conjur-api 6.3.1.pre.829 → 6.3.1.pre.846

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 52dbc5d9ceec78b99d6f3116a6b81731e0ef000c4acefec92f8748e62004817f
-  data.tar.gz: 80c397da5014245c3783e29063427e848f634da126e5cd739876958f755ca612
+  metadata.gz: a22e04544db452dd276f8053e60ec40ba19dbeb6c8c74fa554f1abad9b9ddb37
+  data.tar.gz: 7997ace31344e73979de8a5e651526e0ca419862841e21475b5dec915ee5e444
 SHA512:
-  metadata.gz: db2491c9bc1a5b40b71c8a9c762ca9df040b8d2054b2a683a0343d54a8c845e92dad42d7754ccce611f03d7692a623a61f6ebadbf9b5daf5aab76f4772666455
-  data.tar.gz: 8e9b1daf341e59d9e8a97c562c399a1e30c8ad83c5981812c6df62bcc857a5e633ce938f43b9bb86ba790905965d56a9505a2b96077c56a52998f4d4b25456cb
+  metadata.gz: 36941d33ca17af4c45f9f475ae0dc25161a573bdb3c6d4a5f4c4d457078a1bc122fd63872d9983b835467a78e17ee0a0e0e6b5fd8186a95fd680459bf1f59e31
+  data.tar.gz: 0325c9377ed9aacd040f9d4cc0615c2ee0091460de22b52779cf4abec8fe9ed4e7d2ec6ec2ddde41fbecd9ad7099c2b1c3959776bcabd6275542afee8d592ba3

data/CHANGELOG.md

@@ -5,6 +5,25 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 ## Unreleased
+### Added
+- Cloud-native authenticators for Azure Managed Identity (`authn-azure`),
+  AWS IAM (`authn-iam`), and GCP workload identity (`authn-jwt/gcp`), exposed
+  via `Conjur::API.new_from_azure`, `.new_from_iam`, and `.new_from_gcp`
+  (CNJR-14213).
+
+### Changed
+- CI uses Conjur Enterprise 1.27.0+, which removed the `GET /public_keys` endpoint
+  (CNJR-11339). Dropped the Cucumber scenario that exercised that API; the client
+  method remains for open-source Conjur.
+- Retrieve the Cucumber admin API key via `conjurctl` in `test.sh` instead of rake,
+  avoiding Rails boot output corrupting the key on current Conjur images.
+- CI now tests against Ruby 3.3, 3.4, and 4.0. Dropped Ruby 3.2 (end of life)
+  and raised the minimum supported Ruby version accordingly.
+
+### Fixed
+- Set `CONJUR_AUTHN_ALLOWED_IP_RANGES` and `CONJUR_AUTHN_HTTP_ALLOWLIST` in the
+  test environment so Conjur's new SSRF guard does not block the authn-oidc
+  `provider-uri` fetch to the compose-local Keycloak server. (CNJR-13786)
 
 ## [6.3.1] - 2026-07-16
 
@@ -24,15 +43,6 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Added `Conjur::API#fetch_policy` for retrieving policy data from the server,
   as YAML or JSON, with optional tree depth and size limits.
 
-### Changed
-- CI uses Conjur Enterprise 1.27.0+, which removed the `GET /public_keys` endpoint
-  (CNJR-11339). Dropped the Cucumber scenario that exercised that API; the client
-  method remains for open-source Conjur.
-- Retrieve the Cucumber admin API key via `conjurctl` in `test.sh` instead of rake,
-  avoiding Rails boot output corrupting the key on current Conjur images.
-- CI now tests against Ruby 3.3, 3.4, and 4.0. Dropped Ruby 3.2 (end of life)
-  and raised the minimum supported Ruby version accordingly.
-
 ## [6.2.0] - 2026-06-05
 
 ## [6.1.0] - 2025-12-10

data/VERSION

@@ -1 +1 @@
-6.3.1-829
+6.3.1-846

data/docker-compose.yml

@@ -11,6 +11,13 @@ services:
     environment:
       DATABASE_URL: postgres://postgres@pg/postgres
       CONJUR_DATA_KEY: 'WMfApcDBtocRWV+ZSUP3Tjr5XNU+Z2FdBb6BEezejIs='
+      # Conjur's SSRF guard blocks authenticator fetches (authn-oidc provider-uri here) that
+      # resolve to loopback/RFC1918 ranges or use plain HTTP. Keycloak is reached by compose
+      # service name, so it resolves inside the bridge network's private subnet and its
+      # discovery document advertises http://keycloak:8080 endpoints. Both guards must be
+      # opted out of for this test env. Mirrors conjur's own ci/docker-compose.yml.
+      CONJUR_AUTHN_ALLOWED_IP_RANGES: ${CONJUR_AUTHN_ALLOWED_IP_RANGES:-0.0.0.0/0,::/0}
+      CONJUR_AUTHN_HTTP_ALLOWLIST: ${CONJUR_AUTHN_HTTP_ALLOWLIST:-keycloak}
     volumes:
       - authn_local:/run/authn-local
       - ./ci/oauth/keycloak:/scripts

