-01").
+      #   Pass +nil+ or omit for SPIFFE mode.
+      # @param [String, nil] remote_ip optional IP address recorded in the audit log.
+      # @return [Conjur::API]
+      def new_from_cert(service_id, cert, key,
+                        account: Conjur.configuration.account,
+                        host_id: nil,
+                        remote_ip: nil)
+        cert = load_cert(cert)
+        key  = load_key(key)
+        self.new.init_from_cert(service_id, cert, key,
+                                account: account, host_id: host_id, remote_ip: remote_ip)
+      end
+
+      # Authenticate using authn-cert and return a parsed Conjur access token.
+      #
+      # +cert+ and +key+ must already be OpenSSL objects (use {.new_from_cert} for automatic loading).
+      #
+      # @param [String] service_id the authn-cert service ID
+      # @param [OpenSSL::X509::Certificate] cert client certificate
+      # @param [OpenSSL::PKey::PKey] key client private key
+      # @param [String] account The organization account.
+      # @param [String, nil] host_id Conjur host path for request mode; nil for SPIFFE mode.
+      # @return [Hash] parsed access token
+      def authenticate_cert(service_id, cert, key,
+                            account: Conjur.configuration.account,
+                            host_id: nil)
+        raise ArgumentError, "service_id is required" if service_id.nil? || service_id.empty?
+
+        if Conjur.log
+          Conjur.log << "Authenticating via authn-cert/#{service_id} to account #{account}\n"
+        end
+        cert_options = { ssl_client_cert: cert, ssl_client_key: key }
+        JSON.parse(url_for(:authn_cert_authenticate, account, service_id, host_id, cert_options).post(''))
+      end
+
+      private
+
+      def load_cert(cert)
+        return cert if cert.is_a?(OpenSSL::X509::Certificate)
+        pem = File.file?(cert.to_s) ? File.read(cert.to_s) : cert.to_s
+        OpenSSL::X509::Certificate.new(pem)
+      end
+
+      def load_key(key)
+        return key if key.is_a?(OpenSSL::PKey::PKey)
+        pem = File.file?(key.to_s) ? File.read(key.to_s) : key.to_s
+        OpenSSL::PKey.read(pem)
+      end
+    end
+
+    def init_from_cert(service_id, cert, key,
+                       account: Conjur.configuration.account,
+                       host_id: nil,
+                       remote_ip: nil)
+      @remote_ip     = remote_ip
+      @authenticator = CertAuthenticator.new(account, service_id, cert, key, host_id)
+      self
+    end
+  end
+end

data/lib/conjur/api/router.rb

@@ -42,6 +42,18 @@ module Conjur
         )[fully_escape account][fully_escape username]['authenticate']
       end
 
+      # Builds the RestClient::Resource for an authn-cert authentication request.
+      # cert_options must include :ssl_client_cert and :ssl_client_key so that
+      # the client certificate is presented during the TLS handshake.
+      def authn_cert_authenticate account, service_id, host_id, cert_options
+        options = Conjur.configuration.create_rest_client_options(cert_options)
+        resource = RestClient::Resource.new(
+          Conjur.configuration.core_url,
+          options
+        )['authn-cert'][fully_escape service_id][fully_escape account]
+        host_id ? resource[fully_escape host_id]['authenticate'] : resource['authenticate']
+      end
+
       def authenticator_authenticate(account, service_id, authenticator, options)
         RestClient::Resource.new(
           Conjur.configuration.core_url,

data/lib/conjur/api.rb

@@ -36,6 +36,7 @@ require 'conjur/log_source'
 require 'conjur/has_attributes'
 require 'conjur/api/authenticators'
 require 'conjur/api/authn'
+require 'conjur/api/authn_cert'
 require 'conjur/api/roles'
 require 'conjur/api/resources'
 require 'conjur/api/pubkeys'

