conjur-api 6.3.1.pre.846 → 6.3.1.pre.848

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a22e04544db452dd276f8053e60ec40ba19dbeb6c8c74fa554f1abad9b9ddb37
-  data.tar.gz: 7997ace31344e73979de8a5e651526e0ca419862841e21475b5dec915ee5e444
+  metadata.gz: e94af8f767fd0324c87edb5648af755334c349670c1b4d50a2b4cec6927eb2f5
+  data.tar.gz: e5a01b8576510b3f21209b2a75790ee6f37607c011a8d0937481386e78d0746f
 SHA512:
-  metadata.gz: 36941d33ca17af4c45f9f475ae0dc25161a573bdb3c6d4a5f4c4d457078a1bc122fd63872d9983b835467a78e17ee0a0e0e6b5fd8186a95fd680459bf1f59e31
-  data.tar.gz: 0325c9377ed9aacd040f9d4cc0615c2ee0091460de22b52779cf4abec8fe9ed4e7d2ec6ec2ddde41fbecd9ad7099c2b1c3959776bcabd6275542afee8d592ba3
+  metadata.gz: 74c14463069c05daaa17c1c9aca5ffec2cc884835762c4a0bffaa0322158a3c09145badf7257b8bfdb19888b98b6298e548973111aa4463465da6f584621b95b
+  data.tar.gz: 6ed18e8e9acb13891834d729cd1fc5a4b678942b548be8418c58480517b90b0b28870a0a966dd176e2302e41e8026880d77acbfebd9eb027c0cfb7c9e0fb280d

data/CHANGELOG.md

@@ -7,9 +7,12 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 ## Unreleased
 ### Added
 - Cloud-native authenticators for Azure Managed Identity (`authn-azure`),
-  AWS IAM (`authn-iam`), and GCP workload identity (`authn-jwt/gcp`), exposed
+  AWS IAM (`authn-iam`), and GCP workload identity (`authn-gcp`), exposed
   via `Conjur::API.new_from_azure`, `.new_from_iam`, and `.new_from_gcp`
   (CNJR-14213).
+- Live integration features for the cloud authenticators, gated behind the
+  `RUN_AWS_TESTS` / `RUN_AZURE_TESTS` / `RUN_GCP_TESTS` pipeline params and run
+  on dedicated cloud agents (excluded from the default suite) (CNJR-14213).
 
 ### Changed
 - CI uses Conjur Enterprise 1.27.0+, which removed the `GET /public_keys` endpoint
@@ -24,6 +27,9 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Set `CONJUR_AUTHN_ALLOWED_IP_RANGES` and `CONJUR_AUTHN_HTTP_ALLOWLIST` in the
   test environment so Conjur's new SSRF guard does not block the authn-oidc
   `provider-uri` fetch to the compose-local Keycloak server. (CNJR-13786)
+- Corrected `Conjur::API.new_from_gcp` / `authenticate_gcp` to target the
+  serviceless `authn-gcp` endpoint (`/authn-gcp/{account}/authenticate`) instead
+  of `authn-jwt`; the `service_id` argument was removed accordingly (CNJR-14213).
 
 ## [6.3.1] - 2026-07-16
 

data/Jenkinsfile

@@ -30,8 +30,23 @@ pipeline {
   }
 
   triggers {
-    cron(getDailyCronString())
-    parameterizedCron(getWeeklyCronString("H(1-5)","%MODE=RELEASE"))
+    // Declarative pipelines allow only one parameterizedCron trigger, so both
+    // schedules live in a single multi-line string. The daily build also
+    // exercises the cloud authenticators end-to-end; PR builds leave the
+    // RUN_*_TESTS params false, so those stages are skipped there.
+    parameterizedCron("""
+      ${getDailyCronString("%RUN_AWS_TESTS=true;RUN_AZURE_TESTS=true;RUN_GCP_TESTS=true")}
+      ${getWeeklyCronString("H(1-5)","%MODE=RELEASE")}
+    """)
+  }
+
+  parameters {
+    booleanParam(name: 'RUN_AWS_TESTS', defaultValue: false,
+      description: 'Run the authn-iam integration test on an AWS executor agent')
+    booleanParam(name: 'RUN_AZURE_TESTS', defaultValue: false,
+      description: 'Run the authn-azure integration test on an Azure executor agent')
+    booleanParam(name: 'RUN_GCP_TESTS', defaultValue: false,
+      description: 'Run the authn-jwt/gcp integration test (token fetched on a GCP agent)')
   }
 
