conjur-api 6.3.1 → 6.4.0.pre.849

data/lib/conjur/api/authn_azure.rb

@@ -0,0 +1,145 @@
+# frozen_string_literal: true
+
+require 'net/http'
+require 'json'
+require 'uri'
+require 'cgi'
+
+module Conjur
+  class API
+    # Authenticator that uses an Azure Managed Identity JWT to obtain Conjur access tokens.
+    # Fetches a JWT from the Azure Instance Metadata Service (IMDS), then POSTs it
+    # to the Conjur authn-azure endpoint.
+    class AzureAuthenticator
+      include TokenExpiration
+
+      IMDS_TOKEN_PATH    = '/metadata/identity/oauth2/token'.freeze
+      DEFAULT_RESOURCE   = 'https://management.azure.com/'.freeze
+      DEFAULT_IMDS_BASE  = 'http://169.254.169.254'.freeze
+      DEFAULT_IMDS_VER   = '2018-02-01'.freeze
+
+      attr_reader :account, :service_id, :identity, :resource_uri,
+                  :client_id, :imds_base_url, :imds_api_version
+
+      def initialize(account, service_id, identity,
+                     resource_uri: DEFAULT_RESOURCE,
+                     client_id: nil,
+                     imds_base_url: DEFAULT_IMDS_BASE,
+                     imds_api_version: DEFAULT_IMDS_VER)
+        @account          = account
+        @service_id       = service_id
+        @identity         = identity
+        @resource_uri     = resource_uri
+        @client_id        = client_id
+        @imds_base_url    = imds_base_url
+        @imds_api_version = imds_api_version
+        update_token_born
+      end
+
+      def refresh_token
+        Conjur::API.authenticate_azure(service_id, identity,
+                                       account: account,
+                                       resource_uri: resource_uri,
+                                       client_id: client_id,
+                                       imds_base_url: imds_base_url,
+                                       imds_api_version: imds_api_version).tap do
+          update_token_born
+        end
+      end
+    end
+
+    class << self
+      # Create a {Conjur::API} instance authenticated via Azure Managed Identity (authn-azure).
+      #
+      # @param [String] service_id the authn-azure service ID configured in Conjur
+      # @param [String] identity Conjur host identity (e.g. "host/my-app/azure-host")
+      # @param [String] account the Conjur organization account
+      # @param [String] resource_uri Azure resource URI for the IMDS token request
+      # @param [String, nil] client_id optional client ID for a user-assigned managed identity
+      # @param [String] imds_base_url override for the IMDS base URL (useful in tests)
+      # @param [String] imds_api_version override for the IMDS API version
+      # @param [String, nil] remote_ip optional IP address recorded in the audit log
+      # @return [Conjur::API]
+      def new_from_azure(service_id, identity,
+                         account: Conjur.configuration.account,
+                         resource_uri: AzureAuthenticator::DEFAULT_RESOURCE,
+                         client_id: nil,
+                         imds_base_url: AzureAuthenticator::DEFAULT_IMDS_BASE,
+                         imds_api_version: AzureAuthenticator::DEFAULT_IMDS_VER,
+                         remote_ip: nil)
+        self.new.init_from_azure(service_id, identity,
+                                 account: account,
+                                 resource_uri: resource_uri,
+                                 client_id: client_id,
+                                 imds_base_url: imds_base_url,
