conjur-api 5.1.0 → 5.2.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +5 -5
- data/CHANGELOG.md +5 -0
- data/README.md +54 -10
- data/dev/Dockerfile.dev +12 -0
- data/dev/docker-compose.yml +56 -0
- data/dev/start +17 -0
- data/dev/stop +5 -0
- data/features/members.feature +4 -4
- data/features/new_api.feature +3 -3
- data/lib/conjur-api/version.rb +1 -1
- data/lib/conjur/api/router/v5.rb +2 -2
- data/lib/conjur/configuration.rb +1 -1
- data/lib/conjur/id.rb +8 -3
- data/spec/uri_escape_spec.rb +9 -0
- metadata +9 -3
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
|
-
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
2
|
+
SHA256:
|
3
|
+
metadata.gz: 5cde5e15366fbf8e8838402bd8ffa29183a1d6972cbf0c2f2583a6e56093fed7
|
4
|
+
data.tar.gz: 8a2fe440ec1693c50498adbcc1f188341ffe4767ea80182ce6e1e13a089936ce
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: ff0b849ec96f16fa10fa1ef8f8c661fa5a1695ed16f8c97a24a4d5e3cf7a6660f3fb8e112d1086eec995028585ecd074348d202b96f0fa6252fd55ae128ac7bc
|
7
|
+
data.tar.gz: 5597bfc53825bd362be9f50b914824ca77640f391b859820277a50179ca917a1502d3d33bfad9eccfa81d0aa618c32f0e41db734ea9cb013520a018944831892
|
data/CHANGELOG.md
CHANGED
@@ -1,5 +1,10 @@
|
|
1
1
|
# Latest
|
2
2
|
|
3
|
+
# v5.2.0
|
4
|
+
|
5
|
+
* Adds support for the Role endpoint for searching and paging Role Members
|
6
|
+
* Adds additional escaping to URL parameters on requests to handle special characters (e.g. spaces)
|
7
|
+
|
3
8
|
# v5.1.0
|
4
9
|
|
5
10
|
* Introduces backwards compatibility with Conjur 4.x for most API methods.
|
data/README.md
CHANGED
@@ -7,7 +7,7 @@ Programmatic Ruby access to the Conjur API.
|
|
7
7
|
The Conjur server comes in two major versions:
|
8
8
|
|
9
9
|
* **4.x** Conjur 4 is a commercial, non-open-source product, which is documented at [https://developer.conjur.net/](https://developer.conjur.net/).
|
10
|
-
* **5.x** Conjur 5 is open-source software, hosted and documented at [https://www.conjur.org/](https://www.conjur.org/).
|
10
|
+
* **5.x** Conjur 5 is open-source software, hosted and documented at [https://www.conjur.org/](https://www.conjur.org/).
|
11
11
|
|
12
12
|
You can use the `master` branch of this project, which is `conjur-api` version `5.x`, to do all of the following things against either type of Conjur server:
|
13
13
|
|
@@ -47,12 +47,16 @@ Connecting to Conjur is a two-step process:
|
|
47
47
|
|
48
48
|
The simplest way to configure the Conjur API is to use the configuration file stored on the machine.
|
49
49
|
If you have configured the machine with [conjur init](http://developer.conjur.net/reference/tools/init.html),
|
50
|
-
|
50
|
+
<<<<<<< HEAD
|
51
|
+
its default location is `~/.conjurrc`.
|
52
|
+
=======
|
53
|
+
it's default location is `~/.conjurrc`.
|
54
|
+
>>>>>>> Added development environment
|
51
55
|
|
52
56
|
The Conjur configuration process also checks `/etc/conjur.conf` for global settings. This is typically used
|
53
57
|
in server environments.
|
54
58
|
|
55
|
-
For custom scenarios, the location of the file can be overridden using the `CONJURRC` environment variable.
|
59
|
+
For custom scenarios, the location of the file can be overridden using the `CONJURRC` environment variable.
