conjur-api 6.3.1.pre.848 → 6.3.1

data/lib/conjur/api/authn_iam.rb

@@ -1,140 +0,0 @@
-# frozen_string_literal: true
-
-require 'json'
-require 'uri'
-
-module Conjur
-  class API
-    # Authenticator that uses AWS IAM credentials to obtain Conjur access tokens.
-    # Signs an AWS STS GetCallerIdentity request with SigV4, then POSTs the
-    # resulting headers as JSON to the Conjur authn-iam endpoint.
-    #
-    # Requires the +aws-sdk-core+ gem (not bundled with conjur-api).
-    # Add `gem 'aws-sdk-core'` to your Gemfile to use this authenticator.
-    class IAMAuthenticator
-      include TokenExpiration
-
-      DEFAULT_SERVICE_ID = 'prod'.freeze
-      DEFAULT_REGION     = 'us-east-1'.freeze
-
-      STS_GLOBAL_URL  = 'https://sts.amazonaws.com/?Action=GetCallerIdentity&Version=2011-06-15'.freeze
-      STS_REGIONAL_URL = 'https://sts.%<region>s.amazonaws.com/?Action=GetCallerIdentity&Version=2011-06-15'.freeze
-      STS_GLOBAL_SIGNING_REGION = 'us-east-1'.freeze
-
-      attr_reader :account, :service_id, :identity, :aws_region
-
-      def initialize(account, service_id, identity, aws_region = DEFAULT_REGION)
-        @account    = account
-        @service_id = service_id
-        @identity   = identity
-        @aws_region = aws_region
-        update_token_born
-      end
-
-      def refresh_token
-        Conjur::API.authenticate_iam(identity, account: account,
-                                               service_id: service_id,
-                                               aws_region: aws_region).tap do
-          update_token_born
-        end
-      end
-    end
-
-    class << self
-      # Create a {Conjur::API} instance authenticated via AWS IAM (authn-iam).
-      #
-      # AWS credentials are resolved from the default chain: environment variables
-      # (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN), then
-      # ~/.aws/credentials, then the EC2 instance profile.
-      #
-      # Requires the +aws-sdk-core+ gem.
-      #
-      # @param [String] identity Conjur host identity (e.g. "host/my-app/my-role")
-      # @param [String] service_id the authn-iam service ID (default: "prod")
-      # @param [String] account the Conjur organization account
-      # @param [String] aws_region AWS region for STS signing. Use "global" for the
-      #   global STS endpoint (signed as us-east-1).
-      # @param [String, nil] remote_ip optional IP address recorded in the audit log
-      # @return [Conjur::API]
-      def new_from_iam(identity,
-                       account: Conjur.configuration.account,
-                       service_id: IAMAuthenticator::DEFAULT_SERVICE_ID,
-                       aws_region: IAMAuthenticator::DEFAULT_REGION,
-                       remote_ip: nil)
-        self.new.init_from_iam(identity, account: account, service_id: service_id,
-                                         aws_region: aws_region, remote_ip: remote_ip)
-      end
-
-      # Authenticate via authn-iam and return a parsed Conjur access token.
-      #
-      # @param [String] identity Conjur host identity
