conjur-api 6.3.1.pre.848 → 6.3.1

data/features/README.md

@@ -1,80 +0,0 @@
-# Cucumber integration features
-
-The default suite (run by `rake jenkins_cucumber` via `test.sh`) exercises the
-API against a local Conjur brought up by `docker-compose`.
-
-## Cloud authenticator features
-
-`authn_iam.feature`, `authn_azure.feature`, and `authn_gcp.feature` are **live
-integration tests** for the AWS IAM / Azure / GCP authenticators. They are
-tagged `@authn_iam` / `@authn_azure` / `@authn_gcp` and are **excluded from the
-default run** (see `Rakefile`), because they only pass on the matching cloud
-provider's infrastructure.
-
-### How they run in CI
-
-They are gated behind Jenkins boolean params `RUN_AWS_TESTS` / `RUN_AZURE_TESTS`
-/ `RUN_GCP_TESTS` (default `false`; enabled by the daily cron). When a flag is
-set, `test.sh` runs only that authenticator's feature against a real Conjur
-(with `CONJUR_AUTHENTICATORS` including the cloud authenticators) plus the real
-cloud metadata/STS service:
-
-- **AWS IAM** — runs on the standard `ExecutorV2` agent, which is itself in AWS
-  and carries an instance profile. The stage derives the caller identity with
-  `aws sts get-caller-identity` and passes `AWS_ACCOUNT_ID` / `AWS_ROLE_NAME`;
-  the Conjur host id is `<account-id>/<role-name>` (authn-iam matches the host
-  to the signing role). `new_from_iam` signs a real STS `GetCallerIdentity`
-  request.
-- **Azure** — runs on an `AzureExecutorV2` agent. `summon -e azure` injects
-  `AZURE_SUBSCRIPTION_ID`, `AZURE_RESOURCE_GROUP`, and
-  `USER_ASSIGNED_IDENTITY_CLIENT_ID`. `new_from_azure` fetches a JWT from the
-  real Azure IMDS (`169.254.169.254`); the feature derives the `provider-uri`
-  from that token's `iss` claim and annotates the host with the
-  subscription-id / resource-group restrictions.
-- **GCP** — GCP agents lack a Docker runtime, so the flow is split:
-  `ci/get_gcp_token.sh` fetches a real identity token on a `GcpExecutorV2`
-  agent, Jenkins stashes it, and the test runs on the AWS agent with the token
-  passed via `GCP_ID_TOKEN` (and `GCP_PROJECT_ID` for the host's
-  `authn-gcp/project-id` annotation). `new_from_gcp` exchanges that pre-fetched
-  token via the serviceless `authn-gcp` endpoint, bypassing the metadata service.
-
-`test.sh` forwards the cloud env vars into the tester container and clears
-`HTTP(S)_PROXY` / sets `NO_PROXY` so the link-local metadata endpoints are
-reachable directly.
-
-### Running one locally
-
-You must be on (or have credentials for) the relevant cloud. For example, on an
-AWS host with an appropriate instance profile / credentials:
-
-```sh
-RUN_AWS_TESTS=true ./test.sh
-```
-
-For GCP, fetch a token first (on a GCP host), then point the test at it:
-
-```sh
-./ci/get_gcp_token.sh data/test/gcp-apps/test-app cucumber gcp-ctx
-GCP_ID_TOKEN="$(cat gcp-ctx/token)" RUN_GCP_TESTS=true ./test.sh
-```
-
-### CI infrastructure these depend on
-
-The cloud stages authenticate against real provider infrastructure, so they
-rely on the following being in place (all currently provisioned in the
-Conjur-Enterprise CI):
-
-1. `AzureExecutorV2` / `GcpExecutorV2` InfraPool agent types, plus the standard
-   AWS `ExecutorV2` agent (used for AWS IAM and to run the GCP test).
-2. The `!var` references in `secrets.yml` (`ci/azure/...`) resolvable from the
-   CI Conjur vault, so `summon -e azure` can supply the `AZURE_*` /
-   `USER_ASSIGNED_IDENTITY_CLIENT_ID` values.
-3. Cloud identities matching how each feature builds its Conjur host:
-   - **AWS**: the executor's instance-profile role (host id `<account>/<role>`,
-     derived at runtime).
-   - **Azure**: the managed identity in the given subscription / resource-group.
-   - **GCP**: the `GcpExecutorV2` agent's service account, mapped to
-     `data/test/gcp-apps/test-app` via the `authn-gcp/project-id` annotation.
-
-If any of these change, a stage may fail with an opaque `401`; `test.sh` dumps
-the Conjur server log on cloud-test failure so the precise reason is visible.