data/lib/conjur/api/authn_azure.rb

@@ -0,0 +1,145 @@
+# frozen_string_literal: true
+
+require 'net/http'
+require 'json'
+require 'uri'
+require 'cgi'
+
+module Conjur
+  class API
+    # Authenticator that uses an Azure Managed Identity JWT to obtain Conjur access tokens.
+    # Fetches a JWT from the Azure Instance Metadata Service (IMDS), then POSTs it
+    # to the Conjur authn-azure endpoint.
+    class AzureAuthenticator
+      include TokenExpiration
+
+      IMDS_TOKEN_PATH    = '/metadata/identity/oauth2/token'.freeze
+      DEFAULT_RESOURCE   = 'https://management.azure.com/'.freeze
+      DEFAULT_IMDS_BASE  = 'http://169.254.169.254'.freeze
+      DEFAULT_IMDS_VER   = '2018-02-01'.freeze
+
+      attr_reader :account, :service_id, :identity, :resource_uri,
+                  :client_id, :imds_base_url, :imds_api_version
+
+      def initialize(account, service_id, identity,
+                     resource_uri: DEFAULT_RESOURCE,
+                     client_id: nil,
+                     imds_base_url: DEFAULT_IMDS_BASE,
+                     imds_api_version: DEFAULT_IMDS_VER)
+        @account          = account
+        @service_id       = service_id
+        @identity         = identity
+        @resource_uri     = resource_uri
+        @client_id        = client_id
+        @imds_base_url    = imds_base_url
+        @imds_api_version = imds_api_version
+        update_token_born
+      end
+
+      def refresh_token
+        Conjur::API.authenticate_azure(service_id, identity,
+                                       account: account,
+                                       resource_uri: resource_uri,
+                                       client_id: client_id,
+                                       imds_base_url: imds_base_url,
+                                       imds_api_version: imds_api_version).tap do
+          update_token_born
+        end
+      end
+    end
+
+    class << self
+      # Create a {Conjur::API} instance authenticated via Azure Managed Identity (authn-azure).
+      #
+      # @param [String] service_id the authn-azure service ID configured in Conjur
+      # @param [String] identity Conjur host identity (e.g. "host/my-app/azure-host")
+      # @param [String] account the Conjur organization account
+      # @param [String] resource_uri Azure resource URI for the IMDS token request
+      # @param [String, nil] client_id optional client ID for a user-assigned managed identity
+      # @param [String] imds_base_url override for the IMDS base URL (useful in tests)
+      # @param [String] imds_api_version override for the IMDS API version
+      # @param [String, nil] remote_ip optional IP address recorded in the audit log
+      # @return [Conjur::API]
+      def new_from_azure(service_id, identity,
+                         account: Conjur.configuration.account,
+                         resource_uri: AzureAuthenticator::DEFAULT_RESOURCE,
+                         client_id: nil,
+                         imds_base_url: AzureAuthenticator::DEFAULT_IMDS_BASE,
+                         imds_api_version: AzureAuthenticator::DEFAULT_IMDS_VER,
+                         remote_ip: nil)
+        self.new.init_from_azure(service_id, identity,
+                                 account: account,
+                                 resource_uri: resource_uri,
+                                 client_id: client_id,
+                                 imds_base_url: imds_base_url,
+                                 imds_api_version: imds_api_version,
+                                 remote_ip: remote_ip)
+      end
+
+      # Authenticate via authn-azure and return a parsed Conjur access token.
+      #
+      # @param [String] service_id the authn-azure service ID
+      # @param [String] identity Conjur host identity
+      # @param [String] account the Conjur organization account
+      # @return [Hash] parsed access token
+      def authenticate_azure(service_id, identity,
+                             account: Conjur.configuration.account,
+                             resource_uri: AzureAuthenticator::DEFAULT_RESOURCE,
+                             client_id: nil,
+                             imds_base_url: AzureAuthenticator::DEFAULT_IMDS_BASE,
+                             imds_api_version: AzureAuthenticator::DEFAULT_IMDS_VER)
+        raise ArgumentError, "service_id is required" if service_id.nil? || service_id.empty?
+        raise ArgumentError, "identity is required"   if identity.nil?  || identity.empty?
+
+        if Conjur.log
+          Conjur.log << "Authenticating #{identity} to account #{account} via authn-azure/#{service_id}\n"
+        end
+
+        jwt = fetch_azure_jwt(resource_uri: resource_uri, client_id: client_id,
+                              imds_base_url: imds_base_url, imds_api_version: imds_api_version)
+        JSON.parse(url_for(:authn_azure_authenticate, account, service_id, identity)
+          .post("jwt=#{CGI.escape(jwt)}", content_type: 'application/x-www-form-urlencoded'))
+      end
+
+      private
+
+      # Fetches an Azure Managed Identity JWT from IMDS.
+      # Uses a direct Net::HTTP connection (proxy addr = nil) because the IMDS
+      # link-local address 169.254.169.254 must never be routed through a proxy.
+      def fetch_azure_jwt(resource_uri:, client_id:, imds_base_url:, imds_api_version:)
+        query = "api-version=#{CGI.escape(imds_api_version)}&resource=#{CGI.escape(resource_uri)}"
+        query += "&client_id=#{CGI.escape(client_id)}" if client_id
+
+        uri = URI("#{imds_base_url}#{AzureAuthenticator::IMDS_TOKEN_PATH}?#{query}")
+        http = Net::HTTP.new(uri.host, uri.port, nil) # nil = no proxy
+        response = http.get(uri.request_uri, 'Metadata' => 'true')
+
+        unless response.is_a?(Net::HTTPSuccess)
+          raise "Azure IMDS token request failed: #{response.code} #{response.message}. Body: #{response.body}"
+        end
+
+        body = JSON.parse(response.body)
+        token = body['access_token']
+        raise "Azure IMDS returned an empty access token" if token.nil? || token.empty?
+
+        token
+      end
+    end
+
+    def init_from_azure(service_id, identity,
+                        account: Conjur.configuration.account,
+                        resource_uri: AzureAuthenticator::DEFAULT_RESOURCE,
+                        client_id: nil,
+                        imds_base_url: AzureAuthenticator::DEFAULT_IMDS_BASE,
+                        imds_api_version: AzureAuthenticator::DEFAULT_IMDS_VER,
+                        remote_ip: nil)
+      @remote_ip     = remote_ip
+      @authenticator = AzureAuthenticator.new(account, service_id, identity,
+                                               resource_uri: resource_uri,
+                                               client_id: client_id,
+                                               imds_base_url: imds_base_url,
+                                               imds_api_version: imds_api_version)
+      self
+    end
+  end
+end

