conjur-api 6.3.1.pre.848 → 6.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e94af8f767fd0324c87edb5648af755334c349670c1b4d50a2b4cec6927eb2f5
-  data.tar.gz: e5a01b8576510b3f21209b2a75790ee6f37607c011a8d0937481386e78d0746f
+  metadata.gz: e7b56e1d0e5d393556c564aec43aed82569aee4fce4506f2781af39308dde858
+  data.tar.gz: 0e0f305d3ade218a69a327e0e7bb394ec70317719897942925fe13d4296a63b5
 SHA512:
-  metadata.gz: 74c14463069c05daaa17c1c9aca5ffec2cc884835762c4a0bffaa0322158a3c09145badf7257b8bfdb19888b98b6298e548973111aa4463465da6f584621b95b
-  data.tar.gz: 6ed18e8e9acb13891834d729cd1fc5a4b678942b548be8418c58480517b90b0b28870a0a966dd176e2302e41e8026880d77acbfebd9eb027c0cfb7c9e0fb280d
+  metadata.gz: 25cbc42d0c2b063b0eea9c575d2991fcb49c9097bb1b8b2389a3d718fe589aa0565b147053ec30aaa6696e0f340639fc8792ff8dfcc134dc9c075df9d6263178
+  data.tar.gz: 3aec2b8ee3ad4b6a58206dd50d8e3b57c369e370559518ccfcea6b0ee3a0b83a955430dbc6d1dc346447e4f0f9ccb490da406cb20126e4fe38297f5311f8ad72

data/CHANGELOG.md

@@ -5,31 +5,6 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 ## Unreleased
-### Added
-- Cloud-native authenticators for Azure Managed Identity (`authn-azure`),
-  AWS IAM (`authn-iam`), and GCP workload identity (`authn-gcp`), exposed
-  via `Conjur::API.new_from_azure`, `.new_from_iam`, and `.new_from_gcp`
-  (CNJR-14213).
-- Live integration features for the cloud authenticators, gated behind the
-  `RUN_AWS_TESTS` / `RUN_AZURE_TESTS` / `RUN_GCP_TESTS` pipeline params and run
-  on dedicated cloud agents (excluded from the default suite) (CNJR-14213).
-
-### Changed
-- CI uses Conjur Enterprise 1.27.0+, which removed the `GET /public_keys` endpoint
-  (CNJR-11339). Dropped the Cucumber scenario that exercised that API; the client
-  method remains for open-source Conjur.
-- Retrieve the Cucumber admin API key via `conjurctl` in `test.sh` instead of rake,
-  avoiding Rails boot output corrupting the key on current Conjur images.
-- CI now tests against Ruby 3.3, 3.4, and 4.0. Dropped Ruby 3.2 (end of life)
-  and raised the minimum supported Ruby version accordingly.
-
-### Fixed
-- Set `CONJUR_AUTHN_ALLOWED_IP_RANGES` and `CONJUR_AUTHN_HTTP_ALLOWLIST` in the
-  test environment so Conjur's new SSRF guard does not block the authn-oidc
-  `provider-uri` fetch to the compose-local Keycloak server. (CNJR-13786)
-- Corrected `Conjur::API.new_from_gcp` / `authenticate_gcp` to target the
-  serviceless `authn-gcp` endpoint (`/authn-gcp/{account}/authenticate`) instead
-  of `authn-jwt`; the `service_id` argument was removed accordingly (CNJR-14213).
 
 ## [6.3.1] - 2026-07-16
 
@@ -49,6 +24,15 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Added `Conjur::API#fetch_policy` for retrieving policy data from the server,
   as YAML or JSON, with optional tree depth and size limits.
 