|
56
60
|
|
57
61
|
You can load the Conjur configuration file using the following Ruby code:
|
58
62
|
|
@@ -76,9 +80,9 @@ conjur = Conjur::Authn.connect nil, noask: true
|
|
76
80
|
To [authenticate](http://developer.conjur.net/reference/services/authentication/authenticate.html), the API client must
|
77
81
|
provide a `login` name and `api_key`. The `Conjur::Authn.connect` will attempt the following, in order:
|
78
82
|
|
79
|
-
1. Look for `login` in environment variable `CONJUR_AUTHN_LOGIN`, and `api_key` in `CONJUR_AUTHN_API_KEY`
|
83
|
+
1. Look for `login` in environment variable `CONJUR_AUTHN_LOGIN`, and `api_key` in `CONJUR_AUTHN_API_KEY`
|
80
84
|
2. Look for credentials on disk. The default credentials file is `~/.netrc`. The location of the credentials file
|
81
|
-
can be overridden using the configuration file `netrc_path` option.
|
85
|
+
can be overridden using the configuration file `netrc_path` option.
|
82
86
|
3. Prompt for credentials. This can be disabled using the option `noask: true`.
|
83
87
|
|
84
88
|
## Connecting Without Files
|
@@ -86,7 +90,7 @@ can be overridden using the configuration file `netrc_path` option.
|
|
86
90
|
It's possible to configure and authenticate the Conjur connection without using any files, and without requiring
|
87
91
|
the `conjur-cli` gem.
|
88
92
|
|
89
|
-
To accomplish this, apply the configuration settings directly to the [Conjur::Configuration](https://github.com/conjurinc/api-ruby/blob/master/lib/conjur/configuration.rb)
|
93
|
+
To accomplish this, apply the configuration settings directly to the [Conjur::Configuration](https://github.com/conjurinc/api-ruby/blob/master/lib/conjur/configuration.rb)
|
90
94
|
object.
|
91
95
|
|
92
96
|
For example, specify the `account` and `appliance_url` (both of which are required) like this:
|
@@ -96,8 +100,8 @@ Conjur.configuration.account = 'my-account'
|
|
96
100
|
Conjur.configuration.appliance_url = 'https://conjur.mydomain.com/api'
|
97
101
|
```
|
98
102
|
|
99
|
-
You can also specify these values using environment variables, which is often a bit more convenient.
|
100
|
-
Environment variables are mapped to configuration variables by prepending `CONJUR_` to the all-caps name of the
|
103
|
+
You can also specify these values using environment variables, which is often a bit more convenient.
|
104
|
+
Environment variables are mapped to configuration variables by prepending `CONJUR_` to the all-caps name of the
|
101
105
|
configuration variable. For example, `appliance_url` is `CONJUR_APPLIANCE_URL`, `account` is `CONJUR_ACCOUNT`.
|
102
106
|
|
103
107
|
In either case, you will also need to configure certificate trust. For example:
|
@@ -112,10 +116,50 @@ Once Conjur is configured, you can create a new API client by providing a `login
|
|
112
116
|
Conjur::API.new_from_key login, api_key
|
113
117
|
```
|
114
118
|
|
115
|
-
Note that if you are connecting as a [Host](http://developer.conjur.net/reference/services/directory/host), the login should be
|
119
|
+
Note that if you are connecting as a [Host](http://developer.conjur.net/reference/services/directory/host), the login should be
|
116
120
|
prefixed with `host/`. For example: `host/myhost.example.com`, not just `myhost.example.com`.
|
117
121
|
|
118
|
-
|
122
|
+
|
123
|
+
# Development (V5)
|
124
|
+
To develop and run tests against Conjur V5, use the `start` and `stop` scripts in the `dev` folder. The start script brings up an open source Conjur (and Postgres database), CLI container, and a "work" container, with the gem code mounted into the working directory.
|
125
|
+
|
126
|
+
#### Starting a Shell
|
127
|
+
To begin:
|
128
|
+
```sh
|
129
|
+
$ cd dev
|
130
|
+
$ ./start
|
131
|
+
...