data/lib/conjur/api/authn_gcp.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+require 'net/http'
+require 'uri'
+require 'cgi'
+require 'json'
+
+module Conjur
+  class API
+    # Authenticator that uses a GCP identity token to obtain Conjur access tokens.
+    # Fetches an identity JWT from the GCP Instance Metadata Service, then POSTs it
+    # to the Conjur authn-jwt/gcp endpoint.
+    #
+    # An explicit JWT may be supplied to bypass the metadata service fetch —
+    # useful in CI environments where the token is pre-fetched on a GCP agent.
+    class GCPAuthenticator
+      include TokenExpiration
+
+      DEFAULT_SERVICE_ID   = 'gcp'.freeze
+      DEFAULT_METADATA_URL = 'http://metadata.google.internal/computeMetadata/v1' \
+                             '/instance/service-accounts/default/identity'.freeze
+
+      attr_reader :account, :service_id, :identity, :jwt, :gcp_identity_url, :audience
+
+      def initialize(account, service_id, identity, jwt: nil,
+                     gcp_identity_url: DEFAULT_METADATA_URL, audience: nil)
+        @account          = account
+        @service_id       = service_id
+        @identity         = identity
+        @jwt              = jwt
+        @gcp_identity_url = gcp_identity_url
+        @audience         = audience
+        update_token_born
+      end
+
+      def refresh_token
+        Conjur::API.authenticate_gcp(identity, account: account,
+                                               service_id: service_id,
+                                               jwt: jwt,
+                                               gcp_identity_url: gcp_identity_url,
+                                               audience: audience).tap do
+          update_token_born
+        end
+      end
+    end
+
+    class << self
+      # Create a {Conjur::API} instance authenticated via GCP workload identity (authn-jwt/gcp).
+      #
+      # @param [String] identity Conjur host identity (e.g. "host/data/test/gcp-apps/test-app")
+      # @param [String] service_id the authn-jwt service ID (default: "gcp")
+      # @param [String] account the Conjur organization account
+      # @param [String, nil] jwt pre-obtained GCP identity token; when supplied the metadata
+      #   service is not called. Useful in tests and CI where the token is pre-fetched.
+      # @param [String] gcp_identity_url override for the GCP metadata identity URL (for tests)
+      # @param [String, nil] audience the audience claim requested from the metadata service.
+      #   Must match the audience configured in the authn-jwt/gcp policy. Defaults to
+      #   "conjur/{account}/host/{identity}" when not supplied.
+      # @param [String, nil] remote_ip optional IP address recorded in the audit log
+      # @return [Conjur::API]
+      def new_from_gcp(identity,
+                       account: Conjur.configuration.account,
+                       service_id: GCPAuthenticator::DEFAULT_SERVICE_ID,
+                       jwt: nil,
+                       gcp_identity_url: GCPAuthenticator::DEFAULT_METADATA_URL,
+                       audience: nil,
+                       remote_ip: nil)
+        self.new.init_from_gcp(identity, account: account, service_id: service_id,
+                                          jwt: jwt, gcp_identity_url: gcp_identity_url,
+                                          audience: audience, remote_ip: remote_ip)
+      end
+
+      # Authenticate via authn-jwt/gcp and return a parsed Conjur access token.
+      #
+      # @param [String] identity Conjur host identity
+      # @param [String] service_id the authn-jwt service ID
+      # @param [String] account the Conjur organization account
+      # @param [String, nil] jwt pre-obtained GCP identity token
+      # @param [String] gcp_identity_url override for the GCP metadata identity URL
+      # @param [String, nil] audience the audience claim requested from the metadata service.
+      #   Must match the audience configured in the authn-jwt/gcp policy. Defaults to
+      #   "conjur/{account}/host/{identity}" when not supplied.
+      # @return [Hash] parsed access token
+      def authenticate_gcp(identity,
+                           account: Conjur.configuration.account,
+                           service_id: GCPAuthenticator::DEFAULT_SERVICE_ID,
+                           jwt: nil,
+                           gcp_identity_url: GCPAuthenticator::DEFAULT_METADATA_URL,
+                           audience: nil)
+        raise ArgumentError, "identity is required"   if identity.nil?   || identity.empty?
+        raise ArgumentError, "service_id is required" if service_id.nil? || service_id.empty?
+
+        if Conjur.log
+          Conjur.log << "Authenticating #{identity} to account #{account} via authn-jwt/#{service_id}\n"
+        end
+
+        token = jwt || fetch_gcp_jwt(account, identity,
+                                     gcp_identity_url: gcp_identity_url, audience: audience)
+        JSON.parse(url_for(:authn_gcp_authenticate, account, service_id, identity)
+          .post("jwt=#{CGI.escape(token)}", content_type: 'application/x-www-form-urlencoded'))
+      end
+
+      private
+
+      # Fetches a GCP identity token from the instance metadata service.
+      # Uses a direct Net::HTTP connection (proxy addr = nil) because the metadata
+      # link-local address must never be routed through a proxy.
+      #
+      # When +audience+ is nil the default "conjur/{account}/host/{identity}" is used,
+      # matching the conventional authn-jwt/gcp policy. Pass an explicit audience to
+      # match a policy configured with a different value.
+      def fetch_gcp_jwt(account, identity, gcp_identity_url:, audience: nil)
+        aud = audience || default_gcp_audience(account, identity)
+        url = "#{gcp_identity_url}?#{URI.encode_www_form(audience: aud, format: 'full')}"
+
+        uri  = URI(url)
+        http = Net::HTTP.new(uri.host, uri.port, nil) # nil = no proxy
+        response = http.get(uri.request_uri, 'Metadata-Flavor' => 'Google')
+
+        unless response.is_a?(Net::HTTPSuccess)
+          raise "GCP metadata token request failed: #{response.code} #{response.message}. Body: #{response.body}"
+        end
+
+        token = response.body&.strip
+        raise "GCP metadata service returned an empty token" if token.nil? || token.empty?
+
+        token
+      end
+
+      # Builds the conventional authn-jwt/gcp audience for a Conjur host identity,
+      # e.g. "conjur/myorg/host/data/app". The "host/" prefix is optional in the
+      # supplied identity and is normalized away before being re-applied.
+      def default_gcp_audience(account, identity)
+        normalized = identity.start_with?('host/') ? identity['host/'.length..] : identity
+        "conjur/#{account}/host/#{normalized}"
+      end
+    end
+
+    def init_from_gcp(identity,
+                      account: Conjur.configuration.account,
+                      service_id: GCPAuthenticator::DEFAULT_SERVICE_ID,
+                      jwt: nil,
+                      gcp_identity_url: GCPAuthenticator::DEFAULT_METADATA_URL,
+                      audience: nil,
+                      remote_ip: nil)
+      @remote_ip     = remote_ip
+      @authenticator = GCPAuthenticator.new(account, service_id, identity,
+                                             jwt: jwt, gcp_identity_url: gcp_identity_url,
+                                             audience: audience)
+      self
+    end
+  end
+end