-      # @param [String] service_id the authn-iam service ID
-      # @param [String] account the Conjur organization account
-      # @param [String] aws_region AWS region for STS signing
-      # @return [Hash] parsed access token
-      def authenticate_iam(identity,
-                           account: Conjur.configuration.account,
-                           service_id: IAMAuthenticator::DEFAULT_SERVICE_ID,
-                           aws_region: IAMAuthenticator::DEFAULT_REGION)
-        raise ArgumentError, "identity is required"   if identity.nil?   || identity.empty?
-        raise ArgumentError, "service_id is required" if service_id.nil? || service_id.empty?
-
-        begin
-          require 'aws-sdk-core'
-        rescue LoadError
-          raise LoadError,
-                "aws-sdk-core is required for IAM authentication. " \
-                "Add `gem 'aws-sdk-core'` to your Gemfile."
-        end
-
-        if Conjur.log
-          Conjur.log << "Authenticating #{identity} to account #{account} via authn-iam/#{service_id}\n"
-        end
-
-        signed_headers = build_iam_signed_headers(aws_region)
-        JSON.parse(url_for(:authn_iam_authenticate, account, service_id, identity)
-          .post(signed_headers.to_json, content_type: 'application/json'))
-      end
-
-      private
-
-      def build_iam_signed_headers(aws_region)
-        signing_region = aws_region == 'global' ? IAMAuthenticator::STS_GLOBAL_SIGNING_REGION : aws_region
-        sts_url = aws_region == 'global' || aws_region == IAMAuthenticator::STS_GLOBAL_SIGNING_REGION \
-          ? IAMAuthenticator::STS_GLOBAL_URL
-          : format(IAMAuthenticator::STS_REGIONAL_URL, region: aws_region)
-
-        provider = Aws::CredentialProviderChain.new.resolve
-        raise ArgumentError,
-              "No AWS credentials found. Configure an instance profile, " \
-              "environment variables (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY), " \
-              "or ~/.aws/credentials." unless provider
-
-        creds = provider.credentials
-        signer = Aws::Sigv4::Signer.new(
-          service:           'sts',
-          region:            signing_region,
-          access_key_id:     creds.access_key_id,
-          secret_access_key: creds.secret_access_key,
-          session_token:     creds.session_token
-        )
-
-        signed = signer.sign_request(http_method: 'GET', url: sts_url, headers: {}, body: '')
-        headers = signed.headers.dup
-        # Conjur expects these specific keys
-        headers['host'] = URI.parse(sts_url).host
-        headers.compact
-      end
-    end
-
-    def init_from_iam(identity,
-                      account: Conjur.configuration.account,
-                      service_id: IAMAuthenticator::DEFAULT_SERVICE_ID,
-                      aws_region: IAMAuthenticator::DEFAULT_REGION,
-                      remote_ip: nil)
-      @remote_ip     = remote_ip
-      @authenticator = IAMAuthenticator.new(account, service_id, identity, aws_region)
-      self
-    end
-  end
-end