+                                 imds_api_version: imds_api_version,
+                                 remote_ip: remote_ip)
+      end
+
+      # Authenticate via authn-azure and return a parsed Conjur access token.
+      #
+      # @param [String] service_id the authn-azure service ID
+      # @param [String] identity Conjur host identity
+      # @param [String] account the Conjur organization account
+      # @return [Hash] parsed access token
+      def authenticate_azure(service_id, identity,
+                             account: Conjur.configuration.account,
+                             resource_uri: AzureAuthenticator::DEFAULT_RESOURCE,
+                             client_id: nil,
+                             imds_base_url: AzureAuthenticator::DEFAULT_IMDS_BASE,
+                             imds_api_version: AzureAuthenticator::DEFAULT_IMDS_VER)
+        raise ArgumentError, "service_id is required" if service_id.nil? || service_id.empty?
+        raise ArgumentError, "identity is required"   if identity.nil?  || identity.empty?
+
+        if Conjur.log
+          Conjur.log << "Authenticating #{identity} to account #{account} via authn-azure/#{service_id}\n"
+        end
+
+        jwt = fetch_azure_jwt(resource_uri: resource_uri, client_id: client_id,
+                              imds_base_url: imds_base_url, imds_api_version: imds_api_version)
+        JSON.parse(url_for(:authn_azure_authenticate, account, service_id, identity)
+          .post("jwt=#{CGI.escape(jwt)}", content_type: 'application/x-www-form-urlencoded'))
+      end
+
+      private
+
+      # Fetches an Azure Managed Identity JWT from IMDS.
+      # Uses a direct Net::HTTP connection (proxy addr = nil) because the IMDS
+      # link-local address 169.254.169.254 must never be routed through a proxy.
+      def fetch_azure_jwt(resource_uri:, client_id:, imds_base_url:, imds_api_version:)
+        query = "api-version=#{CGI.escape(imds_api_version)}&resource=#{CGI.escape(resource_uri)}"
+        query += "&client_id=#{CGI.escape(client_id)}" if client_id
+
+        uri = URI("#{imds_base_url}#{AzureAuthenticator::IMDS_TOKEN_PATH}?#{query}")
+        http = Net::HTTP.new(uri.host, uri.port, nil) # nil = no proxy
+        response = http.get(uri.request_uri, 'Metadata' => 'true')
+
+        unless response.is_a?(Net::HTTPSuccess)
+          raise "Azure IMDS token request failed: #{response.code} #{response.message}. Body: #{response.body}"
+        end
+
+        body = JSON.parse(response.body)
+        token = body['access_token']
+        raise "Azure IMDS returned an empty access token" if token.nil? || token.empty?
+
+        token
+      end
+    end
+
+    def init_from_azure(service_id, identity,
+                        account: Conjur.configuration.account,
+                        resource_uri: AzureAuthenticator::DEFAULT_RESOURCE,
+                        client_id: nil,
+                        imds_base_url: AzureAuthenticator::DEFAULT_IMDS_BASE,
+                        imds_api_version: AzureAuthenticator::DEFAULT_IMDS_VER,
+                        remote_ip: nil)
+      @remote_ip     = remote_ip
+      @authenticator = AzureAuthenticator.new(account, service_id, identity,
+                                               resource_uri: resource_uri,
+                                               client_id: client_id,
+                                               imds_base_url: imds_base_url,
+                                               imds_api_version: imds_api_version)
+      self
+    end
+  end
+end

