conjur-api 6.3.1 → 6.4.0.pre.849

data/spec/authn_gcp_spec.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'cgi'
+require 'conjur/api/router'
+
+describe Conjur::API, api: :dummy do
+  let(:identity)   { 'host/data/test/gcp-apps/test-app' }
+  let(:gcp_jwt)    { 'eyJhbGciOiJSUzI1NiJ9.gcp-payload.sig' }
+  let(:raw_token)  { { 'protected' => 'p', 'payload' => 'pl', 'signature' => 's' } }
+
+  describe '.new_from_gcp' do
+    it 'returns an API instance with a GCPAuthenticator' do
+      allow(Conjur::API).to receive(:authenticate_gcp).and_return(raw_token)
+      api_instance = Conjur::API.new_from_gcp(identity, account: account)
+      expect(api_instance).to be_a(Conjur::API)
+      expect(api_instance.authenticator).to be_a(Conjur::API::GCPAuthenticator)
+    end
+  end
+
+  describe '.authenticate_gcp' do
+    let(:resource) { double('resource') }
+
+    before do
+      allow(Conjur::API).to receive(:url_for)
+        .with(:authn_gcp_authenticate, account)
+        .and_return(resource)
+      allow(resource).to receive(:post)
+        .with("jwt=#{CGI.escape(gcp_jwt)}", content_type: 'application/x-www-form-urlencoded')
+        .and_return(raw_token.to_json)
+    end
+
+    context 'with a pre-supplied JWT' do
+      it 'returns a parsed token without calling the metadata service' do
+        expect(Conjur::API).not_to receive(:fetch_gcp_jwt)
+        token = Conjur::API.authenticate_gcp(identity, account: account, jwt: gcp_jwt)
+        expect(token).to eq(raw_token)
+      end
+    end
+
+    context 'without a pre-supplied JWT' do
+      it 'fetches from the metadata service' do
+        allow(Conjur::API).to receive(:fetch_gcp_jwt).and_return(gcp_jwt)
+        token = Conjur::API.authenticate_gcp(identity, account: account)
+        expect(token).to eq(raw_token)
+      end
+    end
+
+    it 'raises ArgumentError when identity is empty' do
+      expect { Conjur::API.authenticate_gcp('', account: account) }
+        .to raise_error(ArgumentError, /identity is required/)
+    end
+  end
+
+  describe 'GCPAuthenticator#refresh_token' do
+    context 'with a pre-supplied JWT' do
+      subject(:authenticator) do
+        Conjur::API::GCPAuthenticator.new(account, identity, jwt: gcp_jwt)
+      end
+
+      it 'passes the stored JWT to authenticate_gcp' do
+        expect(Conjur::API).to receive(:authenticate_gcp)
+          .with(identity,
+                account: account,
+                jwt: gcp_jwt,
+                gcp_identity_url: Conjur::API::GCPAuthenticator::DEFAULT_METADATA_URL)
+          .and_return(raw_token)
+        expect(authenticator.refresh_token).to eq(raw_token)
+      end
+    end
+
+    context 'without a pre-supplied JWT' do
+      subject(:authenticator) do
+        Conjur::API::GCPAuthenticator.new(account, identity)
+      end
+
+      it 'passes nil jwt to authenticate_gcp (which then calls metadata service)' do
+        expect(Conjur::API).to receive(:authenticate_gcp)
+          .with(identity,
+                account: account,
+                jwt: nil,
+                gcp_identity_url: Conjur::API::GCPAuthenticator::DEFAULT_METADATA_URL)
+          .and_return(raw_token)
+        expect(authenticator.refresh_token).to eq(raw_token)
+      end
+    end
+  end
+
+  describe '.gcp_audience' do
+    it 'strips a leading host/ and rebuilds the conjur audience' do
+      expect(Conjur::API.send(:gcp_audience, account, 'host/data/app'))
+        .to eq("conjur/#{account}/host/data/app")
+    end
+
+    it 'assumes a host identity when the host/ prefix is absent' do
+      expect(Conjur::API.send(:gcp_audience, account, 'data/app'))
+        .to eq("conjur/#{account}/host/data/app")
+    end
+  end
+end
+
+describe Conjur::API::Router do
+  let(:account)    { 'myaccount' }
+
+  before do
+    allow(Conjur.configuration).to receive(:core_url).and_return('https://conjur.example.com')
+    allow(Conjur.configuration).to receive(:rest_client_options).and_return({})
+  end
+
+  describe '#authn_gcp_authenticate' do
+    subject { described_class.authn_gcp_authenticate(account) }
+
+    it 'returns a RestClient::Resource' do
+      expect(subject).to be_a(RestClient::Resource)
+    end
+
+    it 'builds the correct URL using the serviceless authn-gcp path' do
+      expect(subject.url).to end_with('/authn-gcp/myaccount/authenticate')
+    end
+  end
+end