+### Changed
+- CI uses Conjur Enterprise 1.27.0+, which removed the `GET /public_keys` endpoint
+  (CNJR-11339). Dropped the Cucumber scenario that exercised that API; the client
+  method remains for open-source Conjur.
+- Retrieve the Cucumber admin API key via `conjurctl` in `test.sh` instead of rake,
+  avoiding Rails boot output corrupting the key on current Conjur images.
+- CI now tests against Ruby 3.3, 3.4, and 4.0. Dropped Ruby 3.2 (end of life)
+  and raised the minimum supported Ruby version accordingly.
+
 ## [6.2.0] - 2026-06-05
 
 ## [6.1.0] - 2025-12-10

data/Jenkinsfile

@@ -30,23 +30,8 @@ pipeline {
   }
 
   triggers {
-    // Declarative pipelines allow only one parameterizedCron trigger, so both
-    // schedules live in a single multi-line string. The daily build also
-    // exercises the cloud authenticators end-to-end; PR builds leave the
-    // RUN_*_TESTS params false, so those stages are skipped there.
-    parameterizedCron("""
-      ${getDailyCronString("%RUN_AWS_TESTS=true;RUN_AZURE_TESTS=true;RUN_GCP_TESTS=true")}
-      ${getWeeklyCronString("H(1-5)","%MODE=RELEASE")}
-    """)
-  }
-
-  parameters {
-    booleanParam(name: 'RUN_AWS_TESTS', defaultValue: false,
-      description: 'Run the authn-iam integration test on an AWS executor agent')
-    booleanParam(name: 'RUN_AZURE_TESTS', defaultValue: false,
-      description: 'Run the authn-azure integration test on an Azure executor agent')
-    booleanParam(name: 'RUN_GCP_TESTS', defaultValue: false,
-      description: 'Run the authn-jwt/gcp integration test (token fetched on a GCP agent)')
+    cron(getDailyCronString())
+    parameterizedCron(getWeeklyCronString("H(1-5)","%MODE=RELEASE"))
   }
 
   stages {
@@ -76,17 +61,6 @@ pipeline {
       steps {
         script {
           infrapool = getInfraPoolAgent.connected(type: "ExecutorV2", quantity: 1, duration: 1)[0]
-          // Provision dedicated cloud agents only when the matching cloud test
-          // is requested. These are real Azure/GCP VMs whose managed identity /
-          // service account the authenticators exercise against the live
-          // metadata service. The AWS test reuses the standard ExecutorV2 agent
-          // (which itself runs in AWS with an instance profile).
-          if (params.RUN_AZURE_TESTS) {
-            azureInfrapool = getInfraPoolAgent.connected(type: "AzureExecutorV2", quantity: 1, duration: 1)[0]
-          }
-          if (params.RUN_GCP_TESTS) {
-            gcpInfrapool = getInfraPoolAgent.connected(type: "GcpExecutorV2", quantity: 1, duration: 1)[0]
-          }
         }
       }
     }
@@ -151,12 +125,6 @@ pipeline {
         script {
           infrapool.agentSh "./test.sh"
           infrapool.agentStash name: 'reports4.0', includes: '**/reports/*.xml'
-          // Stash coverage from the full suite now. The cloud stages below run
-          // ./test.sh again on this agent, and jenkins_init wipes and regenerates
-          // coverage/ from a single cloud feature (no rspec) — which would drop
-          // the reported coverage well below the quality gate. Capturing it here
-          // keeps the submitted coverage that of the complete unit+cucumber run.
-          infrapool.agentStash name: 'coverage', includes: '**/coverage/**'
         }
       }
       post {
@@ -166,101 +134,16 @@ pipeline {
       }
     }
 