data/features/authn_azure.feature

@@ -1,15 +0,0 @@
-@authn_azure
-Feature: Authenticate to Conjur using Azure Managed Identity (authn-azure)
-
-  This scenario is a live integration test: it exercises new_from_azure against
-  the real Azure Instance Metadata Service (IMDS). It is tagged @authn_azure and
-  is only run in CI on an Azure executor agent, gated by RUN_AZURE_TESTS, which
-  also supplies AZURE_SUBSCRIPTION_ID / AZURE_RESOURCE_GROUP / the user-assigned
-  identity client id. See Jenkinsfile and features/README.md.
-
-  Scenario: Authenticate with a system-assigned identity and retrieve a secret
-    Given I enable the authn-azure authenticator "prod" for host "test/azure-apps/test-app" using Azure environment config
-    And the secret "test/azure-apps/db-password" has value "s3cr3t"
-    When I authenticate via authn-azure as "host/test/azure-apps/test-app" with service id "prod"
-    Then I receive a Conjur access token
-    And I can retrieve the secret "test/azure-apps/db-password" with value "s3cr3t"

data/features/authn_gcp.feature

@@ -1,19 +0,0 @@
-@authn_gcp
-Feature: Authenticate to Conjur using GCP workload identity (authn-gcp)
-
-  This scenario is a live integration test. GCP executor agents typically lack a
-  Docker runtime, so the flow is split: ci/get_gcp_token.sh fetches a real GCP
-  identity token on the GCP agent, the pipeline hands it to this test via
-  GCP_ID_TOKEN, and new_from_gcp exchanges that pre-fetched token with Conjur
-  (bypassing the metadata service). Tagged @authn_gcp, gated by RUN_GCP_TESTS.
-  See Jenkinsfile and features/README.md.
-
-  authn-gcp is a serviceless authenticator: the host is identified by its
-  authn-gcp/project-id annotation (set from GCP_PROJECT_ID), not a service id.
-
-  Scenario: Authenticate with a pre-fetched GCP identity token and retrieve a secret
-    Given I enable the authn-gcp authenticator for host "data/test/gcp-apps/test-app"
-    And the secret "data/test/gcp-apps/db-password" has value "s3cr3t"
-    When I authenticate via authn-gcp as "host/data/test/gcp-apps/test-app" using the pre-fetched token
-    Then I receive a Conjur access token
-    And I can retrieve the secret "data/test/gcp-apps/db-password" with value "s3cr3t"

data/features/authn_iam.feature

@@ -1,18 +0,0 @@
-@authn_iam
-Feature: Authenticate to Conjur using AWS IAM (authn-iam)
-
-  This scenario is a live integration test: it exercises new_from_iam against
-  the real AWS STS service using the credentials of the host it runs on. It is
-  tagged @authn_iam and is only run in CI on an AWS executor agent, gated by
-  RUN_AWS_TESTS. See Jenkinsfile and features/README.md.
-
-  authn-iam identifies the Conjur host by the AWS caller identity, so the host
-  id is "<AWS_ACCOUNT_ID>/<AWS_ROLE_NAME>" (derived on the agent from
-  `aws sts get-caller-identity` and passed in via env).
-
-  Scenario: Authenticate and retrieve a secret via authn-iam
-    Given I enable the authn-iam authenticator "prod" for the AWS caller identity host
-    And the secret "test/iam-apps/db-password" has value "s3cr3t"
-    When I authenticate via authn-iam as the AWS caller identity host with service id "prod"
-    Then I receive a Conjur access token
-    And I can retrieve the secret "test/iam-apps/db-password" with value "s3cr3t"