data/spec/authn_iam_spec.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'conjur/api/router'
+
+describe Conjur::API, api: :dummy do
+  let(:service_id) { 'prod' }
+  let(:identity)   { 'host/my-app/my-role' }
+  let(:raw_token)  { { 'protected' => 'p', 'payload' => 'pl', 'signature' => 's' } }
+  let(:signed_headers) do
+    {
+      'Authorization'        => 'AWS4-HMAC-SHA256 Credential=AKIAEXAMPLE/...',
+      'x-amz-date'           => '20240101T000000Z',
+      'x-amz-content-sha256' => 'e3b0c44298fc1c149afbf4c8996fb924',
+      'x-amz-security-token' => 'token',
+      'host'                 => 'sts.amazonaws.com'
+    }
+  end
+
+  describe '.new_from_iam' do
+    it 'returns an API instance with an IAMAuthenticator' do
+      allow(Conjur::API).to receive(:authenticate_iam).and_return(raw_token)
+      api_instance = Conjur::API.new_from_iam(identity, account: account)
+      expect(api_instance).to be_a(Conjur::API)
+      expect(api_instance.authenticator).to be_a(Conjur::API::IAMAuthenticator)
+    end
+  end
+
+  describe '.authenticate_iam' do
+    let(:resource) { double('resource') }
+
+    before do
+      allow(Conjur::API).to receive(:require).with('aws-sdk-core')
+      allow(Conjur::API).to receive(:url_for)
+        .with(:authn_iam_authenticate, account, service_id, identity)
+        .and_return(resource)
+      allow(resource).to receive(:post)
+        .with(signed_headers.to_json, content_type: 'application/json')
+        .and_return(raw_token.to_json)
+      allow(Conjur::API).to receive(:build_iam_signed_headers).and_return(signed_headers)
+    end
+
+    it 'returns a parsed token' do
+      token = Conjur::API.authenticate_iam(identity, account: account, service_id: service_id)
+      expect(token).to eq(raw_token)
+    end
+
+    it 'raises ArgumentError when identity is empty' do
+      expect { Conjur::API.authenticate_iam('', account: account) }
+        .to raise_error(ArgumentError, /identity is required/)
+    end
+
+    it 'raises ArgumentError when service_id is empty' do
+      expect { Conjur::API.authenticate_iam(identity, account: account, service_id: '') }
+        .to raise_error(ArgumentError, /service_id is required/)
+    end
+
+    it 'raises LoadError when aws-sdk-core is unavailable' do
+      allow(Conjur::API).to receive(:require).with('aws-sdk-core').and_raise(LoadError)
+      expect { Conjur::API.authenticate_iam(identity, account: account) }
+        .to raise_error(LoadError, /aws-sdk-core/)
+    end
+  end
+
+  describe 'IAMAuthenticator#refresh_token' do
+    subject(:authenticator) do
+      Conjur::API::IAMAuthenticator.new(account, service_id, identity)
+    end
+
+    it 'delegates to authenticate_iam with stored credentials' do
+      expect(Conjur::API).to receive(:authenticate_iam)
+        .with(identity,
+              account: account,
+              service_id: service_id,
+              aws_region: Conjur::API::IAMAuthenticator::DEFAULT_REGION)
+        .and_return(raw_token)
+      expect(authenticator.refresh_token).to eq(raw_token)
+    end
+  end
+end
+
+describe Conjur::API::Router do
+  let(:account)    { 'myaccount' }
+  let(:service_id) { 'prod' }
+  let(:identity)   { 'host/my-app/my-role' }
+
+  before do
+    allow(Conjur.configuration).to receive(:core_url).and_return('https://conjur.example.com')
+    allow(Conjur.configuration).to receive(:rest_client_options).and_return({})
+  end
+
+  describe '#authn_iam_authenticate' do
+    subject { described_class.authn_iam_authenticate(account, service_id, identity) }
+
+    it 'returns a RestClient::Resource' do
+      expect(subject).to be_a(RestClient::Resource)
+    end
+
+    it 'builds the correct URL' do
+      expect(subject.url).to end_with('/authn-iam/prod/myaccount/host%2Fmy-app%2Fmy-role/authenticate')
+    end
+  end
+end