|
132
|
+
root@9df0ac10ada2:/src/conjur-api#
|
133
|
+
```
|
134
|
+
You'll be dropped into development container upon completion. From there, install the development gems:
|
135
|
+
|
136
|
+
```sh
|
137
|
+
root@9df0ac10ada2:/src/conjur-api# bundle
|
138
|
+
```
|
139
|
+
|
140
|
+
#### Running Tests
|
141
|
+
*NOTE*: There are some existing challenges around running tests from the development console. For now, run tests
|
142
|
+
by using the `./test.sh` script utilized for Jenkins Pipelines.
|
143
|
+
|
144
|
+
<!--
|
145
|
+
Commented out until I can get tests running locally
|
146
|
+
|
147
|
+
Tests can be run with:
|
148
|
+
```sh
|
149
|
+
root@9df0ac10ada2:/src/conjur-api# bundle exec cucumber features
|
150
|
+
root@9df0ac10ada2:/src/conjur-api# bundle exec rspec
|
151
|
+
```
|
152
|
+
-->
|
153
|
+
|
154
|
+
#### Stopping & Environment Cleanup
|
155
|
+
Once you're done, exit the shell, and stop the containers:
|
156
|
+
|
157
|
+
```sh
|
158
|
+
root@9df0ac10ada2:/src/conjur-api# exit
|
159
|
+
$ ./stop
|
160
|
+
```
|
161
|
+
|
162
|
+
# Development (V4)
|
119
163
|
|
120
164
|
The file `docker-compose.yml` is a self-contained development environment for the project.
|
121
165
|
|
data/dev/Dockerfile.dev
ADDED
@@ -0,0 +1,56 @@
|
|
1
|
+
version: '3'
|
2
|
+
services:
|
3
|
+
pg:
|
4
|
+
image: postgres:9.3
|
5
|
+
|
6
|
+
conjur_5:
|
7
|
+
image: cyberark/conjur
|
8
|
+
command: server -a cucumber
|
9
|
+
environment:
|
10
|
+
DATABASE_URL: postgres://postgres@pg/postgres
|
11
|
+
CONJUR_DATA_KEY: 'WMfApcDBtocRWV+ZSUP3Tjr5XNU+Z2FdBb6BEezejIs='
|
12
|
+
volumes:
|
13
|
+
- authn_local_5:/run/authn-local
|
14
|
+
depends_on:
|
15
|
+
- pg
|
16
|
+
|
17
|
+
conjur_4:
|
18
|
+
image: registry2.itci.conjur.net/conjur-appliance-cuke-master:4.9-stable
|
19
|
+
security_opt:
|
20
|
+
- seccomp:unconfined
|
21
|
+
volumes:
|
22
|
+
- ../features_v4/support/policy.yml:/etc/policy.yml
|
23
|
+
- authn_local_4:/run/authn-local
|
24
|
+
|
25
|
+
gem:
|
26
|
+
build:
|
27
|
+
context: ../
|
28
|
+
dockerfile: dev/Dockerfile.dev
|
29
|
+
entrypoint: sleep
|
30
|
+
command: infinity
|
31
|
+
environment:
|
32
|
+
CONJUR_APPLIANCE_URL: http://conjur_5
|
33
|
+
CONJUR_VERSION: 5
|
34
|
+
CONJUR_ACCOUNT: cucumber
|
35
|
+
links:
|
36
|
+
- conjur_5:conjur_5
|
37
|
+
- conjur_4:conjur_4
|
38
|
+
volumes:
|
39
|
+
- ..:/src/conjur-api
|
40
|
+
- authn_local_4:/run/authn-local-4
|
41
|
+
- authn_local_5:/run/authn-local-5
|
42
|
+
|
43
|
+
client:
|
44
|
+
image: conjurinc/cli5
|
45
|
+
entrypoint: sleep
|
46
|
+
command: infinity
|
47
|
+
environment:
|
48
|
+
CONJUR_APPLIANCE_URL: http://conjur_5
|
49
|
+
CONJUR_ACCOUNT: cucumber
|
50
|
+
CONJUR_AUTHN_LOGIN: admin
|
51
|
+
links:
|
52
|
+
- conjur_5:conjur_5
|
53
|
+
|
54
|
+
volumes:
|
55
|
+
authn_local_5:
|
56
|
+
authn_local_4:
|
data/dev/start
ADDED
@@ -0,0 +1,17 @@
|
|
1
|
+
#!/bin/bash -ex
|
2
|
+
|
3
|
+
function v5_development() {
|
4
|
+
docker-compose up -d --no-deps conjur_5 pg gem client
|
5
|
+