data/lib/conjur/api/authn_iam.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'uri'
+
+module Conjur
+  class API
+    # Authenticator that uses AWS IAM credentials to obtain Conjur access tokens.
+    # Signs an AWS STS GetCallerIdentity request with SigV4, then POSTs the
+    # resulting headers as JSON to the Conjur authn-iam endpoint.
+    #
+    # Requires the +aws-sdk-core+ gem (not bundled with conjur-api).
+    # Add `gem 'aws-sdk-core'` to your Gemfile to use this authenticator.
+    class IAMAuthenticator
+      include TokenExpiration
+
+      DEFAULT_SERVICE_ID = 'prod'.freeze
+      DEFAULT_REGION     = 'us-east-1'.freeze
+
+      STS_GLOBAL_URL  = 'https://sts.amazonaws.com/?Action=GetCallerIdentity&Version=2011-06-15'.freeze
+      STS_REGIONAL_URL = 'https://sts.%<region>s.amazonaws.com/?Action=GetCallerIdentity&Version=2011-06-15'.freeze
+      STS_GLOBAL_SIGNING_REGION = 'us-east-1'.freeze
+
+      attr_reader :account, :service_id, :identity, :aws_region
+
+      def initialize(account, service_id, identity, aws_region = DEFAULT_REGION)
+        @account    = account
+        @service_id = service_id
+        @identity   = identity
+        @aws_region = aws_region
+        update_token_born
+      end
+
+      def refresh_token
+        Conjur::API.authenticate_iam(identity, account: account,
+                                               service_id: service_id,
+                                               aws_region: aws_region).tap do
+          update_token_born
+        end
+      end
+    end
+
+    class << self
+      # Create a {Conjur::API} instance authenticated via AWS IAM (authn-iam).
+      #
+      # AWS credentials are resolved from the default chain: environment variables
+      # (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN), then
+      # ~/.aws/credentials, then the EC2 instance profile.
+      #
+      # Requires the +aws-sdk-core+ gem.
+      #
+      # @param [String] identity Conjur host identity (e.g. "host/my-app/my-role")
+      # @param [String] service_id the authn-iam service ID (default: "prod")
+      # @param [String] account the Conjur organization account
+      # @param [String] aws_region AWS region for STS signing. Use "global" for the
+      #   global STS endpoint (signed as us-east-1).
+      # @param [String, nil] remote_ip optional IP address recorded in the audit log
+      # @return [Conjur::API]
+      def new_from_iam(identity,
+                       account: Conjur.configuration.account,
+                       service_id: IAMAuthenticator::DEFAULT_SERVICE_ID,
+                       aws_region: IAMAuthenticator::DEFAULT_REGION,
+                       remote_ip: nil)
+        self.new.init_from_iam(identity, account: account, service_id: service_id,
+                                         aws_region: aws_region, remote_ip: remote_ip)
+      end
+
+      # Authenticate via authn-iam and return a parsed Conjur access token.
+      #
+      # @param [String] identity Conjur host identity
+      # @param [String] service_id the authn-iam service ID
+      # @param [String] account the Conjur organization account
+      # @param [String] aws_region AWS region for STS signing
+      # @return [Hash] parsed access token
+      def authenticate_iam(identity,
+                           account: Conjur.configuration.account,
+                           service_id: IAMAuthenticator::DEFAULT_SERVICE_ID,
+                           aws_region: IAMAuthenticator::DEFAULT_REGION)
+        raise ArgumentError, "identity is required"   if identity.nil?   || identity.empty?
+        raise ArgumentError, "service_id is required" if service_id.nil? || service_id.empty?
+
+        begin
+          require 'aws-sdk-core'
+        rescue LoadError
+          raise LoadError,
+                "aws-sdk-core is required for IAM authentication. " \
+                "Add `gem 'aws-sdk-core'` to your Gemfile."
+        end
+
+        if Conjur.log
+          Conjur.log << "Authenticating #{identity} to account #{account} via authn-iam/#{service_id}\n"
+        end
+
+        signed_headers = build_iam_signed_headers(aws_region)
+        JSON.parse(url_for(:authn_iam_authenticate, account, service_id, identity)
+          .post(signed_headers.to_json, content_type: 'application/json'))
+      end
+
+      private
+
+      def build_iam_signed_headers(aws_region)
+        signing_region = aws_region == 'global' ? IAMAuthenticator::STS_GLOBAL_SIGNING_REGION : aws_region
+        sts_url = aws_region == 'global' || aws_region == IAMAuthenticator::STS_GLOBAL_SIGNING_REGION \
+          ? IAMAuthenticator::STS_GLOBAL_URL
+          : format(IAMAuthenticator::STS_REGIONAL_URL, region: aws_region)
+
+        provider = Aws::CredentialProviderChain.new.resolve
+        raise ArgumentError,
+              "No AWS credentials found. Configure an instance profile, " \
+              "environment variables (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY), " \
+              "or ~/.aws/credentials." unless provider
+
+        creds = provider.credentials
+        signer = Aws::Sigv4::Signer.new(
+          service:           'sts',
+          region:            signing_region,
+          access_key_id:     creds.access_key_id,
+          secret_access_key: creds.secret_access_key,
+          session_token:     creds.session_token
+        )
+
+        signed = signer.sign_request(http_method: 'GET', url: sts_url, headers: {}, body: '')
+        headers = signed.headers.dup
+        # Conjur expects these specific keys
+        headers['host'] = URI.parse(sts_url).host
+        headers.compact
+      end
+    end
+
+    def init_from_iam(identity,
+                      account: Conjur.configuration.account,
+                      service_id: IAMAuthenticator::DEFAULT_SERVICE_ID,
+                      aws_region: IAMAuthenticator::DEFAULT_REGION,
+                      remote_ip: nil)
+      @remote_ip     = remote_ip
+      @authenticator = IAMAuthenticator.new(account, service_id, identity, aws_region)
+      self
+    end
+  end
+end