data/test.sh

@@ -7,6 +7,22 @@ RUBY_VERSION="$(cut -d '-' -f 2 <<< "$RUBY_VERSION")"
 export REGISTRY_URL=${INFRAPOOL_REGISTRY_URL:-"docker.io"}
 export RUBY_VERSION="${INFRAPOOL_RUBY_VERSION:-$RUBY_VERSION}"
 
+# Cloud-authenticator integration toggles. These accept both plain and
+# INFRAPOOL_-prefixed variants (Jenkins injects the latter). When any is
+# "true", ONLY that authenticator's tagged feature runs against real cloud
+# infrastructure; the normal suite is skipped. Left unset by default so PR
+# builds run the ordinary unit + cucumber suite.
+RUN_AWS_TESTS="${INFRAPOOL_RUN_AWS_TESTS:-${RUN_AWS_TESTS:-false}}"
+RUN_AZURE_TESTS="${INFRAPOOL_RUN_AZURE_TESTS:-${RUN_AZURE_TESTS:-false}}"
+RUN_GCP_TESTS="${INFRAPOOL_RUN_GCP_TESTS:-${RUN_GCP_TESTS:-false}}"
+export RUN_AWS_TESTS RUN_AZURE_TESTS RUN_GCP_TESTS
+
+# authn-iam identifies the Conjur host by the AWS caller identity; the AWS stage
+# derives these from `aws sts get-caller-identity` on the agent.
+AWS_ACCOUNT_ID="${INFRAPOOL_AWS_ACCOUNT_ID:-${AWS_ACCOUNT_ID:-}}"
+AWS_ROLE_NAME="${INFRAPOOL_AWS_ROLE_NAME:-${AWS_ROLE_NAME:-}}"
+export AWS_ACCOUNT_ID AWS_ROLE_NAME
+
 source ./ci/oauth/keycloak/keycloak_functions.sh
 TOP_LEVEL=$(git rev-parse --show-toplevel)
 
@@ -23,6 +39,23 @@ if [ ! -f "${TOP_LEVEL}/VERSION" ]; then
   echo -n "0.0.dev" > "${TOP_LEVEL}/VERSION"
 fi
 