   stages {
@@ -61,6 +76,17 @@ pipeline {
       steps {
         script {
           infrapool = getInfraPoolAgent.connected(type: "ExecutorV2", quantity: 1, duration: 1)[0]
+          // Provision dedicated cloud agents only when the matching cloud test
+          // is requested. These are real Azure/GCP VMs whose managed identity /
+          // service account the authenticators exercise against the live
+          // metadata service. The AWS test reuses the standard ExecutorV2 agent
+          // (which itself runs in AWS with an instance profile).
+          if (params.RUN_AZURE_TESTS) {
+            azureInfrapool = getInfraPoolAgent.connected(type: "AzureExecutorV2", quantity: 1, duration: 1)[0]
+          }
+          if (params.RUN_GCP_TESTS) {
+            gcpInfrapool = getInfraPoolAgent.connected(type: "GcpExecutorV2", quantity: 1, duration: 1)[0]
+          }
         }
       }
     }
@@ -125,6 +151,12 @@ pipeline {
         script {
           infrapool.agentSh "./test.sh"
           infrapool.agentStash name: 'reports4.0', includes: '**/reports/*.xml'
+          // Stash coverage from the full suite now. The cloud stages below run
+          // ./test.sh again on this agent, and jenkins_init wipes and regenerates
+          // coverage/ from a single cloud feature (no rspec) — which would drop
+          // the reported coverage well below the quality gate. Capturing it here
+          // keeps the submitted coverage that of the complete unit+cucumber run.
+          infrapool.agentStash name: 'coverage', includes: '**/coverage/**'
         }
       }
       post {
@@ -134,16 +166,101 @@ pipeline {
       }
     }
 
-    stage('Submit Coverage Report'){
-      steps{
+    stage('Run AWS IAM tests') {
+      when { expression { params.RUN_AWS_TESTS } }
+      environment {
+        INFRAPOOL_RUN_AWS_TESTS = 'true'
+        INFRAPOOL_RUBY_VERSION  = '3.3'
+        INFRAPOOL_REGISTRY_URL  = "registry.tld"
+      }
+      steps {
         script {
-          infrapool.agentStash name: 'coverage', includes: '**/coverage/**'
+          // authn-iam identifies the Conjur host by the AWS caller identity, so
+          // the host id in the policy must be "<account-id>/<role-name>". Derive
+          // those from the agent's own instance profile (as conjur-api-java does)
+          // and pass them to the feature via env.
+          def callerIdentityJson = infrapool.agentSh(script: 'aws sts get-caller-identity', returnStdout: true).trim()
+          def awsAccountId = (callerIdentityJson =~ /"Account"\s*:\s*"([^"]+)"/)[0][1]
+          def awsArn       = (callerIdentityJson =~ /"Arn"\s*:\s*"([^"]+)"/)[0][1]
+          def awsRoleName  = awsArn.tokenize('/')[1]  // arn:...:assumed-role/<role>/<session>
+          infrapool.agentSh """
+            export INFRAPOOL_AWS_ACCOUNT_ID='${awsAccountId}'
+            export INFRAPOOL_AWS_ROLE_NAME='${awsRoleName}'
+            ./test.sh
+          """
+        }
+      }
+      post {
+        always {
+          script { infrapool.agentStash name: 'reports-aws', includes: '**/reports/*.xml' }
+          unstash 'reports-aws'
+        }
+      }
+    }
+
+    stage('Run Azure tests') {
+      when { expression { params.RUN_AZURE_TESTS } }
+      environment {
+        INFRAPOOL_RUN_AZURE_TESTS = 'true'
+        INFRAPOOL_RUBY_VERSION    = '3.3'
+        INFRAPOOL_REGISTRY_URL    = "registry.tld"
+      }
+      steps {
+        script {
+          // summon injects AZURE_SUBSCRIPTION_ID / AZURE_RESOURCE_GROUP /
+          // USER_ASSIGNED_IDENTITY_CLIENT_ID from the CI vault; the test hits
+          // the real Azure IMDS on this Azure VM.
+          azureInfrapool.agentSh "summon -e azure ./test.sh"
+        }
+      }
+      post {
+        always {
+          script { azureInfrapool.agentStash name: 'reports-azure', includes: '**/reports/*.xml' }
+          unstash 'reports-azure'
+        }
+      }
+    }
+
+    stage('Run GCP tests') {
+      when { expression { params.RUN_GCP_TESTS } }
+      environment {
+        INFRAPOOL_RUN_GCP_TESTS = 'true'
+        INFRAPOOL_RUBY_VERSION  = '3.3'
+        INFRAPOOL_REGISTRY_URL  = "registry.tld"
+        GCP_CTX_DIR = "gcp-ctx"
+      }
+      steps {
+        script {
+          // GCP agents lack a Docker runtime, so fetch a real identity token on
+          // the GCP VM, stash it, then run the actual test on the AWS agent with
+          // the token supplied via GCP_ID_TOKEN.
+          gcpInfrapool.agentSh "./ci/get_gcp_token.sh data/test/gcp-apps/test-app cucumber ${GCP_CTX_DIR}"
+          gcpInfrapool.agentStash name: 'gcp-token', includes: "${GCP_CTX_DIR}/*"
+          infrapool.agentUnstash name: 'gcp-token'
+          infrapool.agentSh """
+            export GCP_ID_TOKEN="\$(cat ${GCP_CTX_DIR}/token)"
+            export GCP_PROJECT_ID="\$(cat ${GCP_CTX_DIR}/project-id)"
+            ./test.sh
+          """
+        }
+      }
+      post {
+        always {
+          script { infrapool.agentStash name: 'reports-gcp', includes: '**/reports/*.xml' }
+          unstash 'reports-gcp'
         }
+      }
+    }
+
+    stage('Submit Coverage Report'){
+      steps{
+        // Coverage was stashed at the end of 'Test Ruby 4.0', before the cloud
+        // stages regenerated a partial coverage/ on the agent.
         unstash 'coverage'
 