data/lib/conjur/api/authn_gcp.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+require 'net/http'
+require 'uri'
+require 'cgi'
+require 'json'
+
+module Conjur
+  class API
+    # Authenticator that uses a GCP identity token to obtain Conjur access tokens.
+    # Fetches an identity JWT from the GCP Instance Metadata Service, then POSTs it
+    # to the Conjur authn-gcp endpoint.
+    #
+    # authn-gcp is a serviceless authenticator: there is no service ID, and Conjur
+    # identifies the calling host from the token's claims (matched against the
+    # host's authn-gcp/project-id annotation), so the host id is not sent in the
+    # authenticate URL.
+    #
+    # An explicit JWT may be supplied to bypass the metadata service fetch —
+    # useful in CI environments where the token is pre-fetched on a GCP agent.
+    class GCPAuthenticator
+      include TokenExpiration
+
+      DEFAULT_METADATA_URL = 'http://metadata.google.internal/computeMetadata/v1' \
+                             '/instance/service-accounts/default/identity'.freeze
+
+      attr_reader :account, :identity, :jwt, :gcp_identity_url
+
+      def initialize(account, identity, jwt: nil,
+                     gcp_identity_url: DEFAULT_METADATA_URL)
+        @account          = account
+        @identity         = identity
+        @jwt              = jwt
+        @gcp_identity_url = gcp_identity_url
+        update_token_born
+      end
+
+      def refresh_token
+        Conjur::API.authenticate_gcp(identity, account: account,
+                                               jwt: jwt,
+                                               gcp_identity_url: gcp_identity_url).tap do
+          update_token_born
+        end
+      end
+    end
+
+    class << self
+      # Create a {Conjur::API} instance authenticated via GCP workload identity (authn-gcp).
+      #
+      # @param [String] identity Conjur host identity (e.g. "host/data/test/gcp-apps/test-app").
+      #   Used to build the metadata-service audience; Conjur itself derives the
+      #   host from the token, so it is not sent in the authenticate request.
+      # @param [String] account the Conjur organization account
+      # @param [String, nil] jwt pre-obtained GCP identity token; when supplied the metadata
+      #   service is not called. Useful in tests and CI where the token is pre-fetched.
+      # @param [String] gcp_identity_url override for the GCP metadata identity URL (for tests)
+      # @param [String, nil] remote_ip optional IP address recorded in the audit log
+      # @return [Conjur::API]
+      def new_from_gcp(identity,
+                       account: Conjur.configuration.account,
+                       jwt: nil,
+                       gcp_identity_url: GCPAuthenticator::DEFAULT_METADATA_URL,
+                       remote_ip: nil)
+        self.new.init_from_gcp(identity, account: account,
+                                         jwt: jwt, gcp_identity_url: gcp_identity_url,
+                                         remote_ip: remote_ip)
+      end
+
+      # Authenticate via authn-gcp and return a parsed Conjur access token.
+      #
+      # @param [String] identity Conjur host identity (used to build the audience)
+      # @param [String] account the Conjur organization account
+      # @param [String, nil] jwt pre-obtained GCP identity token
+      # @param [String] gcp_identity_url override for the GCP metadata identity URL
+      # @return [Hash] parsed access token
+      def authenticate_gcp(identity,
+                           account: Conjur.configuration.account,
+                           jwt: nil,
+                           gcp_identity_url: GCPAuthenticator::DEFAULT_METADATA_URL)
+        raise ArgumentError, "identity is required" if identity.nil? || identity.empty?
+
+        if Conjur.log
+          Conjur.log << "Authenticating #{identity} to account #{account} via authn-gcp\n"
+        end
+
+        token = jwt || fetch_gcp_jwt(account, identity, gcp_identity_url: gcp_identity_url)
+        JSON.parse(url_for(:authn_gcp_authenticate, account)
+          .post("jwt=#{CGI.escape(token)}", content_type: 'application/x-www-form-urlencoded'))
+      end
+
+      private
+
+      # Fetches a GCP identity token from the instance metadata service.
+      # Uses a direct Net::HTTP connection (proxy addr = nil) because the metadata
+      # link-local address must never be routed through a proxy.
+      #
+      # The requested audience is "conjur/{account}/host/{identity}", matching what
+      # the authn-gcp authenticator expects.
+      def fetch_gcp_jwt(account, identity, gcp_identity_url:)
+        aud = gcp_audience(account, identity)
+        url = "#{gcp_identity_url}?#{URI.encode_www_form(audience: aud, format: 'full')}"
+
+        uri  = URI(url)
+        http = Net::HTTP.new(uri.host, uri.port, nil) # nil = no proxy
+        response = http.get(uri.request_uri, 'Metadata-Flavor' => 'Google')
+
+        unless response.is_a?(Net::HTTPSuccess)
+          raise "GCP metadata token request failed: #{response.code} #{response.message}. Body: #{response.body}"
+        end
+
+        token = response.body&.strip
+        raise "GCP metadata service returned an empty token" if token.nil? || token.empty?
+
+        token
+      end
+
+      # Builds the authn-gcp audience for a Conjur host identity, e.g.
+      # "conjur/myorg/host/data/app". The "host/" prefix is optional in the
+      # supplied identity and is normalized away before being re-applied.
+      def gcp_audience(account, identity)
+        normalized = identity.start_with?('host/') ? identity['host/'.length..] : identity
+        "conjur/#{account}/host/#{normalized}"
+      end
+    end
+
+    def init_from_gcp(identity,
+                      account: Conjur.configuration.account,
+                      jwt: nil,
+                      gcp_identity_url: GCPAuthenticator::DEFAULT_METADATA_URL,
+                      remote_ip: nil)
+      @remote_ip     = remote_ip
+      @authenticator = GCPAuthenticator.new(account, identity,
+                                             jwt: jwt, gcp_identity_url: gcp_identity_url)
+      self
+    end
+  end
+end