-    stage('Run AWS IAM tests') {
-      when { expression { params.RUN_AWS_TESTS } }
-      environment {
-        INFRAPOOL_RUN_AWS_TESTS = 'true'
-        INFRAPOOL_RUBY_VERSION  = '3.3'
-        INFRAPOOL_REGISTRY_URL  = "registry.tld"
-      }
-      steps {
-        script {
-          // authn-iam identifies the Conjur host by the AWS caller identity, so
-          // the host id in the policy must be "<account-id>/<role-name>". Derive
-          // those from the agent's own instance profile (as conjur-api-java does)
-          // and pass them to the feature via env.
-          def callerIdentityJson = infrapool.agentSh(script: 'aws sts get-caller-identity', returnStdout: true).trim()
-          def awsAccountId = (callerIdentityJson =~ /"Account"\s*:\s*"([^"]+)"/)[0][1]
-          def awsArn       = (callerIdentityJson =~ /"Arn"\s*:\s*"([^"]+)"/)[0][1]
-          def awsRoleName  = awsArn.tokenize('/')[1]  // arn:...:assumed-role/<role>/<session>
-          infrapool.agentSh """
-            export INFRAPOOL_AWS_ACCOUNT_ID='${awsAccountId}'
-            export INFRAPOOL_AWS_ROLE_NAME='${awsRoleName}'
-            ./test.sh
-          """
-        }
-      }
-      post {
-        always {
-          script { infrapool.agentStash name: 'reports-aws', includes: '**/reports/*.xml' }
-          unstash 'reports-aws'
-        }
-      }
-    }
-
-    stage('Run Azure tests') {
-      when { expression { params.RUN_AZURE_TESTS } }
-      environment {
-        INFRAPOOL_RUN_AZURE_TESTS = 'true'
-        INFRAPOOL_RUBY_VERSION    = '3.3'
-        INFRAPOOL_REGISTRY_URL    = "registry.tld"
-      }
-      steps {
-        script {
-          // summon injects AZURE_SUBSCRIPTION_ID / AZURE_RESOURCE_GROUP /
-          // USER_ASSIGNED_IDENTITY_CLIENT_ID from the CI vault; the test hits
-          // the real Azure IMDS on this Azure VM.
-          azureInfrapool.agentSh "summon -e azure ./test.sh"
-        }
-      }
-      post {
-        always {
-          script { azureInfrapool.agentStash name: 'reports-azure', includes: '**/reports/*.xml' }
-          unstash 'reports-azure'
-        }
-      }
-    }
-
-    stage('Run GCP tests') {
-      when { expression { params.RUN_GCP_TESTS } }
-      environment {
-        INFRAPOOL_RUN_GCP_TESTS = 'true'
-        INFRAPOOL_RUBY_VERSION  = '3.3'
-        INFRAPOOL_REGISTRY_URL  = "registry.tld"
-        GCP_CTX_DIR = "gcp-ctx"
-      }
-      steps {
-        script {
-          // GCP agents lack a Docker runtime, so fetch a real identity token on
-          // the GCP VM, stash it, then run the actual test on the AWS agent with
-          // the token supplied via GCP_ID_TOKEN.
-          gcpInfrapool.agentSh "./ci/get_gcp_token.sh data/test/gcp-apps/test-app cucumber ${GCP_CTX_DIR}"
-          gcpInfrapool.agentStash name: 'gcp-token', includes: "${GCP_CTX_DIR}/*"
-          infrapool.agentUnstash name: 'gcp-token'
-          infrapool.agentSh """
-            export GCP_ID_TOKEN="\$(cat ${GCP_CTX_DIR}/token)"
-            export GCP_PROJECT_ID="\$(cat ${GCP_CTX_DIR}/project-id)"
-            ./test.sh
-          """
-        }
-      }
-      post {
-        always {
-          script { infrapool.agentStash name: 'reports-gcp', includes: '**/reports/*.xml' }
-          unstash 'reports-gcp'
-        }
-      }
-    }
-
     stage('Submit Coverage Report'){
       steps{
-        // Coverage was stashed at the end of 'Test Ruby 4.0', before the cloud
-        // stages regenerated a partial coverage/ on the agent.
+        script {
+          infrapool.agentStash name: 'coverage', includes: '**/coverage/**'
+        }
         unstash 'coverage'
 
         recordCoverage(
           tools: [[parser: 'COBERTURA', pattern: 'coverage/coverage.xml']],
-          sourceCodeEncoding: 'UTF-8',
+          sourceCodeEncoding: 'ASCII',
           qualityGates: [
             [threshold: 70.0, metric: 'LINE', baseline: 'PROJECT', unstable: true],
             [threshold: 70.0, metric: 'BRANCH', baseline: 'PROJECT', unstable: true],

data/Rakefile

@@ -23,34 +23,8 @@ begin
   require 'cucumber'
   require 'cucumber/rake/task'
 