data/spec/authn_cert_spec.rb

@@ -0,0 +1,163 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'openssl'
+require 'tempfile'
+require 'conjur/api/router'
+
+# Generate once for the entire spec file — RSA key generation is expensive.
+TEST_KEY = OpenSSL::PKey::RSA.new(512)
+TEST_CERT = OpenSSL::X509::Certificate.new.tap do |c|
+  c.subject = c.issuer = OpenSSL::X509::Name.parse('/CN=test')
+  c.not_before = Time.now - 1
+  c.not_after  = Time.now + 3600
+  c.public_key = TEST_KEY.public_key
+  c.serial     = 1
+  c.sign(TEST_KEY, OpenSSL::Digest::SHA256.new)
+end
+
+describe Conjur::API, api: :dummy do
+  let(:service_id) { 'my-service' }
+  let(:host_id)    { 'host/workloads/vm-01' }
+
+  let(:key)  { TEST_KEY }
+  let(:cert) { TEST_CERT }
+
+  let(:raw_token) { { 'protected' => 'p', 'payload' => 'pl', 'signature' => 's' } }
+
+  describe '.new_from_cert' do
+    it 'returns an API instance with a CertAuthenticator' do
+      api_instance = Conjur::API.new_from_cert(service_id, cert, key, account: account)
+      expect(api_instance).to be_a(Conjur::API)
+      expect(api_instance.authenticator).to be_a(Conjur::API::CertAuthenticator)
+    end
+
+    it 'accepts file paths for cert and key' do
+      cert_file = Tempfile.new(['cert', '.pem'])
+      key_file  = Tempfile.new(['key', '.pem'])
+      begin
+        cert_file.write(cert.to_pem)
+        key_file.write(key.to_pem)
+        cert_file.close
+        key_file.close
+
+        api_instance = Conjur::API.new_from_cert(service_id, cert_file.path, key_file.path,
+                                                  account: account)
+        expect(api_instance.authenticator).to be_a(Conjur::API::CertAuthenticator)
+      ensure
+        cert_file.unlink
+        key_file.unlink
+      end
+    end
+
+    it 'accepts PEM strings for cert and key' do
+      api_instance = Conjur::API.new_from_cert(service_id, cert.to_pem, key.to_pem,
+                                                account: account)
+      expect(api_instance.authenticator).to be_a(Conjur::API::CertAuthenticator)
+    end
+  end
+
+  describe '.authenticate_cert' do
+    let(:resource) { double('resource') }
+
+    before do
+      allow(Conjur::API).to receive(:url_for)
+        .with(:authn_cert_authenticate, account, service_id, host_id, anything)
+        .and_return(resource)
+      allow(resource).to receive(:post).with('').and_return(raw_token.to_json)
+    end
+
+    it 'returns a parsed token' do
+      token = Conjur::API.authenticate_cert(service_id, cert, key,
+                                             account: account, host_id: host_id)
+      expect(token).to eq(raw_token)
+    end
+  end
+
+  describe '.authenticate_cert (SPIFFE mode)' do
+    let(:resource) { double('resource') }
+
+    before do
+      allow(Conjur::API).to receive(:url_for)
+        .with(:authn_cert_authenticate, account, service_id, nil, anything)
+        .and_return(resource)
+      allow(resource).to receive(:post).with('').and_return(raw_token.to_json)
+    end
+
+    it 'returns a parsed token without host_id' do
+      token = Conjur::API.authenticate_cert(service_id, cert, key, account: account)
+      expect(token).to eq(raw_token)
+    end
+  end
+
+  describe 'CertAuthenticator#refresh_token' do
+    subject(:authenticator) do
+      Conjur::API::CertAuthenticator.new(account, service_id, cert, key, host_id)
+    end
+
+    it 'calls authenticate_cert with the stored credentials' do
+      expect(Conjur::API).to receive(:authenticate_cert)
+        .with(service_id, cert, key, account: account, host_id: host_id)
+        .and_return(raw_token)
+      expect(authenticator.refresh_token).to eq(raw_token)
+    end
+  end
+
+  describe 'CertAuthenticator (SPIFFE mode)' do
+    subject(:authenticator) do
+      Conjur::API::CertAuthenticator.new(account, service_id, cert, key)
+    end
+
+    it 'calls authenticate_cert without host_id' do
+      expect(Conjur::API).to receive(:authenticate_cert)
+        .with(service_id, cert, key, account: account, host_id: nil)
+        .and_return(raw_token)
+      expect(authenticator.refresh_token).to eq(raw_token)
+    end
+  end
+end
+
+describe Conjur::API::Router do
+  let(:account)    { 'myaccount' }
+  let(:service_id) { 'my-service' }
+  let(:cert)       { double('cert') }
+  let(:key)        { double('key') }
+  let(:cert_opts)  { { ssl_client_cert: cert, ssl_client_key: key } }
+
+  before do
+    allow(Conjur.configuration).to receive(:core_url).and_return('https://conjur.example.com')
+    allow(Conjur.configuration).to receive(:create_rest_client_options) do |opts|
+      { ssl_cert_store: OpenSSL::SSL::SSLContext::DEFAULT_CERT_STORE }.merge(opts)
+    end
+  end
+
+  describe '#authn_cert_authenticate' do
+    context 'with host_id (request mode)' do
+      subject { described_class.authn_cert_authenticate(account, service_id, 'host/vm-01', cert_opts) }
+
+      it 'returns a RestClient::Resource' do
+        expect(subject).to be_a(RestClient::Resource)
+      end
+
+      it 'builds the correct URL' do
+        expect(subject.url).to end_with('/authn-cert/my-service/myaccount/host%2Fvm-01/authenticate')
+      end
+    end
+
+    context 'without host_id (SPIFFE mode)' do
+      subject { described_class.authn_cert_authenticate(account, service_id, nil, cert_opts) }
+
+      it 'builds the correct URL without host segment' do
+        expect(subject.url).to end_with('/authn-cert/my-service/myaccount/authenticate')
+      end
+    end
+
+    context 'with a service_id containing special characters' do
+      subject { described_class.authn_cert_authenticate(account, 'svc/my service', nil, cert_opts) }
+
+      it 'URL-encodes the service_id' do
+        expect(subject.url).to end_with('/authn-cert/svc%2Fmy%20service/myaccount/authenticate')
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: conjur-api
 version: !ruby/object:Gem::Version
-  version: 6.2.0.pre.802
+  version: 6.2.0.pre.806
 platform: ruby
 authors:
 - CyberArk Maintainers
@@ -342,6 +342,7 @@ files:
 - lib/conjur/api.rb
 - lib/conjur/api/authenticators.rb
 - lib/conjur/api/authn.rb
+- lib/conjur/api/authn_cert.rb
 - lib/conjur/api/host_factories.rb
 - lib/conjur/api/ldap_sync.rb
 - lib/conjur/api/policies.rb
@@ -384,6 +385,7 @@ files:
 - spec/.conjurrc
 - spec/api/host_factories_spec.rb
 - spec/api_spec.rb
+- spec/authn_cert_spec.rb
 - spec/base_object_spec.rb
 - spec/cert_utils_spec.rb
 - spec/cidr_spec.rb
@@ -457,6 +459,7 @@ test_files:
 - spec/.conjurrc
 - spec/api/host_factories_spec.rb
 - spec/api_spec.rb
+- spec/authn_cert_spec.rb
 - spec/base_object_spec.rb
 - spec/cert_utils_spec.rb
 - spec/cidr_spec.rb