data/lib/conjur/api/router.rb

@@ -42,6 +42,30 @@ module Conjur
         )[fully_escape account][fully_escape username]['authenticate']
       end
 
+      # POST /authn-azure/{service_id}/{account}/{login}/authenticate
+      def authn_azure_authenticate account, service_id, identity
+        RestClient::Resource.new(
+          Conjur.configuration.core_url,
+          Conjur.configuration.rest_client_options
+        )['authn-azure'][fully_escape service_id][fully_escape account][fully_escape identity]['authenticate']
+      end
+
+      # POST /authn-iam/{service_id}/{account}/{login}/authenticate
+      def authn_iam_authenticate account, service_id, identity
+        RestClient::Resource.new(
+          Conjur.configuration.core_url,
+          Conjur.configuration.rest_client_options
+        )['authn-iam'][fully_escape service_id][fully_escape account][fully_escape identity]['authenticate']
+      end
+
+      # POST /authn-jwt/{service_id}/{account}/{login}/authenticate
+      def authn_gcp_authenticate account, service_id, identity
+        RestClient::Resource.new(
+          Conjur.configuration.core_url,
+          Conjur.configuration.rest_client_options
+        )['authn-jwt'][fully_escape service_id][fully_escape account][fully_escape identity]['authenticate']
+      end
+
       # Builds the RestClient::Resource for an authn-cert authentication request.
       # cert_options must include :ssl_client_cert and :ssl_client_key so that
       # the client certificate is presented during the TLS handshake.

data/lib/conjur/api.rb

@@ -36,6 +36,9 @@ require 'conjur/log_source'
 require 'conjur/has_attributes'
 require 'conjur/api/authenticators'
 require 'conjur/api/authn'
+require 'conjur/api/authn_azure'
+require 'conjur/api/authn_iam'
+require 'conjur/api/authn_gcp'
 require 'conjur/api/authn_cert'
 require 'conjur/api/roles'
 require 'conjur/api/resources'