-  # Cloud-authenticator features (authn-iam / authn-azure / authn-jwt gcp) are
-  # live integration tests that only work on the matching cloud agent, so they
-  # are excluded from the default suite and opted into via the CLOUD_AUTHN_TAG
-  # env var by the dedicated jenkins_cucumber_cloud task.
-  CLOUD_AUTHN_TAGS = %w[@authn_iam @authn_azure @authn_gcp].freeze
-
   Cucumber::Rake::Task.new(:cucumber) do |t|
-    exclude = (['@wip'] + CLOUD_AUTHN_TAGS).map { |tag| "not #{tag}" }.join(' and ')
-    t.cucumber_opts = "--tags '#{exclude}' --format pretty --format junit --out features/reports"
-  end
-
-  # Runs a single cloud-authenticator feature, selected by CLOUD_AUTHN_TAG
-  # (e.g. CLOUD_AUTHN_TAG=@authn_iam). Used by the cloud CI stages.
-  #
-  # NOTE: this block runs at Rakefile load time, so it must not raise when
-  # CLOUD_AUTHN_TAG is unset (that would break every other rake invocation).
-  # The value is validated in the :validate_cloud_authn_tag prerequisite,
-  # which only runs when this task is actually invoked. The fallback tag here
-  # is only a placeholder for the load-time cucumber_opts string.
-  Cucumber::Rake::Task.new(:cucumber_cloud) do |t|
-    tag = ENV['CLOUD_AUTHN_TAG'].to_s.empty? ? '@authn_iam' : ENV['CLOUD_AUTHN_TAG']
-    t.cucumber_opts = "--tags '#{tag}' --format pretty --format junit --out features/reports"
-  end
-
-  task :validate_cloud_authn_tag do
-    if ENV['CLOUD_AUTHN_TAG'].to_s.empty?
-      raise 'CLOUD_AUTHN_TAG must be set (e.g. @authn_iam) to run jenkins_cucumber_cloud'
-    end
+    t.cucumber_opts = "--tags 'not @wip' --format pretty --format junit --out features/reports"
   end
 
   begin
@@ -59,7 +33,6 @@ begin
     task :jenkins_init => [ :init_coverage, :cuke_report_cleanup ]
     task :jenkins_spec => [ :"ci:setup:rspec", :spec ]
     task :jenkins_cucumber => [ :cucumber ]
-    task :jenkins_cucumber_cloud => [ :validate_cloud_authn_tag, :cucumber_cloud ]
   rescue LoadError
     warn "ci_reporter_rspec not found, jenkins task will be unavailable"
   end

data/VERSION

@@ -1 +1 @@
-6.3.1-848
+6.3.1

data/conjur-api.gemspec

@@ -40,8 +40,4 @@ Gem::Specification.new do |gem|
   gem.add_development_dependency 'pry-byebug'
   gem.add_development_dependency 'nokogiri'
   gem.add_development_dependency 'webrick'
-  # Optional runtime dependency for the IAM authenticator (authn-iam); not a
-  # hard dependency of the gem, but required to exercise it in the integration
-  # tests.
-  gem.add_development_dependency 'aws-sdk-core'
 end

data/docker-compose.yml

@@ -11,21 +11,6 @@ services:
     environment:
       DATABASE_URL: postgres://postgres@pg/postgres
       CONJUR_DATA_KEY: 'WMfApcDBtocRWV+ZSUP3Tjr5XNU+Z2FdBb6BEezejIs='
-      # NOTE: CONJUR_AUTHENTICATORS is intentionally left unset. When unset the
-      # server is permissive, so both the existing authn-oidc tests and the
-      # cloud-authenticator features can enable their authenticators at runtime
-      # via authenticator_enable. Setting an explicit allowlist here makes the
-      # server strict and breaks the authn-oidc scenarios, and any authenticators
-      # listed would show up in authenticator_list's "enabled" set (which the
-      # authenticators.feature assertions depend on staying ["authn"]).
-      #
-      # Conjur's SSRF guard blocks authenticator fetches (authn-oidc provider-uri here) that
-      # resolve to loopback/RFC1918 ranges or use plain HTTP. Keycloak is reached by compose
-      # service name, so it resolves inside the bridge network's private subnet and its
-      # discovery document advertises http://keycloak:8080 endpoints. Both guards must be
-      # opted out of for this test env. Mirrors conjur's own ci/docker-compose.yml.
-      CONJUR_AUTHN_ALLOWED_IP_RANGES: ${CONJUR_AUTHN_ALLOWED_IP_RANGES:-0.0.0.0/0,::/0}
-      CONJUR_AUTHN_HTTP_ALLOWLIST: ${CONJUR_AUTHN_HTTP_ALLOWLIST:-keycloak}
     volumes:
       - authn_local:/run/authn-local
       - ./ci/oauth/keycloak:/scripts