|
6
|
+
docker-compose exec -T conjur_5 conjurctl wait
|
7
|
+
|
8
|
+
local api_key=$(docker-compose exec -T conjur_5 rake 'role:retrieve-key[cucumber:user:admin]')
|
9
|
+
api_key=$(docker-compose exec -T conjur_5 conjurctl role retrieve-key cucumber:user:admin | tr -d '\r')
|
10
|
+
|
11
|
+
docker exec -e CONJUR_AUTHN_API_KEY="$api_key" -it --detach-keys 'ctrl-\' $(docker-compose ps -q gem) bash
|
12
|
+
}
|
13
|
+
|
14
|
+
docker-compose pull
|
15
|
+
docker-compose build
|
16
|
+
|
17
|
+
v5_development
|
data/dev/stop
ADDED
data/features/members.feature
CHANGED
@@ -21,13 +21,13 @@ Feature: Display role members and memberships.
|
|
21
21
|
"""
|
22
22
|
[
|
23
23
|
{
|
24
|
-
"admin_option":
|
25
|
-
"member": "cucumber:
|
24
|
+
"admin_option": false,
|
25
|
+
"member": "cucumber:group:developers",
|
26
26
|
"role": "cucumber:group:everyone"
|
27
27
|
},
|
28
28
|
{
|
29
|
-
"admin_option":
|
30
|
-
"member": "cucumber:
|
29
|
+
"admin_option": true,
|
30
|
+
"member": "cucumber:user:admin",
|
31
31
|
"role": "cucumber:group:everyone"
|
32
32
|
}
|
33
33
|
]
|
data/features/new_api.feature
CHANGED
@@ -7,7 +7,7 @@ Feature: Constructing a new API object.
|
|
7
7
|
"""
|
8
8
|
api = Conjur::API.new_from_key "host/#{@host_id}", @host_api_key
|
9
9
|
expect(api.token).to be_instance_of(Hash)
|
10
|
-
expect(
|
10
|
+
expect($conjur.resource("cucumber:host:#{@host_id}")).to exist
|
11
11
|
"""
|
12
12
|
|
13
13
|
Scenario: From access token.
|
@@ -18,7 +18,7 @@ Feature: Constructing a new API object.
|
|
18
18
|
Then I run the code:
|
19
19
|
"""
|
20
20
|
api = Conjur::API.new_from_token @token
|
21
|
-
expect(
|
21
|
+
expect($conjur.resource("cucumber:host:#{@host_id}")).to exist
|
22
22
|
"""
|
23
23
|
|
24
24
|
Scenario: From access token file.
|
@@ -32,5 +32,5 @@ Feature: Constructing a new API object.
|
|
32
32
|
Then I run the code:
|
33
33
|
"""
|
34
34
|
api = Conjur::API.new_from_token_file @temp_file.path
|
35
|
-
expect(
|
35
|
+
expect($conjur.resource("cucumber:host:#{@host_id}")).to exist
|
36
36
|
"""
|
data/lib/conjur-api/version.rb
CHANGED
data/lib/conjur/api/router/v5.rb
CHANGED
@@ -82,7 +82,7 @@ module Conjur
|
|
82
82
|
options = {}
|
83
83
|
options[:check] = true
|
84
84
|
options[:privilege] = privilege
|
85
|
-
options[:role] = cast_to_id(role) if role
|
85
|
+
options[:role] = path_escape(cast_to_id(role)) if role
|
86
86
|
resources_resource(credentials, id)[options_querystring options].get
|
87
87
|
end
|
88
88
|
|
@@ -134,7 +134,7 @@ module Conjur
|
|
134
134
|
end
|
135
135
|
|
136
136
|
def parse_members credentials, result
|
137
|
-
result
|
137
|
+
result.map do |json|
|
138
138
|
RoleGrant.parse_from_json(json, credentials)
|
139
139
|
end
|
140
140
|
end
|
data/lib/conjur/configuration.rb
CHANGED
data/lib/conjur/id.rb
CHANGED
@@ -18,16 +18,19 @@
|
|
18
18
|
# IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
19
19
|
# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
20
20
|
#
|
21
|
+
require 'conjur/escape'