data/secrets.yml

@@ -1,13 +0,0 @@
-# Summon secrets for CI. `summon -e <env> ./test.sh` resolves the !var
-# references below from the CI Conjur vault and exports them into the
-# environment for the wrapped command.
-#
-# The azure environment supplies the values the authn-azure integration
-# feature needs (see features/authn_azure.feature and features/README.md).
-# Mirrors the layout used by conjur-api-java / conjur-api-dotnet.
-azure:
-  RUN_AZURE_TESTS: "true"
-  AZURE_SUBSCRIPTION_ID: !var ci/azure/subscription-id
-  AZURE_RESOURCE_GROUP: !var ci/azure/authn-test/resource-group
-  USER_ASSIGNED_IDENTITY: !var ci/azure/authn-test/user-assigned-id
-  USER_ASSIGNED_IDENTITY_CLIENT_ID: !var ci/azure/authn-test/user-assigned-id-client-id

data/spec/authn_azure_spec.rb

@@ -1,91 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-require 'cgi'
-require 'conjur/api/router'
-
-describe Conjur::API, api: :dummy do
-  let(:service_id) { 'my-azure-service' }
-  let(:identity)   { 'host/my-app/azure-host' }
-  let(:azure_jwt)  { 'eyJhbGciOiJSUzI1NiJ9.azure-payload.sig' }
-  let(:raw_token)  { { 'protected' => 'p', 'payload' => 'pl', 'signature' => 's' } }
-
-  describe '.new_from_azure' do
-    it 'returns an API instance with an AzureAuthenticator' do
-      allow(Conjur::API).to receive(:authenticate_azure).and_return(raw_token)
-      api_instance = Conjur::API.new_from_azure(service_id, identity, account: account)
-      expect(api_instance).to be_a(Conjur::API)
-      expect(api_instance.authenticator).to be_a(Conjur::API::AzureAuthenticator)
-    end
-  end
-
-  describe '.authenticate_azure' do
-    let(:resource) { double('resource') }
-
-    before do
-      allow(Conjur::API).to receive(:url_for)
-        .with(:authn_azure_authenticate, account, service_id, identity)
-        .and_return(resource)
-      allow(resource).to receive(:post)
-        .with("jwt=#{CGI.escape(azure_jwt)}", content_type: 'application/x-www-form-urlencoded')
-        .and_return(raw_token.to_json)
-      allow(Conjur::API).to receive(:fetch_azure_jwt).and_return(azure_jwt)
-    end
-
-    it 'returns a parsed token' do
-      token = Conjur::API.authenticate_azure(service_id, identity, account: account)
-      expect(token).to eq(raw_token)
-    end
-
-    it 'raises ArgumentError when service_id is empty' do
-      expect { Conjur::API.authenticate_azure('', identity, account: account) }
-        .to raise_error(ArgumentError, /service_id is required/)
-    end
-
-    it 'raises ArgumentError when identity is empty' do
-      expect { Conjur::API.authenticate_azure(service_id, '', account: account) }
-        .to raise_error(ArgumentError, /identity is required/)
-    end
-  end
-
-  describe 'AzureAuthenticator#refresh_token' do
-    subject(:authenticator) do
-      Conjur::API::AzureAuthenticator.new(account, service_id, identity)
-    end
-
-    it 'delegates to authenticate_azure with stored credentials' do
-      expect(Conjur::API).to receive(:authenticate_azure)
-        .with(service_id, identity,
-              account: account,
-              resource_uri: Conjur::API::AzureAuthenticator::DEFAULT_RESOURCE,
-              client_id: nil,
-              imds_base_url: Conjur::API::AzureAuthenticator::DEFAULT_IMDS_BASE,
-              imds_api_version: Conjur::API::AzureAuthenticator::DEFAULT_IMDS_VER)
-        .and_return(raw_token)
-      expect(authenticator.refresh_token).to eq(raw_token)
-    end
-  end
-end
-
-describe Conjur::API::Router do
-  let(:account)    { 'myaccount' }
-  let(:service_id) { 'my-service' }
-  let(:identity)   { 'host/my-app/azure-host' }
-
-  before do
-    allow(Conjur.configuration).to receive(:core_url).and_return('https://conjur.example.com')
-    allow(Conjur.configuration).to receive(:rest_client_options).and_return({})
-  end
-
-  describe '#authn_azure_authenticate' do
-    subject { described_class.authn_azure_authenticate(account, service_id, identity) }
-
-    it 'returns a RestClient::Resource' do
-      expect(subject).to be_a(RestClient::Resource)
-    end
-
-    it 'builds the correct URL' do
-      expect(subject.url).to end_with('/authn-azure/my-service/myaccount/host%2Fmy-app%2Fazure-host/authenticate')
-    end
-  end
-end