data/lib/conjur/api/router.rb

@@ -42,33 +42,6 @@ module Conjur
         )[fully_escape account][fully_escape username]['authenticate']
       end
 
-      # POST /authn-azure/{service_id}/{account}/{login}/authenticate
-      def authn_azure_authenticate account, service_id, identity
-        RestClient::Resource.new(
-          Conjur.configuration.core_url,
-          Conjur.configuration.rest_client_options
-        )['authn-azure'][fully_escape service_id][fully_escape account][fully_escape identity]['authenticate']
-      end
-
-      # POST /authn-iam/{service_id}/{account}/{login}/authenticate
-      def authn_iam_authenticate account, service_id, identity
-        RestClient::Resource.new(
-          Conjur.configuration.core_url,
-          Conjur.configuration.rest_client_options
-        )['authn-iam'][fully_escape service_id][fully_escape account][fully_escape identity]['authenticate']
-      end
-
-      # POST /authn-gcp/{account}/authenticate
-      # authn-gcp is a serviceless authenticator: Conjur derives the host from
-      # the GCP identity token's claims, so neither a service id nor the login
-      # appears in the path.
-      def authn_gcp_authenticate account
-        RestClient::Resource.new(
-          Conjur.configuration.core_url,
-          Conjur.configuration.rest_client_options
-        )['authn-gcp'][fully_escape account]['authenticate']
-      end
-
       # Builds the RestClient::Resource for an authn-cert authentication request.
       # cert_options must include :ssl_client_cert and :ssl_client_key so that
       # the client certificate is presented during the TLS handshake.
@@ -89,14 +62,10 @@ module Conjur
       end
 
       def authenticator account, authenticator, service_id, credentials
-        resource = RestClient::Resource.new(
+        RestClient::Resource.new(
           Conjur.configuration.core_url,
           Conjur.configuration.create_rest_client_options(credentials)
-        )[fully_escape authenticator]
-        # Serviceless authenticators (e.g. authn-gcp) have no service id segment:
-        # the path is authn-<type>/<account>.
-        resource = resource[fully_escape service_id] unless service_id.nil? || service_id.empty?
-        resource[fully_escape account]
+        )[fully_escape authenticator][fully_escape service_id][fully_escape account]
       end
 
       def authenticators

data/lib/conjur/api.rb

@@ -36,9 +36,6 @@ require 'conjur/log_source'
 require 'conjur/has_attributes'
 require 'conjur/api/authenticators'
 require 'conjur/api/authn'
-require 'conjur/api/authn_azure'
-require 'conjur/api/authn_iam'
-require 'conjur/api/authn_gcp'
 require 'conjur/api/authn_cert'
 require 'conjur/api/roles'
 require 'conjur/api/resources'

data/test.sh

@@ -7,22 +7,6 @@ RUBY_VERSION="$(cut -d '-' -f 2 <<< "$RUBY_VERSION")"
 export REGISTRY_URL=${INFRAPOOL_REGISTRY_URL:-"docker.io"}
 export RUBY_VERSION="${INFRAPOOL_RUBY_VERSION:-$RUBY_VERSION}"
 