data/lib/conjur/api/authn_iam.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'uri'
+
+module Conjur
+  class API
+    # Authenticator that uses AWS IAM credentials to obtain Conjur access tokens.
+    # Signs an AWS STS GetCallerIdentity request with SigV4, then POSTs the
+    # resulting headers as JSON to the Conjur authn-iam endpoint.
+    #
+    # Requires the +aws-sdk-core+ gem (not bundled with conjur-api).
+    # Add `gem 'aws-sdk-core'` to your Gemfile to use this authenticator.
+    class IAMAuthenticator
+      include TokenExpiration
+
+      DEFAULT_SERVICE_ID = 'prod'.freeze
+      DEFAULT_REGION     = 'us-east-1'.freeze
+
+      STS_GLOBAL_URL  = 'https://sts.amazonaws.com/?Action=GetCallerIdentity&Version=2011-06-15'.freeze
+      STS_REGIONAL_URL = 'https://sts.%<region>s.amazonaws.com/?Action=GetCallerIdentity&Version=2011-06-15'.freeze
+      STS_GLOBAL_SIGNING_REGION = 'us-east-1'.freeze
+
+      attr_reader :account, :service_id, :identity, :aws_region
+
+      def initialize(account, service_id, identity, aws_region = DEFAULT_REGION)
+        @account    = account
+        @service_id = service_id
+        @identity   = identity
+        @aws_region = aws_region
+        update_token_born
+      end
+
+      def refresh_token
+        Conjur::API.authenticate_iam(identity, account: account,
+                                               service_id: service_id,
+                                               aws_region: aws_region).tap do
+          update_token_born
+        end
+      end
+    end
+
+    class << self
+      # Create a {Conjur::API} instance authenticated via AWS IAM (authn-iam).
+      #
+      # AWS credentials are resolved from the default chain: environment variables
+      # (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN), then
+      # ~/.aws/credentials, then the EC2 instance profile.
+      #
+      # Requires the +aws-sdk-core+ gem.
+      #
+      # @param [String] identity Conjur host identity (e.g. "host/my-app/my-role")
+      # @param [String] service_id the authn-iam service ID (default: "prod")
+      # @param [String] account the Conjur organization account
+      # @param [String] aws_region AWS region for STS signing. Use "global" for the
+      #   global STS endpoint (signed as us-east-1).
+      # @param [String, nil] remote_ip optional IP address recorded in the audit log
+      # @return [Conjur::API]
+      def new_from_iam(identity,
+                       account: Conjur.configuration.account,
+                       service_id: IAMAuthenticator::DEFAULT_SERVICE_ID,
+                       aws_region: IAMAuthenticator::DEFAULT_REGION,
+                       remote_ip: nil)
+        self.new.init_from_iam(identity, account: account, service_id: service_id,
+                                         aws_region: aws_region, remote_ip: remote_ip)
+      end
+
+      # Authenticate via authn-iam and return a parsed Conjur access token.
+      #
+      # @param [String] identity Conjur host identity
+      # @param [String] service_id the authn-iam service ID
+      # @param [String] account the Conjur organization account
+      # @param [String] aws_region AWS region for STS signing
+      # @return [Hash] parsed access token
+      def authenticate_iam(identity,
+                           account: Conjur.configuration.account,
+                           service_id: IAMAuthenticator::DEFAULT_SERVICE_ID,
+                           aws_region: IAMAuthenticator::DEFAULT_REGION)
+        raise ArgumentError, "identity is required"   if identity.nil?   || identity.empty?
+        raise ArgumentError, "service_id is required" if service_id.nil? || service_id.empty?
+
+        begin
+          require 'aws-sdk-core'
+        rescue LoadError
+          raise LoadError,
+                "aws-sdk-core is required for IAM authentication. " \
+                "Add `gem 'aws-sdk-core'` to your Gemfile."
+        end
+
+        if Conjur.log
+          Conjur.log << "Authenticating #{identity} to account #{account} via authn-iam/#{service_id}\n"
+        end
+
+        signed_headers = build_iam_signed_headers(aws_region)
+        JSON.parse(url_for(:authn_iam_authenticate, account, service_id, identity)
+          .post(signed_headers.to_json, content_type: 'application/json'))
+      end
+
+      private
+
+      def build_iam_signed_headers(aws_region)
+        signing_region = aws_region == 'global' ? IAMAuthenticator::STS_GLOBAL_SIGNING_REGION : aws_region
+        sts_url = aws_region == 'global' || aws_region == IAMAuthenticator::STS_GLOBAL_SIGNING_REGION \
+          ? IAMAuthenticator::STS_GLOBAL_URL
+          : format(IAMAuthenticator::STS_REGIONAL_URL, region: aws_region)
+
+        provider = Aws::CredentialProviderChain.new.resolve
+        raise ArgumentError,
+              "No AWS credentials found. Configure an instance profile, " \
+              "environment variables (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY), " \
+              "or ~/.aws/credentials." unless provider
+
+        creds = provider.credentials
+        signer = Aws::Sigv4::Signer.new(
+          service:           'sts',
+          region:            signing_region,
+          access_key_id:     creds.access_key_id,
+          secret_access_key: creds.secret_access_key,
+          session_token:     creds.session_token
+        )
+
+        signed = signer.sign_request(http_method: 'GET', url: sts_url, headers: {}, body: '')
+        headers = signed.headers.dup
+        # Conjur expects these specific keys
+        headers['host'] = URI.parse(sts_url).host
+        headers.compact
+      end
+    end
+
+    def init_from_iam(identity,
+                      account: Conjur.configuration.account,
+                      service_id: IAMAuthenticator::DEFAULT_SERVICE_ID,
+                      aws_region: IAMAuthenticator::DEFAULT_REGION,
+                      remote_ip: nil)
+      @remote_ip     = remote_ip
+      @authenticator = IAMAuthenticator.new(account, service_id, identity, aws_region)
+      self
+    end
+  end
+end