data/features/step_definitions/cloud_authn_steps.rb

@@ -1,182 +0,0 @@
-require 'base64'
-require 'json'
-
-# Step definitions for the cloud authenticator integration features
-# (authn-iam, authn-azure, authn-gcp).
-#
-# These steps drive real Conjur (brought up by docker-compose) against the
-# cloud provider's real metadata/STS services. They are only meaningful when
-# run on the matching cloud agent, so the features carry @authn_iam /
-# @authn_azure / @authn_gcp tags and are gated by RUN_AWS_TESTS /
-# RUN_AZURE_TESTS / RUN_GCP_TESTS in the pipeline.
-
-# --- authn-iam -------------------------------------------------------------
-
-# authn-iam matches the Conjur host to the AWS caller identity, so the host id
-# must be "<account-id>/<role-name>" (supplied via env by the AWS CI stage).
-def aws_caller_identity_host_id
-  account = ENV.fetch('AWS_ACCOUNT_ID')
-  role    = ENV.fetch('AWS_ROLE_NAME')
-  "#{account}/#{role}"
-end
-
-Given(/^I enable the authn-iam authenticator "([^"]+)" for the AWS caller identity host$/) do |service_id|
-  host_id = aws_caller_identity_host_id
-  $conjur.load_policy 'root', <<-POLICY
-  - !policy
-    id: conjur/authn-iam/#{service_id}
-    body:
-    - !webservice
-    - !group apps
-    - !permit
-      role: !group apps
-      privilege: [ read, authenticate ]
-      resource: !webservice
-
-  - !host
-    id: #{host_id}
-    annotations:
-      authn-iam/#{service_id}: true
-
-  - !grant
-    role: !group conjur/authn-iam/#{service_id}/apps
-    member: !host #{host_id}
-  POLICY
-
-  @cloud_host_id = host_id
-  $conjur.authenticator_enable('authn-iam', service_id)
-end
-
-When(/^I authenticate via authn-iam as the AWS caller identity host with service id "([^"]+)"$/) do |service_id|
-  identity = "host/#{aws_caller_identity_host_id}"
-  @cloud_api = Conjur::API.new_from_iam(identity, service_id: service_id)
-  @result = @cloud_api.token
-end
-
-# --- authn-azure -----------------------------------------------------------
-
-# The authn-azure provider-uri must equal the token's actual issuer
-# (https://sts.windows.net/<tenant>/). Derive it from a real IMDS token's `iss`
-# claim rather than hardcoding, matching conjur-api-java's resolveProviderUriFromImds.
-def azure_provider_uri
-  jwt = Conjur::API.send(:fetch_azure_jwt,
-                         resource_uri: Conjur::API::AzureAuthenticator::DEFAULT_RESOURCE,
-                         client_id: (ENV['USER_ASSIGNED_IDENTITY_CLIENT_ID'] unless ENV['USER_ASSIGNED_IDENTITY_CLIENT_ID'].to_s.empty?),
-                         imds_base_url: Conjur::API::AzureAuthenticator::DEFAULT_IMDS_BASE,
-                         imds_api_version: Conjur::API::AzureAuthenticator::DEFAULT_IMDS_VER)
-  payload = JSON.parse(Base64.decode64(jwt.split('.')[1]))
-  issuer  = payload.fetch('iss')
-  issuer.end_with?('/') ? issuer : "#{issuer}/"
-end
-
-Given(/^I enable the authn-azure authenticator "([^"]+)" for host "([^"]+)" using Azure environment config$/) do |service_id, host_id|
-  subscription   = ENV.fetch('AZURE_SUBSCRIPTION_ID')
-  resource_group = ENV.fetch('AZURE_RESOURCE_GROUP')
-  provider_uri   = azure_provider_uri
-
-  $conjur.load_policy 'root', <<-POLICY
-  - !policy
-    id: conjur/authn-azure/#{service_id}
-    body:
-    - !webservice
-    - !variable provider-uri
-    - !group apps
-    - !permit
-      role: !group apps