|
21
22
|
|
22
23
|
module Conjur
|
23
24
|
# Encapsulates a Conjur id, which consists of account, kind, and identifier.
|
24
25
|
class Id
|
26
|
+
include Conjur::Escape
|
27
|
+
|
25
28
|
attr_reader :id
|
26
|
-
|
29
|
+
|
27
30
|
def initialize id
|
28
31
|
@id = id
|
29
32
|
end
|
30
|
-
|
33
|
+
|
31
34
|
# The organization account, obtained from the first component of the id.
|
32
35
|
def account; id.split(':', 3)[0]; end
|
33
36
|
# The object kind, obtained from the second component of the id.
|
@@ -52,7 +55,9 @@ module Conjur
|
|
52
55
|
|
53
56
|
# Splits the id into 3 components, and then joins them with a forward-slash `/`.
|
54
57
|
def to_url_path
|
55
|
-
id.split(':', 3)
|
58
|
+
id.split(':', 3)
|
59
|
+
.map(&method(:path_escape))
|
60
|
+
.join('/')
|
56
61
|
end
|
57
62
|
|
58
63
|
# @return [String] the id string
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: conjur-api
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 5.
|
4
|
+
version: 5.2.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Rafal Rzepecki
|
@@ -9,7 +9,7 @@ authors:
|
|
9
9
|
autorequire:
|
10
10
|
bindir: bin
|
11
11
|
cert_chain: []
|
12
|
-
date:
|
12
|
+
date: 2018-06-14 00:00:00.000000000 Z
|
13
13
|
dependencies:
|
14
14
|
- !ruby/object:Gem::Dependency
|
15
15
|
name: rest-client
|
@@ -229,6 +229,10 @@ files:
|
|
229
229
|
- ci/configure_v4.sh
|
230
230
|
- ci/configure_v5.sh
|
231
231
|
- conjur-api.gemspec
|
232
|
+
- dev/Dockerfile.dev
|
233
|
+
- dev/docker-compose.yml
|
234
|
+
- dev/start
|
235
|
+
- dev/stop
|
232
236
|
- docker-compose.yml
|
233
237
|
- example/demo_v4.rb
|
234
238
|
- example/demo_v5.rb
|
@@ -332,6 +336,7 @@ files:
|
|
332
336
|
- spec/roles_spec.rb
|
333
337
|
- spec/spec_helper.rb
|
334
338
|
- spec/ssl_spec.rb
|
339
|
+
- spec/uri_escape_spec.rb
|
335
340
|
- spec/vendor/rest_client_spec.rb
|
336
341
|
- test.sh
|
337
342
|
- tmp/.keep
|
@@ -355,7 +360,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
355
360
|
version: '0'
|
356
361
|
requirements: []
|
357
362
|
rubyforge_project:
|
358
|
-
rubygems_version: 2.
|
363
|
+
rubygems_version: 2.7.6
|
359
364
|
signing_key:
|
360
365
|
specification_version: 4
|
361
366
|
summary: Conjur API
|
@@ -398,4 +403,5 @@ test_files:
|
|
398
403
|
- spec/roles_spec.rb
|
399
404
|
- spec/spec_helper.rb
|
400
405
|
- spec/ssl_spec.rb
|
406
|
+
- spec/uri_escape_spec.rb
|
401
407
|
- spec/vendor/rest_client_spec.rb
|