data/lib/conjur/api/router.rb

@@ -42,6 +42,33 @@ module Conjur
         )[fully_escape account][fully_escape username]['authenticate']
       end
 
+      # POST /authn-azure/{service_id}/{account}/{login}/authenticate
+      def authn_azure_authenticate account, service_id, identity
+        RestClient::Resource.new(
+          Conjur.configuration.core_url,
+          Conjur.configuration.rest_client_options
+        )['authn-azure'][fully_escape service_id][fully_escape account][fully_escape identity]['authenticate']
+      end
+
+      # POST /authn-iam/{service_id}/{account}/{login}/authenticate
+      def authn_iam_authenticate account, service_id, identity
+        RestClient::Resource.new(
+          Conjur.configuration.core_url,
+          Conjur.configuration.rest_client_options
+        )['authn-iam'][fully_escape service_id][fully_escape account][fully_escape identity]['authenticate']
+      end
+
+      # POST /authn-gcp/{account}/authenticate
+      # authn-gcp is a serviceless authenticator: Conjur derives the host from
+      # the GCP identity token's claims, so neither a service id nor the login
+      # appears in the path.
+      def authn_gcp_authenticate account
+        RestClient::Resource.new(
+          Conjur.configuration.core_url,
+          Conjur.configuration.rest_client_options
+        )['authn-gcp'][fully_escape account]['authenticate']
+      end
+
       # Builds the RestClient::Resource for an authn-cert authentication request.
       # cert_options must include :ssl_client_cert and :ssl_client_key so that
       # the client certificate is presented during the TLS handshake.
@@ -62,10 +89,14 @@ module Conjur
       end
 
       def authenticator account, authenticator, service_id, credentials
-        RestClient::Resource.new(
+        resource = RestClient::Resource.new(
           Conjur.configuration.core_url,
           Conjur.configuration.create_rest_client_options(credentials)
-        )[fully_escape authenticator][fully_escape service_id][fully_escape account]
+        )[fully_escape authenticator]
+        # Serviceless authenticators (e.g. authn-gcp) have no service id segment:
+        # the path is authn-<type>/<account>.
+        resource = resource[fully_escape service_id] unless service_id.nil? || service_id.empty?
+        resource[fully_escape account]
       end
 
       def authenticators

data/lib/conjur/api.rb

@@ -36,6 +36,9 @@ require 'conjur/log_source'
 require 'conjur/has_attributes'
 require 'conjur/api/authenticators'
 require 'conjur/api/authn'
+require 'conjur/api/authn_azure'
+require 'conjur/api/authn_iam'
+require 'conjur/api/authn_gcp'
 require 'conjur/api/authn_cert'
 require 'conjur/api/roles'
 require 'conjur/api/resources'