-      privilege: [ read, authenticate ]
-      resource: !webservice
-
-  - !host
-    id: #{host_id}
-    annotations:
-      authn-azure/subscription-id: "#{subscription}"
-      authn-azure/resource-group: "#{resource_group}"
-
-  - !grant
-    role: !group conjur/authn-azure/#{service_id}/apps
-    member: !host #{host_id}
-  POLICY
-
-  @cloud_host_id = host_id
-  $conjur.resource("cucumber:variable:conjur/authn-azure/#{service_id}/provider-uri")
-         .add_value(provider_uri)
-  $conjur.authenticator_enable('authn-azure', service_id)
-end
-
-When(/^I authenticate via authn-azure as "([^"]+)" with service id "([^"]+)"(?: and client id "([^"]*)")?$/) do |identity, service_id, client_id|
-  # new_from_azure takes service_id and identity positionally; client_id is a keyword.
-  opts = {}
-  opts[:client_id] = client_id if client_id && !client_id.empty?
-  @cloud_api = Conjur::API.new_from_azure(service_id, identity, **opts)
-  @result = @cloud_api.token
-end
-
-# --- authn-gcp -------------------------------------------------------------
-
-Given(/^I enable the authn-gcp authenticator for host "([^"]+)"$/) do |host_id|
-  # authn-gcp is serviceless. The host is matched to the GCP identity token via
-  # its authn-gcp/project-id annotation, so the project id must be the one the
-  # token was issued for (supplied by ci/get_gcp_token.sh as GCP_PROJECT_ID).
-  project_id = ENV.fetch('GCP_PROJECT_ID')
-
-  $conjur.load_policy 'root', <<-POLICY
-  - !policy
-    id: conjur/authn-gcp
-    body:
-    - !webservice
-    - !group apps
-    - !permit
-      role: !group apps
-      privilege: [ read, authenticate ]
-      resource: !webservice
-
-  - !host
-    id: #{host_id}
-    annotations:
-      authn-gcp/project-id: "#{project_id}"
-
-  - !grant
-    role: !group conjur/authn-gcp/apps
-    member: !host #{host_id}
-  POLICY
-
-  @cloud_host_id = host_id
-  $conjur.authenticator_enable('authn-gcp', '')
-end
-
-When(/^I authenticate via authn-gcp as "([^"]+)" using the pre-fetched token$/) do |identity|
-  jwt = ENV['GCP_ID_TOKEN']
-  raise 'GCP_ID_TOKEN is not set; run ci/get_gcp_token.sh on a GCP agent first' if jwt.nil? || jwt.empty?
-
-  @cloud_api = Conjur::API.new_from_gcp(identity, jwt: jwt)
-  @result = @cloud_api.token
-end
-
-# --- shared assertions -----------------------------------------------------
-
-Then(/^I receive a Conjur access token$/) do
-  # Conjur access tokens are returned parsed into a Hash of the JWT parts.
-  expect(@result).to be_a(Hash)
-  expect(@result).to include('protected', 'payload', 'signature')
-end
-
-Given(/^the secret "([^"]+)" has value "([^"]+)"$/) do |var_id, value|
-  # Declare the variable and grant the cloud host permission to read it, then
-  # set the value. @cloud_host_id is captured by the "enable ... authenticator"
-  # step that always runs first.
-  raise 'no cloud host configured; run the "enable authenticator" step first' unless @cloud_host_id
-
-  $conjur.load_policy 'root', <<-POLICY
-  - !variable #{var_id}
-  - !permit
-    role: !host #{@cloud_host_id}
-    privilege: [ read, execute ]
-    resource: !variable #{var_id}
-  POLICY
-
-  $conjur.resource("cucumber:variable:#{var_id}").add_value(value)
-end
-
-Then(/^I can retrieve the secret "([^"]+)" with value "([^"]+)"$/) do |var_id, value|
-  expect(@cloud_api.resource("cucumber:variable:#{var_id}").value).to eq(value)
-end