data/spec/authn_gcp_spec.rb

@@ -1,121 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-require 'cgi'
-require 'conjur/api/router'
-
-describe Conjur::API, api: :dummy do
-  let(:identity)   { 'host/data/test/gcp-apps/test-app' }
-  let(:gcp_jwt)    { 'eyJhbGciOiJSUzI1NiJ9.gcp-payload.sig' }
-  let(:raw_token)  { { 'protected' => 'p', 'payload' => 'pl', 'signature' => 's' } }
-
-  describe '.new_from_gcp' do
-    it 'returns an API instance with a GCPAuthenticator' do
-      allow(Conjur::API).to receive(:authenticate_gcp).and_return(raw_token)
-      api_instance = Conjur::API.new_from_gcp(identity, account: account)
-      expect(api_instance).to be_a(Conjur::API)
-      expect(api_instance.authenticator).to be_a(Conjur::API::GCPAuthenticator)
-    end
-  end
-
-  describe '.authenticate_gcp' do
-    let(:resource) { double('resource') }
-
-    before do
-      allow(Conjur::API).to receive(:url_for)
-        .with(:authn_gcp_authenticate, account)
-        .and_return(resource)
-      allow(resource).to receive(:post)
-        .with("jwt=#{CGI.escape(gcp_jwt)}", content_type: 'application/x-www-form-urlencoded')
-        .and_return(raw_token.to_json)
-    end
-
-    context 'with a pre-supplied JWT' do
-      it 'returns a parsed token without calling the metadata service' do
-        expect(Conjur::API).not_to receive(:fetch_gcp_jwt)
-        token = Conjur::API.authenticate_gcp(identity, account: account, jwt: gcp_jwt)
-        expect(token).to eq(raw_token)
-      end
-    end
-
-    context 'without a pre-supplied JWT' do
-      it 'fetches from the metadata service' do
-        allow(Conjur::API).to receive(:fetch_gcp_jwt).and_return(gcp_jwt)
-        token = Conjur::API.authenticate_gcp(identity, account: account)
-        expect(token).to eq(raw_token)
-      end
-    end
-
-    it 'raises ArgumentError when identity is empty' do
-      expect { Conjur::API.authenticate_gcp('', account: account) }
-        .to raise_error(ArgumentError, /identity is required/)
-    end
-  end
-
-  describe 'GCPAuthenticator#refresh_token' do
-    context 'with a pre-supplied JWT' do
-      subject(:authenticator) do
-        Conjur::API::GCPAuthenticator.new(account, identity, jwt: gcp_jwt)
-      end
-
-      it 'passes the stored JWT to authenticate_gcp' do
-        expect(Conjur::API).to receive(:authenticate_gcp)
-          .with(identity,
-                account: account,
-                jwt: gcp_jwt,
-                gcp_identity_url: Conjur::API::GCPAuthenticator::DEFAULT_METADATA_URL)
-          .and_return(raw_token)
-        expect(authenticator.refresh_token).to eq(raw_token)
-      end
-    end
-
-    context 'without a pre-supplied JWT' do
-      subject(:authenticator) do
-        Conjur::API::GCPAuthenticator.new(account, identity)
-      end
-
-      it 'passes nil jwt to authenticate_gcp (which then calls metadata service)' do
-        expect(Conjur::API).to receive(:authenticate_gcp)
-          .with(identity,
-                account: account,
-                jwt: nil,
-                gcp_identity_url: Conjur::API::GCPAuthenticator::DEFAULT_METADATA_URL)
-          .and_return(raw_token)
-        expect(authenticator.refresh_token).to eq(raw_token)
-      end
-    end
-  end
-
-  describe '.gcp_audience' do
-    it 'strips a leading host/ and rebuilds the conjur audience' do
-      expect(Conjur::API.send(:gcp_audience, account, 'host/data/app'))
-        .to eq("conjur/#{account}/host/data/app")
-    end
-
-    it 'assumes a host identity when the host/ prefix is absent' do
-      expect(Conjur::API.send(:gcp_audience, account, 'data/app'))
-        .to eq("conjur/#{account}/host/data/app")
-    end
-  end
-end
-
-describe Conjur::API::Router do
-  let(:account)    { 'myaccount' }
-
-  before do
-    allow(Conjur.configuration).to receive(:core_url).and_return('https://conjur.example.com')
-    allow(Conjur.configuration).to receive(:rest_client_options).and_return({})
-  end
-
-  describe '#authn_gcp_authenticate' do
-    subject { described_class.authn_gcp_authenticate(account) }
-
-    it 'returns a RestClient::Resource' do
-      expect(subject).to be_a(RestClient::Resource)
-    end
-
-    it 'builds the correct URL using the serviceless authn-gcp path' do
-      expect(subject.url).to end_with('/authn-gcp/myaccount/authenticate')
-    end
-  end
-end