-# Cloud-authenticator integration toggles. These accept both plain and
-# INFRAPOOL_-prefixed variants (Jenkins injects the latter). When any is
-# "true", ONLY that authenticator's tagged feature runs against real cloud
-# infrastructure; the normal suite is skipped. Left unset by default so PR
-# builds run the ordinary unit + cucumber suite.
-RUN_AWS_TESTS="${INFRAPOOL_RUN_AWS_TESTS:-${RUN_AWS_TESTS:-false}}"
-RUN_AZURE_TESTS="${INFRAPOOL_RUN_AZURE_TESTS:-${RUN_AZURE_TESTS:-false}}"
-RUN_GCP_TESTS="${INFRAPOOL_RUN_GCP_TESTS:-${RUN_GCP_TESTS:-false}}"
-export RUN_AWS_TESTS RUN_AZURE_TESTS RUN_GCP_TESTS
-
-# authn-iam identifies the Conjur host by the AWS caller identity; the AWS stage
-# derives these from `aws sts get-caller-identity` on the agent.
-AWS_ACCOUNT_ID="${INFRAPOOL_AWS_ACCOUNT_ID:-${AWS_ACCOUNT_ID:-}}"
-AWS_ROLE_NAME="${INFRAPOOL_AWS_ROLE_NAME:-${AWS_ROLE_NAME:-}}"
-export AWS_ACCOUNT_ID AWS_ROLE_NAME
-
 source ./ci/oauth/keycloak/keycloak_functions.sh
 TOP_LEVEL=$(git rev-parse --show-toplevel)
 
@@ -39,23 +23,6 @@ if [ ! -f "${TOP_LEVEL}/VERSION" ]; then
   echo -n "0.0.dev" > "${TOP_LEVEL}/VERSION"
 fi
 
-# Returns the cloud-authn cucumber tag to run when a RUN_*_TESTS flag is set,
-# or empty for a normal run. Validates required env vars for the chosen cloud.
-function cloudAuthnTag() {
-  if [[ "$RUN_AWS_TESTS" == "true" ]]; then
-    : "${AWS_ACCOUNT_ID:?AWS_ACCOUNT_ID is required for IAM tests (derived from aws sts get-caller-identity)}"
-    : "${AWS_ROLE_NAME:?AWS_ROLE_NAME is required for IAM tests (derived from aws sts get-caller-identity)}"
-    echo '@authn_iam'
-  elif [[ "$RUN_AZURE_TESTS" == "true" ]]; then
-    : "${AZURE_SUBSCRIPTION_ID:?AZURE_SUBSCRIPTION_ID is required for Azure tests}"
-    : "${AZURE_RESOURCE_GROUP:?AZURE_RESOURCE_GROUP is required for Azure tests}"
-    echo '@authn_azure'
-  elif [[ "$RUN_GCP_TESTS" == "true" ]]; then
-    : "${GCP_ID_TOKEN:?GCP_ID_TOKEN is required for GCP tests (run ci/get_gcp_token.sh first)}"
-    echo '@authn_gcp'
-  fi
-}
-
 function main() {
   if ! docker info >/dev/null 2>&1; then
     echo "Docker does not seem to be running, run it first and retry"
@@ -64,8 +31,6 @@ function main() {
   # Generate reports folders locally
   mkdir -p spec/reports features/reports
 
-  CLOUD_AUTHN_TAG="$(cloudAuthnTag)"
-
   startConjur
   runTests
 }
@@ -89,15 +54,6 @@ function runTests() {
 
   local api_key=$(docker compose exec -T conjur conjurctl role retrieve-key cucumber:user:admin | tr -d '\r\n')
 
-  if [[ -n "$CLOUD_AUTHN_TAG" ]]; then
-    runCloudAuthnTests "$api_key"
-  else
-    runDefaultTests "$api_key"
-  fi
-}
-
-function runDefaultTests() {
-  local api_key="$1"
   echo 'Running tests'
   echo '-----'
   docker compose run --rm \
@@ -107,38 +63,4 @@ function runDefaultTests() {
     "/scripts/fetch_certificate && bundle exec rake jenkins_init jenkins_spec jenkins_cucumber"
 }
 