data/spec/authn_azure_spec.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'cgi'
+require 'conjur/api/router'
+
+describe Conjur::API, api: :dummy do
+  let(:service_id) { 'my-azure-service' }
+  let(:identity)   { 'host/my-app/azure-host' }
+  let(:azure_jwt)  { 'eyJhbGciOiJSUzI1NiJ9.azure-payload.sig' }
+  let(:raw_token)  { { 'protected' => 'p', 'payload' => 'pl', 'signature' => 's' } }
+
+  describe '.new_from_azure' do
+    it 'returns an API instance with an AzureAuthenticator' do
+      allow(Conjur::API).to receive(:authenticate_azure).and_return(raw_token)
+      api_instance = Conjur::API.new_from_azure(service_id, identity, account: account)
+      expect(api_instance).to be_a(Conjur::API)
+      expect(api_instance.authenticator).to be_a(Conjur::API::AzureAuthenticator)
+    end
+  end
+
+  describe '.authenticate_azure' do
+    let(:resource) { double('resource') }
+
+    before do
+      allow(Conjur::API).to receive(:url_for)
+        .with(:authn_azure_authenticate, account, service_id, identity)
+        .and_return(resource)
+      allow(resource).to receive(:post)
+        .with("jwt=#{CGI.escape(azure_jwt)}", content_type: 'application/x-www-form-urlencoded')
+        .and_return(raw_token.to_json)
+      allow(Conjur::API).to receive(:fetch_azure_jwt).and_return(azure_jwt)
+    end
+
+    it 'returns a parsed token' do
+      token = Conjur::API.authenticate_azure(service_id, identity, account: account)
+      expect(token).to eq(raw_token)
+    end
+
+    it 'raises ArgumentError when service_id is empty' do
+      expect { Conjur::API.authenticate_azure('', identity, account: account) }
+        .to raise_error(ArgumentError, /service_id is required/)
+    end
+
+    it 'raises ArgumentError when identity is empty' do
+      expect { Conjur::API.authenticate_azure(service_id, '', account: account) }
+        .to raise_error(ArgumentError, /identity is required/)
+    end
+  end
+
+  describe 'AzureAuthenticator#refresh_token' do
+    subject(:authenticator) do
+      Conjur::API::AzureAuthenticator.new(account, service_id, identity)
+    end
+
+    it 'delegates to authenticate_azure with stored credentials' do
+      expect(Conjur::API).to receive(:authenticate_azure)
+        .with(service_id, identity,
+              account: account,
+              resource_uri: Conjur::API::AzureAuthenticator::DEFAULT_RESOURCE,
+              client_id: nil,
+              imds_base_url: Conjur::API::AzureAuthenticator::DEFAULT_IMDS_BASE,
+              imds_api_version: Conjur::API::AzureAuthenticator::DEFAULT_IMDS_VER)
+        .and_return(raw_token)
+      expect(authenticator.refresh_token).to eq(raw_token)
+    end
+  end
+end
+
+describe Conjur::API::Router do
+  let(:account)    { 'myaccount' }
+  let(:service_id) { 'my-service' }
+  let(:identity)   { 'host/my-app/azure-host' }
+
+  before do
+    allow(Conjur.configuration).to receive(:core_url).and_return('https://conjur.example.com')
+    allow(Conjur.configuration).to receive(:rest_client_options).and_return({})
+  end
+
+  describe '#authn_azure_authenticate' do
+    subject { described_class.authn_azure_authenticate(account, service_id, identity) }
+
+    it 'returns a RestClient::Resource' do
+      expect(subject).to be_a(RestClient::Resource)
+    end
+
+    it 'builds the correct URL' do
+      expect(subject.url).to end_with('/authn-azure/my-service/myaccount/host%2Fmy-app%2Fazure-host/authenticate')
+    end
+  end
+end