data/spec/authn_iam_spec.rb

@@ -1,103 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-require 'conjur/api/router'
-
-describe Conjur::API, api: :dummy do
-  let(:service_id) { 'prod' }
-  let(:identity)   { 'host/my-app/my-role' }
-  let(:raw_token)  { { 'protected' => 'p', 'payload' => 'pl', 'signature' => 's' } }
-  let(:signed_headers) do
-    {
-      'Authorization'        => 'AWS4-HMAC-SHA256 Credential=AKIAEXAMPLE/...',
-      'x-amz-date'           => '20240101T000000Z',
-      'x-amz-content-sha256' => 'e3b0c44298fc1c149afbf4c8996fb924',
-      'x-amz-security-token' => 'token',
-      'host'                 => 'sts.amazonaws.com'
-    }
-  end
-
-  describe '.new_from_iam' do
-    it 'returns an API instance with an IAMAuthenticator' do
-      allow(Conjur::API).to receive(:authenticate_iam).and_return(raw_token)
-      api_instance = Conjur::API.new_from_iam(identity, account: account)
-      expect(api_instance).to be_a(Conjur::API)
-      expect(api_instance.authenticator).to be_a(Conjur::API::IAMAuthenticator)
-    end
-  end
-
-  describe '.authenticate_iam' do
-    let(:resource) { double('resource') }
-
-    before do
-      allow(Conjur::API).to receive(:require).with('aws-sdk-core')
-      allow(Conjur::API).to receive(:url_for)
-        .with(:authn_iam_authenticate, account, service_id, identity)
-        .and_return(resource)
-      allow(resource).to receive(:post)
-        .with(signed_headers.to_json, content_type: 'application/json')
-        .and_return(raw_token.to_json)
-      allow(Conjur::API).to receive(:build_iam_signed_headers).and_return(signed_headers)
-    end
-
-    it 'returns a parsed token' do
-      token = Conjur::API.authenticate_iam(identity, account: account, service_id: service_id)
-      expect(token).to eq(raw_token)
-    end
-
-    it 'raises ArgumentError when identity is empty' do
-      expect { Conjur::API.authenticate_iam('', account: account) }
-        .to raise_error(ArgumentError, /identity is required/)
-    end
-
-    it 'raises ArgumentError when service_id is empty' do
-      expect { Conjur::API.authenticate_iam(identity, account: account, service_id: '') }
-        .to raise_error(ArgumentError, /service_id is required/)
-    end
-
-    it 'raises LoadError when aws-sdk-core is unavailable' do
-      allow(Conjur::API).to receive(:require).with('aws-sdk-core').and_raise(LoadError)
-      expect { Conjur::API.authenticate_iam(identity, account: account) }
-        .to raise_error(LoadError, /aws-sdk-core/)
-    end
-  end
-
-  describe 'IAMAuthenticator#refresh_token' do
-    subject(:authenticator) do
-      Conjur::API::IAMAuthenticator.new(account, service_id, identity)
-    end
-
-    it 'delegates to authenticate_iam with stored credentials' do
-      expect(Conjur::API).to receive(:authenticate_iam)
-        .with(identity,
-              account: account,
-              service_id: service_id,
-              aws_region: Conjur::API::IAMAuthenticator::DEFAULT_REGION)
-        .and_return(raw_token)
-      expect(authenticator.refresh_token).to eq(raw_token)
-    end
-  end
-end
-
-describe Conjur::API::Router do
-  let(:account)    { 'myaccount' }
-  let(:service_id) { 'prod' }
-  let(:identity)   { 'host/my-app/my-role' }
-
-  before do
-    allow(Conjur.configuration).to receive(:core_url).and_return('https://conjur.example.com')
-    allow(Conjur.configuration).to receive(:rest_client_options).and_return({})
-  end
-
-  describe '#authn_iam_authenticate' do
-    subject { described_class.authn_iam_authenticate(account, service_id, identity) }
-
-    it 'returns a RestClient::Resource' do
-      expect(subject).to be_a(RestClient::Resource)
-    end
-
-    it 'builds the correct URL' do
-      expect(subject.url).to end_with('/authn-iam/prod/myaccount/host%2Fmy-app%2Fmy-role/authenticate')
-    end
-  end
-end