-# Runs a single cloud-authenticator feature against real cloud infrastructure.
-# Forwards the cloud provider env vars and clears proxies so the container can
-# reach the link-local metadata endpoints (169.254.169.254, metadata.google.internal).
-function runCloudAuthnTests() {
-  local api_key="$1"
-  echo "Running cloud authenticator tests: $CLOUD_AUTHN_TAG"
-  echo '-----'
-  local rc=0
-  docker compose run --rm \
-    -e CONJUR_AUTHN_API_KEY="$api_key" \
-    -e CLOUD_AUTHN_TAG="$CLOUD_AUTHN_TAG" \
-    -e NO_PROXY="169.254.169.254,metadata.google.internal,localhost,127.0.0.1,conjur" \
-    -e HTTP_PROXY="" -e HTTPS_PROXY="" -e http_proxy="" -e https_proxy="" \
-    -e AZURE_SUBSCRIPTION_ID="${AZURE_SUBSCRIPTION_ID:-}" \
-    -e AZURE_RESOURCE_GROUP="${AZURE_RESOURCE_GROUP:-}" \
-    -e USER_ASSIGNED_IDENTITY_CLIENT_ID="${USER_ASSIGNED_IDENTITY_CLIENT_ID:-}" \
-    -e GCP_ID_TOKEN="${GCP_ID_TOKEN:-}" \
-    -e GCP_PROJECT_ID="${GCP_PROJECT_ID:-}" \
-    -e AWS_ACCOUNT_ID="${AWS_ACCOUNT_ID:-}" \
-    -e AWS_ROLE_NAME="${AWS_ROLE_NAME:-}" \
-    tester \
-    "bundle exec rake jenkins_init jenkins_cucumber_cloud" || rc=$?
-
-  # On failure, dump the Conjur server log: authn-azure/iam/gcp rejections are
-  # logged there with the precise reason (issuer/annotation/audience mismatch),
-  # which the client only ever sees as an opaque 401.
-  if [[ $rc -ne 0 ]]; then
-    echo "=== cloud authn test failed; last 100 lines of Conjur server log ==="
-    docker compose logs --tail=100 conjur || true
-    echo '=== end Conjur server log ==='
-  fi
-  return $rc
-}
-
 main

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: conjur-api
 version: !ruby/object:Gem::Version
-  version: 6.3.1.pre.848
+  version: 6.3.1
 platform: ruby
 authors:
 - CyberArk Maintainers
@@ -261,20 +261,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: aws-sdk-core
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 description: Conjur API
 email:
 - conj_maintainers@cyberark.com
@@ -305,7 +291,6 @@ files:
 - SECURITY.md
 - VERSION
 - ci/configure.sh
-- ci/get_gcp_token.sh
 - ci/oauth/keycloak/create_client
 - ci/oauth/keycloak/create_user
 - ci/oauth/keycloak/fetch_certificate
@@ -320,12 +305,8 @@ files:
 - dev/stop
 - docker-compose.yml
 - example/demo.rb
-- features/README.md
 - features/authenticators.feature
 - features/authn.feature
-- features/authn_azure.feature
-- features/authn_gcp.feature
-- features/authn_iam.feature
 - features/authn_local.feature
 - features/exists.feature
 - features/group.feature
@@ -341,7 +322,6 @@ files:
 - features/role_fields.feature
 - features/rotate_api_key.feature
 - features/step_definitions/api_steps.rb
-- features/step_definitions/cloud_authn_steps.rb
 - features/step_definitions/policy_steps.rb
 - features/step_definitions/result_steps.rb
 - features/support/env.rb
@@ -362,10 +342,7 @@ files:
 - lib/conjur/api.rb
 - lib/conjur/api/authenticators.rb
 - lib/conjur/api/authn.rb
-- lib/conjur/api/authn_azure.rb
 - lib/conjur/api/authn_cert.rb
-- lib/conjur/api/authn_gcp.rb
-- lib/conjur/api/authn_iam.rb
 - lib/conjur/api/host_factories.rb
 - lib/conjur/api/ldap_sync.rb
 - lib/conjur/api/policies.rb
@@ -408,7 +385,6 @@ files:
 - lib/conjur/variable.rb
 - lib/conjur/webservice.rb
 - publish.sh
-- secrets.yml
 - spec/.conjurrc
 - spec/api/host_factories_spec.rb
 - spec/api/policies_spec.rb
@@ -416,10 +392,7 @@ files:
 - spec/api/server_version_spec.rb
 - spec/api/version_check_spec.rb
 - spec/api_spec.rb
-- spec/authn_azure_spec.rb
 - spec/authn_cert_spec.rb
-- spec/authn_gcp_spec.rb
-- spec/authn_iam_spec.rb
 - spec/base_object_spec.rb
 - spec/cert_utils_spec.rb
 - spec/cidr_spec.rb
@@ -464,12 +437,8 @@ rubygems_version: 4.0.10
 specification_version: 4
 summary: Conjur API
 test_files:
-- features/README.md
 - features/authenticators.feature
 - features/authn.feature
-- features/authn_azure.feature
-- features/authn_gcp.feature
-- features/authn_iam.feature
 - features/authn_local.feature
 - features/exists.feature
 - features/group.feature
@@ -485,7 +454,6 @@ test_files:
 - features/role_fields.feature
 - features/rotate_api_key.feature
 - features/step_definitions/api_steps.rb
-- features/step_definitions/cloud_authn_steps.rb
 - features/step_definitions/policy_steps.rb
 - features/step_definitions/result_steps.rb
 - features/support/env.rb
@@ -503,10 +471,7 @@ test_files:
 - spec/api/server_version_spec.rb
 - spec/api/version_check_spec.rb
 - spec/api_spec.rb
-- spec/authn_azure_spec.rb
 - spec/authn_cert_spec.rb
-- spec/authn_gcp_spec.rb
-- spec/authn_iam_spec.rb
 - spec/base_object_spec.rb
 - spec/cert_utils_spec.rb
 - spec/cidr_spec.rb