data/spec/authn_gcp_spec.rb

@@ -0,0 +1,176 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'cgi'
+require 'conjur/api/router'
+
+describe Conjur::API, api: :dummy do
+  let(:service_id) { 'gcp' }
+  let(:identity)   { 'host/data/test/gcp-apps/test-app' }
+  let(:gcp_jwt)    { 'eyJhbGciOiJSUzI1NiJ9.gcp-payload.sig' }
+  let(:raw_token)  { { 'protected' => 'p', 'payload' => 'pl', 'signature' => 's' } }
+
+  describe '.new_from_gcp' do
+    it 'returns an API instance with a GCPAuthenticator' do
+      allow(Conjur::API).to receive(:authenticate_gcp).and_return(raw_token)
+      api_instance = Conjur::API.new_from_gcp(identity, account: account)
+      expect(api_instance).to be_a(Conjur::API)
+      expect(api_instance.authenticator).to be_a(Conjur::API::GCPAuthenticator)
+    end
+  end
+
+  describe '.authenticate_gcp' do
+    let(:resource) { double('resource') }
+
+    before do
+      allow(Conjur::API).to receive(:url_for)
+        .with(:authn_gcp_authenticate, account, service_id, identity)
+        .and_return(resource)
+      allow(resource).to receive(:post)
+        .with("jwt=#{CGI.escape(gcp_jwt)}", content_type: 'application/x-www-form-urlencoded')
+        .and_return(raw_token.to_json)
+    end
+
+    context 'with a pre-supplied JWT' do
+      it 'returns a parsed token without calling the metadata service' do
+        expect(Conjur::API).not_to receive(:fetch_gcp_jwt)
+        token = Conjur::API.authenticate_gcp(identity, account: account,
+                                                        service_id: service_id,
+                                                        jwt: gcp_jwt)
+        expect(token).to eq(raw_token)
+      end
+    end
+
+    context 'without a pre-supplied JWT' do
+      it 'fetches from the metadata service' do
+        allow(Conjur::API).to receive(:fetch_gcp_jwt).and_return(gcp_jwt)
+        token = Conjur::API.authenticate_gcp(identity, account: account, service_id: service_id)
+        expect(token).to eq(raw_token)
+      end
+    end
+
+    it 'raises ArgumentError when identity is empty' do
+      expect { Conjur::API.authenticate_gcp('', account: account) }
+        .to raise_error(ArgumentError, /identity is required/)
+    end
+
+    it 'raises ArgumentError when service_id is empty' do
+      expect { Conjur::API.authenticate_gcp(identity, account: account, service_id: '') }
+        .to raise_error(ArgumentError, /service_id is required/)
+    end
+  end
+
+  describe 'GCPAuthenticator#refresh_token' do
+    context 'with a pre-supplied JWT' do
+      subject(:authenticator) do
+        Conjur::API::GCPAuthenticator.new(account, service_id, identity, jwt: gcp_jwt)
+      end
+
+      it 'passes the stored JWT to authenticate_gcp' do
+        expect(Conjur::API).to receive(:authenticate_gcp)
+          .with(identity,
+                account: account,
+                service_id: service_id,
+                jwt: gcp_jwt,
+                gcp_identity_url: Conjur::API::GCPAuthenticator::DEFAULT_METADATA_URL,
+                audience: nil)
+          .and_return(raw_token)
+        expect(authenticator.refresh_token).to eq(raw_token)
+      end
+    end
+
+    context 'without a pre-supplied JWT' do
+      subject(:authenticator) do
+        Conjur::API::GCPAuthenticator.new(account, service_id, identity)
+      end
+
+      it 'passes nil jwt to authenticate_gcp (which then calls metadata service)' do
+        expect(Conjur::API).to receive(:authenticate_gcp)
+          .with(identity,
+                account: account,
+                service_id: service_id,
+                jwt: nil,
+                gcp_identity_url: Conjur::API::GCPAuthenticator::DEFAULT_METADATA_URL,
+                audience: nil)
+          .and_return(raw_token)
+        expect(authenticator.refresh_token).to eq(raw_token)
+      end
+    end
+
+    context 'with a custom audience' do
+      subject(:authenticator) do
+        Conjur::API::GCPAuthenticator.new(account, service_id, identity,
+                                          audience: 'my-custom-audience')
+      end
+
+      it 'passes the stored audience to authenticate_gcp' do
+        expect(Conjur::API).to receive(:authenticate_gcp)
+          .with(identity,
+                account: account,
+                service_id: service_id,
+                jwt: nil,
+                gcp_identity_url: Conjur::API::GCPAuthenticator::DEFAULT_METADATA_URL,
+                audience: 'my-custom-audience')
+          .and_return(raw_token)
+        expect(authenticator.refresh_token).to eq(raw_token)
+      end
+    end
+  end
+
+  describe 'GCPAuthenticator audience building' do
+    it 'passes the identity and nil audience to fetch_gcp_jwt by default' do
+      allow(Conjur::API).to receive(:url_for).and_return(double(post: raw_token.to_json))
+      allow(Conjur::API).to receive(:fetch_gcp_jwt) do |acct, ident, gcp_identity_url:, audience:|
+        expect(ident).to eq(identity)
+        expect(audience).to be_nil
+        gcp_jwt
+      end
+      Conjur::API.authenticate_gcp(identity, account: account, service_id: service_id)
+    end
+
+    it 'forwards an explicit audience to fetch_gcp_jwt' do
+      allow(Conjur::API).to receive(:url_for).and_return(double(post: raw_token.to_json))
+      allow(Conjur::API).to receive(:fetch_gcp_jwt) do |acct, ident, gcp_identity_url:, audience:|
+        expect(audience).to eq('my-custom-audience')
+        gcp_jwt
+      end
+      Conjur::API.authenticate_gcp(identity, account: account, service_id: service_id,
+                                             audience: 'my-custom-audience')
+    end
+  end
+
+  describe '.default_gcp_audience' do
+    it 'strips a leading host/ and rebuilds the conjur audience' do
+      expect(Conjur::API.send(:default_gcp_audience, account, 'host/data/app'))
+        .to eq("conjur/#{account}/host/data/app")
+    end
+
+    it 'assumes a host identity when the host/ prefix is absent' do
+      expect(Conjur::API.send(:default_gcp_audience, account, 'data/app'))
+        .to eq("conjur/#{account}/host/data/app")
+    end
+  end
+end
+
+describe Conjur::API::Router do
+  let(:account)    { 'myaccount' }
+  let(:service_id) { 'gcp' }
+  let(:identity)   { 'host/data/test/gcp-apps/test-app' }
+
+  before do
+    allow(Conjur.configuration).to receive(:core_url).and_return('https://conjur.example.com')
+    allow(Conjur.configuration).to receive(:rest_client_options).and_return({})
+  end
+
+  describe '#authn_gcp_authenticate' do
+    subject { described_class.authn_gcp_authenticate(account, service_id, identity) }
+
+    it 'returns a RestClient::Resource' do
+      expect(subject).to be_a(RestClient::Resource)
+    end
+
+    it 'builds the correct URL using authn-jwt path' do
+      expect(subject.url).to end_with('/authn-jwt/gcp/myaccount/host%2Fdata%2Ftest%2Fgcp-apps%2Ftest-app/authenticate')
+    end
+  end
+end