+# Returns the cloud-authn cucumber tag to run when a RUN_*_TESTS flag is set,
+# or empty for a normal run. Validates required env vars for the chosen cloud.
+function cloudAuthnTag() {
+  if [[ "$RUN_AWS_TESTS" == "true" ]]; then
+    : "${AWS_ACCOUNT_ID:?AWS_ACCOUNT_ID is required for IAM tests (derived from aws sts get-caller-identity)}"
+    : "${AWS_ROLE_NAME:?AWS_ROLE_NAME is required for IAM tests (derived from aws sts get-caller-identity)}"
+    echo '@authn_iam'
+  elif [[ "$RUN_AZURE_TESTS" == "true" ]]; then
+    : "${AZURE_SUBSCRIPTION_ID:?AZURE_SUBSCRIPTION_ID is required for Azure tests}"
+    : "${AZURE_RESOURCE_GROUP:?AZURE_RESOURCE_GROUP is required for Azure tests}"
+    echo '@authn_azure'
+  elif [[ "$RUN_GCP_TESTS" == "true" ]]; then
+    : "${GCP_ID_TOKEN:?GCP_ID_TOKEN is required for GCP tests (run ci/get_gcp_token.sh first)}"
+    echo '@authn_gcp'
+  fi
+}
+
 function main() {
   if ! docker info >/dev/null 2>&1; then
     echo "Docker does not seem to be running, run it first and retry"
@@ -31,6 +64,8 @@ function main() {
   # Generate reports folders locally
   mkdir -p spec/reports features/reports
 
+  CLOUD_AUTHN_TAG="$(cloudAuthnTag)"
+
   startConjur
   runTests
 }
@@ -54,6 +89,15 @@ function runTests() {
 
   local api_key=$(docker compose exec -T conjur conjurctl role retrieve-key cucumber:user:admin | tr -d '\r\n')
 
+  if [[ -n "$CLOUD_AUTHN_TAG" ]]; then
+    runCloudAuthnTests "$api_key"
+  else
+    runDefaultTests "$api_key"
+  fi
+}
+
+function runDefaultTests() {
+  local api_key="$1"
   echo 'Running tests'
   echo '-----'
   docker compose run --rm \
@@ -63,4 +107,38 @@ function runTests() {
     "/scripts/fetch_certificate && bundle exec rake jenkins_init jenkins_spec jenkins_cucumber"
 }
 
+# Runs a single cloud-authenticator feature against real cloud infrastructure.
+# Forwards the cloud provider env vars and clears proxies so the container can
+# reach the link-local metadata endpoints (169.254.169.254, metadata.google.internal).
+function runCloudAuthnTests() {
+  local api_key="$1"
+  echo "Running cloud authenticator tests: $CLOUD_AUTHN_TAG"
+  echo '-----'
+  local rc=0
+  docker compose run --rm \
+    -e CONJUR_AUTHN_API_KEY="$api_key" \
+    -e CLOUD_AUTHN_TAG="$CLOUD_AUTHN_TAG" \
+    -e NO_PROXY="169.254.169.254,metadata.google.internal,localhost,127.0.0.1,conjur" \
+    -e HTTP_PROXY="" -e HTTPS_PROXY="" -e http_proxy="" -e https_proxy="" \
+    -e AZURE_SUBSCRIPTION_ID="${AZURE_SUBSCRIPTION_ID:-}" \
+    -e AZURE_RESOURCE_GROUP="${AZURE_RESOURCE_GROUP:-}" \
+    -e USER_ASSIGNED_IDENTITY_CLIENT_ID="${USER_ASSIGNED_IDENTITY_CLIENT_ID:-}" \
+    -e GCP_ID_TOKEN="${GCP_ID_TOKEN:-}" \
+    -e GCP_PROJECT_ID="${GCP_PROJECT_ID:-}" \
+    -e AWS_ACCOUNT_ID="${AWS_ACCOUNT_ID:-}" \
+    -e AWS_ROLE_NAME="${AWS_ROLE_NAME:-}" \
+    tester \
+    "bundle exec rake jenkins_init jenkins_cucumber_cloud" || rc=$?
+
+  # On failure, dump the Conjur server log: authn-azure/iam/gcp rejections are
+  # logged there with the precise reason (issuer/annotation/audience mismatch),
+  # which the client only ever sees as an opaque 401.
+  if [[ $rc -ne 0 ]]; then
+    echo "=== cloud authn test failed; last 100 lines of Conjur server log ==="
+    docker compose logs --tail=100 conjur || true
+    echo '=== end Conjur server log ==='
+  fi
+  return $rc
+}
+
 main