data/secrets.yml

@@ -0,0 +1,13 @@
+# Summon secrets for CI. `summon -e <env> ./test.sh` resolves the !var
+# references below from the CI Conjur vault and exports them into the
+# environment for the wrapped command.
+#
+# The azure environment supplies the values the authn-azure integration
+# feature needs (see features/authn_azure.feature and features/README.md).
+# Mirrors the layout used by conjur-api-java / conjur-api-dotnet.
+azure:
+  RUN_AZURE_TESTS: "true"
+  AZURE_SUBSCRIPTION_ID: !var ci/azure/subscription-id
+  AZURE_RESOURCE_GROUP: !var ci/azure/authn-test/resource-group
+  USER_ASSIGNED_IDENTITY: !var ci/azure/authn-test/user-assigned-id
+  USER_ASSIGNED_IDENTITY_CLIENT_ID: !var ci/azure/authn-test/user-assigned-id-client-id

data/spec/authn_azure_spec.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'cgi'
+require 'conjur/api/router'
+
+describe Conjur::API, api: :dummy do
+  let(:service_id) { 'my-azure-service' }
+  let(:identity)   { 'host/my-app/azure-host' }
+  let(:azure_jwt)  { 'eyJhbGciOiJSUzI1NiJ9.azure-payload.sig' }
+  let(:raw_token)  { { 'protected' => 'p', 'payload' => 'pl', 'signature' => 's' } }
+
+  describe '.new_from_azure' do
+    it 'returns an API instance with an AzureAuthenticator' do
+      allow(Conjur::API).to receive(:authenticate_azure).and_return(raw_token)
+      api_instance = Conjur::API.new_from_azure(service_id, identity, account: account)
+      expect(api_instance).to be_a(Conjur::API)
+      expect(api_instance.authenticator).to be_a(Conjur::API::AzureAuthenticator)
+    end
+  end
+
+  describe '.authenticate_azure' do
+    let(:resource) { double('resource') }
+
+    before do
+      allow(Conjur::API).to receive(:url_for)
+        .with(:authn_azure_authenticate, account, service_id, identity)
+        .and_return(resource)
+      allow(resource).to receive(:post)
+        .with("jwt=#{CGI.escape(azure_jwt)}", content_type: 'application/x-www-form-urlencoded')
+        .and_return(raw_token.to_json)
+      allow(Conjur::API).to receive(:fetch_azure_jwt).and_return(azure_jwt)
+    end
+
+    it 'returns a parsed token' do
+      token = Conjur::API.authenticate_azure(service_id, identity, account: account)
+      expect(token).to eq(raw_token)
+    end
+
+    it 'raises ArgumentError when service_id is empty' do
+      expect { Conjur::API.authenticate_azure('', identity, account: account) }
+        .to raise_error(ArgumentError, /service_id is required/)
+    end
+
+    it 'raises ArgumentError when identity is empty' do
+      expect { Conjur::API.authenticate_azure(service_id, '', account: account) }
+        .to raise_error(ArgumentError, /identity is required/)
+    end
+  end
+
+  describe 'AzureAuthenticator#refresh_token' do
+    subject(:authenticator) do
+      Conjur::API::AzureAuthenticator.new(account, service_id, identity)
+    end
+
+    it 'delegates to authenticate_azure with stored credentials' do
+      expect(Conjur::API).to receive(:authenticate_azure)
+        .with(service_id, identity,
+              account: account,
+              resource_uri: Conjur::API::AzureAuthenticator::DEFAULT_RESOURCE,
+              client_id: nil,
+              imds_base_url: Conjur::API::AzureAuthenticator::DEFAULT_IMDS_BASE,
+              imds_api_version: Conjur::API::AzureAuthenticator::DEFAULT_IMDS_VER)
+        .and_return(raw_token)
+      expect(authenticator.refresh_token).to eq(raw_token)
+    end
+  end
+end
+
+describe Conjur::API::Router do
+  let(:account)    { 'myaccount' }
+  let(:service_id) { 'my-service' }
+  let(:identity)   { 'host/my-app/azure-host' }
+
+  before do
+    allow(Conjur.configuration).to receive(:core_url).and_return('https://conjur.example.com')
+    allow(Conjur.configuration).to receive(:rest_client_options).and_return({})
+  end
+
+  describe '#authn_azure_authenticate' do
+    subject { described_class.authn_azure_authenticate(account, service_id, identity) }
+
+    it 'returns a RestClient::Resource' do
+      expect(subject).to be_a(RestClient::Resource)
+    end
+
+    it 'builds the correct URL' do
+      expect(subject.url).to end_with('/authn-azure/my-service/myaccount/host%2Fmy-app%2Fazure-host/authenticate')
+    end
+  end
+end