data/lib/conjur/api/authn_azure.rb

@@ -1,145 +0,0 @@
-# frozen_string_literal: true
-
-require 'net/http'
-require 'json'
-require 'uri'
-require 'cgi'
-
-module Conjur
-  class API
-    # Authenticator that uses an Azure Managed Identity JWT to obtain Conjur access tokens.
-    # Fetches a JWT from the Azure Instance Metadata Service (IMDS), then POSTs it
-    # to the Conjur authn-azure endpoint.
-    class AzureAuthenticator
-      include TokenExpiration
-
-      IMDS_TOKEN_PATH    = '/metadata/identity/oauth2/token'.freeze
-      DEFAULT_RESOURCE   = 'https://management.azure.com/'.freeze
-      DEFAULT_IMDS_BASE  = 'http://169.254.169.254'.freeze
-      DEFAULT_IMDS_VER   = '2018-02-01'.freeze
-
-      attr_reader :account, :service_id, :identity, :resource_uri,
-                  :client_id, :imds_base_url, :imds_api_version
-
-      def initialize(account, service_id, identity,
-                     resource_uri: DEFAULT_RESOURCE,
-                     client_id: nil,
-                     imds_base_url: DEFAULT_IMDS_BASE,
-                     imds_api_version: DEFAULT_IMDS_VER)
-        @account          = account
-        @service_id       = service_id
-        @identity         = identity
-        @resource_uri     = resource_uri
-        @client_id        = client_id
-        @imds_base_url    = imds_base_url
-        @imds_api_version = imds_api_version
-        update_token_born
-      end
-
-      def refresh_token
-        Conjur::API.authenticate_azure(service_id, identity,
-                                       account: account,
-                                       resource_uri: resource_uri,
-                                       client_id: client_id,
-                                       imds_base_url: imds_base_url,
-                                       imds_api_version: imds_api_version).tap do
-          update_token_born
-        end
-      end
-    end
-
-    class << self
-      # Create a {Conjur::API} instance authenticated via Azure Managed Identity (authn-azure).
-      #
-      # @param [String] service_id the authn-azure service ID configured in Conjur
-      # @param [String] identity Conjur host identity (e.g. "host/my-app/azure-host")
-      # @param [String] account the Conjur organization account
-      # @param [String] resource_uri Azure resource URI for the IMDS token request
-      # @param [String, nil] client_id optional client ID for a user-assigned managed identity
-      # @param [String] imds_base_url override for the IMDS base URL (useful in tests)
-      # @param [String] imds_api_version override for the IMDS API version
-      # @param [String, nil] remote_ip optional IP address recorded in the audit log
-      # @return [Conjur::API]
-      def new_from_azure(service_id, identity,
-                         account: Conjur.configuration.account,
-                         resource_uri: AzureAuthenticator::DEFAULT_RESOURCE,
-                         client_id: nil,
-                         imds_base_url: AzureAuthenticator::DEFAULT_IMDS_BASE,
-                         imds_api_version: AzureAuthenticator::DEFAULT_IMDS_VER,
-                         remote_ip: nil)
-        self.new.init_from_azure(service_id, identity,
-                                 account: account,
-                                 resource_uri: resource_uri,
-                                 client_id: client_id,
-                                 imds_base_url: imds_base_url,
-                                 imds_api_version: imds_api_version,