data/ci/get_gcp_token.sh

@@ -1,43 +0,0 @@
-#!/bin/bash -e
-#
-# Fetch a GCP identity token from the instance metadata service.
-#
-# This is meant to run ON a GCP executor agent. GCP agents typically lack a
-# Docker runtime, so the authn-jwt/gcp integration test itself runs on a
-# different (e.g. AWS) agent. This script fetches a real identity token here,
-# writes it to a file, and the Jenkins pipeline stashes it and hands it to the
-# test container via the GCP_ID_TOKEN env var.
-#
-# Usage: ./ci/get_gcp_token.sh <host-id> <account> <output-dir>
-#   host-id     Conjur host id WITHOUT the "host/" prefix
-#               (e.g. "data/test/gcp-apps/test-app")
-#   account     Conjur account (e.g. "cucumber")
-#   output-dir  directory to write "token" and "project-id" into
-
-HOST_ID="${1:?host-id (without host/ prefix) is required}"
-ACCOUNT="${2:?account is required}"
-OUT_DIR="${3:?output directory is required}"
-
-METADATA_BASE="http://metadata.google.internal/computeMetadata/v1"
-AUDIENCE="conjur/${ACCOUNT}/host/${HOST_ID}"
-
-mkdir -p "${OUT_DIR}"
-
-echo "Fetching GCP identity token for audience: ${AUDIENCE}"
-token="$(curl -sS --noproxy '*' -H 'Metadata-Flavor: Google' \
-  "${METADATA_BASE}/instance/service-accounts/default/identity?audience=${AUDIENCE}&format=full")"
-
-# Sanity-check that we got a 3-part JWT rather than an HTML error page.
-if [[ "$(grep -o '\.' <<< "${token}" | wc -l | tr -d ' ')" != "2" ]]; then
-  echo "ERROR: metadata service did not return a JWT. Got:" >&2
-  echo "${token}" >&2
-  exit 1
-fi
-
-project_id="$(curl -sS --noproxy '*' -H 'Metadata-Flavor: Google' \
-  "${METADATA_BASE}/project/project-id")"
-
-printf '%s' "${token}"      > "${OUT_DIR}/token"
-printf '%s' "${project_id}" > "${OUT_DIR}/project-id"
-
-echo "Wrote ${OUT_DIR}/token and ${OUT_DIR}/project-id"