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: conjur-api
 version: !ruby/object:Gem::Version
-  version: 6.3.1
+  version: 6.4.0.pre.849
 platform: ruby
 authors:
 - CyberArk Maintainers
@@ -261,6 +261,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-core
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Conjur API
 email:
 - conj_maintainers@cyberark.com
@@ -291,6 +305,7 @@ files:
 - SECURITY.md
 - VERSION
 - ci/configure.sh
+- ci/get_gcp_token.sh
 - ci/oauth/keycloak/create_client
 - ci/oauth/keycloak/create_user
 - ci/oauth/keycloak/fetch_certificate
@@ -305,8 +320,12 @@ files:
 - dev/stop
 - docker-compose.yml
 - example/demo.rb
+- features/README.md
 - features/authenticators.feature
 - features/authn.feature
+- features/authn_azure.feature
+- features/authn_gcp.feature
+- features/authn_iam.feature
 - features/authn_local.feature
 - features/exists.feature
 - features/group.feature
@@ -322,6 +341,7 @@ files:
 - features/role_fields.feature
 - features/rotate_api_key.feature
 - features/step_definitions/api_steps.rb
+- features/step_definitions/cloud_authn_steps.rb
 - features/step_definitions/policy_steps.rb
 - features/step_definitions/result_steps.rb
 - features/support/env.rb
@@ -342,7 +362,10 @@ files:
 - lib/conjur/api.rb
 - lib/conjur/api/authenticators.rb
 - lib/conjur/api/authn.rb
+- lib/conjur/api/authn_azure.rb
 - lib/conjur/api/authn_cert.rb
+- lib/conjur/api/authn_gcp.rb
+- lib/conjur/api/authn_iam.rb
 - lib/conjur/api/host_factories.rb
 - lib/conjur/api/ldap_sync.rb
 - lib/conjur/api/policies.rb
@@ -385,6 +408,7 @@ files:
 - lib/conjur/variable.rb
 - lib/conjur/webservice.rb
 - publish.sh
+- secrets.yml
 - spec/.conjurrc
 - spec/api/host_factories_spec.rb
 - spec/api/policies_spec.rb
@@ -392,7 +416,10 @@ files:
 - spec/api/server_version_spec.rb
 - spec/api/version_check_spec.rb
 - spec/api_spec.rb
+- spec/authn_azure_spec.rb
 - spec/authn_cert_spec.rb
+- spec/authn_gcp_spec.rb
+- spec/authn_iam_spec.rb
 - spec/base_object_spec.rb
 - spec/cert_utils_spec.rb
 - spec/cidr_spec.rb
@@ -437,8 +464,12 @@ rubygems_version: 4.0.10
 specification_version: 4
 summary: Conjur API
 test_files:
+- features/README.md
 - features/authenticators.feature
 - features/authn.feature
+- features/authn_azure.feature
+- features/authn_gcp.feature
+- features/authn_iam.feature
 - features/authn_local.feature
 - features/exists.feature
 - features/group.feature
@@ -454,6 +485,7 @@ test_files:
 - features/role_fields.feature
 - features/rotate_api_key.feature
 - features/step_definitions/api_steps.rb
+- features/step_definitions/cloud_authn_steps.rb
 - features/step_definitions/policy_steps.rb
 - features/step_definitions/result_steps.rb
 - features/support/env.rb
@@ -471,7 +503,10 @@ test_files:
 - spec/api/server_version_spec.rb
 - spec/api/version_check_spec.rb
 - spec/api_spec.rb
+- spec/authn_azure_spec.rb
 - spec/authn_cert_spec.rb
+- spec/authn_gcp_spec.rb
+- spec/authn_iam_spec.rb
 - spec/base_object_spec.rb
 - spec/cert_utils_spec.rb
 - spec/cidr_spec.rb