-                                 remote_ip: remote_ip)
-      end
-
-      # Authenticate via authn-azure and return a parsed Conjur access token.
-      #
-      # @param [String] service_id the authn-azure service ID
-      # @param [String] identity Conjur host identity
-      # @param [String] account the Conjur organization account
-      # @return [Hash] parsed access token
-      def authenticate_azure(service_id, identity,
-                             account: Conjur.configuration.account,
-                             resource_uri: AzureAuthenticator::DEFAULT_RESOURCE,
-                             client_id: nil,
-                             imds_base_url: AzureAuthenticator::DEFAULT_IMDS_BASE,
-                             imds_api_version: AzureAuthenticator::DEFAULT_IMDS_VER)
-        raise ArgumentError, "service_id is required" if service_id.nil? || service_id.empty?
-        raise ArgumentError, "identity is required"   if identity.nil?  || identity.empty?
-
-        if Conjur.log
-          Conjur.log << "Authenticating #{identity} to account #{account} via authn-azure/#{service_id}\n"
-        end
-
-        jwt = fetch_azure_jwt(resource_uri: resource_uri, client_id: client_id,
-                              imds_base_url: imds_base_url, imds_api_version: imds_api_version)
-        JSON.parse(url_for(:authn_azure_authenticate, account, service_id, identity)
-          .post("jwt=#{CGI.escape(jwt)}", content_type: 'application/x-www-form-urlencoded'))
-      end
-
-      private
-
-      # Fetches an Azure Managed Identity JWT from IMDS.
-      # Uses a direct Net::HTTP connection (proxy addr = nil) because the IMDS
-      # link-local address 169.254.169.254 must never be routed through a proxy.
-      def fetch_azure_jwt(resource_uri:, client_id:, imds_base_url:, imds_api_version:)
-        query = "api-version=#{CGI.escape(imds_api_version)}&resource=#{CGI.escape(resource_uri)}"
-        query += "&client_id=#{CGI.escape(client_id)}" if client_id
-
-        uri = URI("#{imds_base_url}#{AzureAuthenticator::IMDS_TOKEN_PATH}?#{query}")
-        http = Net::HTTP.new(uri.host, uri.port, nil) # nil = no proxy
-        response = http.get(uri.request_uri, 'Metadata' => 'true')
-
-        unless response.is_a?(Net::HTTPSuccess)
-          raise "Azure IMDS token request failed: #{response.code} #{response.message}. Body: #{response.body}"
-        end
-
-        body = JSON.parse(response.body)
-        token = body['access_token']
-        raise "Azure IMDS returned an empty access token" if token.nil? || token.empty?
-
-        token
-      end
-    end
-
-    def init_from_azure(service_id, identity,
-                        account: Conjur.configuration.account,
-                        resource_uri: AzureAuthenticator::DEFAULT_RESOURCE,
-                        client_id: nil,
-                        imds_base_url: AzureAuthenticator::DEFAULT_IMDS_BASE,
-                        imds_api_version: AzureAuthenticator::DEFAULT_IMDS_VER,
-                        remote_ip: nil)
-      @remote_ip     = remote_ip
-      @authenticator = AzureAuthenticator.new(account, service_id, identity,
-                                               resource_uri: resource_uri,
-                                               client_id: client_id,
-                                               imds_base_url: imds_base_url,
-                                               imds_api_version: imds_api_version)
-      self
-    end
-  end
-end