data/spec/authn_iam_spec.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'conjur/api/router'
+
+describe Conjur::API, api: :dummy do
+  let(:service_id) { 'prod' }
+  let(:identity)   { 'host/my-app/my-role' }
+  let(:raw_token)  { { 'protected' => 'p', 'payload' => 'pl', 'signature' => 's' } }
+  let(:signed_headers) do
+    {
+      'Authorization'        => 'AWS4-HMAC-SHA256 Credential=AKIAEXAMPLE/...',
+      'x-amz-date'           => '20240101T000000Z',
+      'x-amz-content-sha256' => 'e3b0c44298fc1c149afbf4c8996fb924',
+      'x-amz-security-token' => 'token',
+      'host'                 => 'sts.amazonaws.com'
+    }
+  end
+
+  describe '.new_from_iam' do
+    it 'returns an API instance with an IAMAuthenticator' do
+      allow(Conjur::API).to receive(:authenticate_iam).and_return(raw_token)
+      api_instance = Conjur::API.new_from_iam(identity, account: account)
+      expect(api_instance).to be_a(Conjur::API)
+      expect(api_instance.authenticator).to be_a(Conjur::API::IAMAuthenticator)
+    end
+  end
+
+  describe '.authenticate_iam' do
+    let(:resource) { double('resource') }
+
+    before do
+      allow(Conjur::API).to receive(:require).with('aws-sdk-core')
+      allow(Conjur::API).to receive(:url_for)
+        .with(:authn_iam_authenticate, account, service_id, identity)
+        .and_return(resource)
+      allow(resource).to receive(:post)
+        .with(signed_headers.to_json, content_type: 'application/json')
+        .and_return(raw_token.to_json)
+      allow(Conjur::API).to receive(:build_iam_signed_headers).and_return(signed_headers)
+    end
+
+    it 'returns a parsed token' do
+      token = Conjur::API.authenticate_iam(identity, account: account, service_id: service_id)
+      expect(token).to eq(raw_token)
+    end
+
+    it 'raises ArgumentError when identity is empty' do
+      expect { Conjur::API.authenticate_iam('', account: account) }
+        .to raise_error(ArgumentError, /identity is required/)
+    end
+
+    it 'raises ArgumentError when service_id is empty' do
+      expect { Conjur::API.authenticate_iam(identity, account: account, service_id: '') }
+        .to raise_error(ArgumentError, /service_id is required/)
+    end
+
+    it 'raises LoadError when aws-sdk-core is unavailable' do
+      allow(Conjur::API).to receive(:require).with('aws-sdk-core').and_raise(LoadError)
+      expect { Conjur::API.authenticate_iam(identity, account: account) }
+        .to raise_error(LoadError, /aws-sdk-core/)
+    end
+  end
+
+  describe 'IAMAuthenticator#refresh_token' do
+    subject(:authenticator) do
+      Conjur::API::IAMAuthenticator.new(account, service_id, identity)
+    end
+
+    it 'delegates to authenticate_iam with stored credentials' do
+      expect(Conjur::API).to receive(:authenticate_iam)
+        .with(identity,
+              account: account,
+              service_id: service_id,
+              aws_region: Conjur::API::IAMAuthenticator::DEFAULT_REGION)
+        .and_return(raw_token)
+      expect(authenticator.refresh_token).to eq(raw_token)
+    end
+  end
+end
+
+describe Conjur::API::Router do
+  let(:account)    { 'myaccount' }
+  let(:service_id) { 'prod' }
+  let(:identity)   { 'host/my-app/my-role' }
+
+  before do
+    allow(Conjur.configuration).to receive(:core_url).and_return('https://conjur.example.com')
+    allow(Conjur.configuration).to receive(:rest_client_options).and_return({})
+  end
+
+  describe '#authn_iam_authenticate' do
+    subject { described_class.authn_iam_authenticate(account, service_id, identity) }
+
+    it 'returns a RestClient::Resource' do
+      expect(subject).to be_a(RestClient::Resource)
+    end
+
+    it 'builds the correct URL' do
+      expect(subject.url).to end_with('/authn-iam/prod/myaccount/host%2Fmy-app%2Fmy-role/authenticate')
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: conjur-api
 version: !ruby/object:Gem::Version
-  version: 6.3.1.pre.829
+  version: 6.3.1.pre.846
 platform: ruby
 authors:
 - CyberArk Maintainers
@@ -342,7 +342,10 @@ files:
 - lib/conjur/api.rb
 - lib/conjur/api/authenticators.rb
 - lib/conjur/api/authn.rb
+- lib/conjur/api/authn_azure.rb
 - lib/conjur/api/authn_cert.rb
+- lib/conjur/api/authn_gcp.rb
+- lib/conjur/api/authn_iam.rb
 - lib/conjur/api/host_factories.rb
 - lib/conjur/api/ldap_sync.rb
 - lib/conjur/api/policies.rb
@@ -392,7 +395,10 @@ files:
 - spec/api/server_version_spec.rb
 - spec/api/version_check_spec.rb
 - spec/api_spec.rb
+- spec/authn_azure_spec.rb
 - spec/authn_cert_spec.rb
+- spec/authn_gcp_spec.rb
+- spec/authn_iam_spec.rb
 - spec/base_object_spec.rb
 - spec/cert_utils_spec.rb
 - spec/cidr_spec.rb
@@ -471,7 +477,10 @@ test_files:
 - spec/api/server_version_spec.rb
 - spec/api/version_check_spec.rb
 - spec/api_spec.rb
+- spec/authn_azure_spec.rb
 - spec/authn_cert_spec.rb
+- spec/authn_gcp_spec.rb
+- spec/authn_iam_spec.rb
 - spec/base_object_spec.rb
 - spec/cert_utils_spec.rb
 - spec/cidr_spec.rb