data/lib/conjur/api/authn_gcp.rb

@@ -1,137 +0,0 @@
-# frozen_string_literal: true
-
-require 'net/http'
-require 'uri'
-require 'cgi'
-require 'json'
-
-module Conjur
-  class API
-    # Authenticator that uses a GCP identity token to obtain Conjur access tokens.
-    # Fetches an identity JWT from the GCP Instance Metadata Service, then POSTs it
-    # to the Conjur authn-gcp endpoint.
-    #
-    # authn-gcp is a serviceless authenticator: there is no service ID, and Conjur
-    # identifies the calling host from the token's claims (matched against the
-    # host's authn-gcp/project-id annotation), so the host id is not sent in the
-    # authenticate URL.
-    #
-    # An explicit JWT may be supplied to bypass the metadata service fetch —
-    # useful in CI environments where the token is pre-fetched on a GCP agent.
-    class GCPAuthenticator
-      include TokenExpiration
-
-      DEFAULT_METADATA_URL = 'http://metadata.google.internal/computeMetadata/v1' \
-                             '/instance/service-accounts/default/identity'.freeze
-
-      attr_reader :account, :identity, :jwt, :gcp_identity_url
-
-      def initialize(account, identity, jwt: nil,
-                     gcp_identity_url: DEFAULT_METADATA_URL)
-        @account          = account
-        @identity         = identity
-        @jwt              = jwt
-        @gcp_identity_url = gcp_identity_url
-        update_token_born
-      end
-
-      def refresh_token
-        Conjur::API.authenticate_gcp(identity, account: account,
-                                               jwt: jwt,
-                                               gcp_identity_url: gcp_identity_url).tap do
-          update_token_born
-        end
-      end
-    end
-
-    class << self
-      # Create a {Conjur::API} instance authenticated via GCP workload identity (authn-gcp).
-      #
-      # @param [String] identity Conjur host identity (e.g. "host/data/test/gcp-apps/test-app").
-      #   Used to build the metadata-service audience; Conjur itself derives the
-      #   host from the token, so it is not sent in the authenticate request.
-      # @param [String] account the Conjur organization account
-      # @param [String, nil] jwt pre-obtained GCP identity token; when supplied the metadata
-      #   service is not called. Useful in tests and CI where the token is pre-fetched.
-      # @param [String] gcp_identity_url override for the GCP metadata identity URL (for tests)
-      # @param [String, nil] remote_ip optional IP address recorded in the audit log
-      # @return [Conjur::API]
-      def new_from_gcp(identity,
-                       account: Conjur.configuration.account,
-                       jwt: nil,
-                       gcp_identity_url: GCPAuthenticator::DEFAULT_METADATA_URL,
-                       remote_ip: nil)
-        self.new.init_from_gcp(identity, account: account,
-                                         jwt: jwt, gcp_identity_url: gcp_identity_url,
-                                         remote_ip: remote_ip)
-      end
-
-      # Authenticate via authn-gcp and return a parsed Conjur access token.
-      #
-      # @param [String] identity Conjur host identity (used to build the audience)
-      # @param [String] account the Conjur organization account
-      # @param [String, nil] jwt pre-obtained GCP identity token
-      # @param [String] gcp_identity_url override for the GCP metadata identity URL
-      # @return [Hash] parsed access token
-      def authenticate_gcp(identity,
-                           account: Conjur.configuration.account,
-                           jwt: nil,
-                           gcp_identity_url: GCPAuthenticator::DEFAULT_METADATA_URL)
-        raise ArgumentError, "identity is required" if identity.nil? || identity.empty?
-
-        if Conjur.log
-          Conjur.log << "Authenticating #{identity} to account #{account} via authn-gcp\n"
-        end
-
-        token = jwt || fetch_gcp_jwt(account, identity, gcp_identity_url: gcp_identity_url)
-        JSON.parse(url_for(:authn_gcp_authenticate, account)
-          .post("jwt=#{CGI.escape(token)}", content_type: 'application/x-www-form-urlencoded'))
-      end
-
-      private
-
-      # Fetches a GCP identity token from the instance metadata service.
-      # Uses a direct Net::HTTP connection (proxy addr = nil) because the metadata
-      # link-local address must never be routed through a proxy.
-      #
-      # The requested audience is "conjur/{account}/host/{identity}", matching what
-      # the authn-gcp authenticator expects.
-      def fetch_gcp_jwt(account, identity, gcp_identity_url:)
-        aud = gcp_audience(account, identity)
-        url = "#{gcp_identity_url}?#{URI.encode_www_form(audience: aud, format: 'full')}"
-
-        uri  = URI(url)
-        http = Net::HTTP.new(uri.host, uri.port, nil) # nil = no proxy
-        response = http.get(uri.request_uri, 'Metadata-Flavor' => 'Google')
-
-        unless response.is_a?(Net::HTTPSuccess)
-          raise "GCP metadata token request failed: #{response.code} #{response.message}. Body: #{response.body}"
-        end
-
-        token = response.body&.strip
-        raise "GCP metadata service returned an empty token" if token.nil? || token.empty?
-
-        token
-      end
-
-      # Builds the authn-gcp audience for a Conjur host identity, e.g.
-      # "conjur/myorg/host/data/app". The "host/" prefix is optional in the
-      # supplied identity and is normalized away before being re-applied.
-      def gcp_audience(account, identity)
-        normalized = identity.start_with?('host/') ? identity['host/'.length..] : identity
-        "conjur/#{account}/host/#{normalized}"
-      end
-    end
-
-    def init_from_gcp(identity,
-                      account: Conjur.configuration.account,
-                      jwt: nil,
-                      gcp_identity_url: GCPAuthenticator::DEFAULT_METADATA_URL,
-                      remote_ip: nil)
-      @remote_ip     = remote_ip
-      @authenticator = GCPAuthenticator.new(account, identity,
-                                             jwt: jwt, gcp_identity_url: gcp_identity_url)
-      self
-    end
-  end
-end