         recordCoverage(
           tools: [[parser: 'COBERTURA', pattern: 'coverage/coverage.xml']],
-          sourceCodeEncoding: 'ASCII',
+          sourceCodeEncoding: 'UTF-8',
           qualityGates: [
             [threshold: 70.0, metric: 'LINE', baseline: 'PROJECT', unstable: true],
             [threshold: 70.0, metric: 'BRANCH', baseline: 'PROJECT', unstable: true],

data/Rakefile

@@ -23,8 +23,34 @@ begin
   require 'cucumber'
   require 'cucumber/rake/task'
 
+  # Cloud-authenticator features (authn-iam / authn-azure / authn-jwt gcp) are
+  # live integration tests that only work on the matching cloud agent, so they
+  # are excluded from the default suite and opted into via the CLOUD_AUTHN_TAG
+  # env var by the dedicated jenkins_cucumber_cloud task.
+  CLOUD_AUTHN_TAGS = %w[@authn_iam @authn_azure @authn_gcp].freeze
+
   Cucumber::Rake::Task.new(:cucumber) do |t|
-    t.cucumber_opts = "--tags 'not @wip' --format pretty --format junit --out features/reports"
+    exclude = (['@wip'] + CLOUD_AUTHN_TAGS).map { |tag| "not #{tag}" }.join(' and ')
+    t.cucumber_opts = "--tags '#{exclude}' --format pretty --format junit --out features/reports"
+  end
+
+  # Runs a single cloud-authenticator feature, selected by CLOUD_AUTHN_TAG
+  # (e.g. CLOUD_AUTHN_TAG=@authn_iam). Used by the cloud CI stages.
+  #
+  # NOTE: this block runs at Rakefile load time, so it must not raise when
+  # CLOUD_AUTHN_TAG is unset (that would break every other rake invocation).
+  # The value is validated in the :validate_cloud_authn_tag prerequisite,
+  # which only runs when this task is actually invoked. The fallback tag here
+  # is only a placeholder for the load-time cucumber_opts string.
+  Cucumber::Rake::Task.new(:cucumber_cloud) do |t|
+    tag = ENV['CLOUD_AUTHN_TAG'].to_s.empty? ? '@authn_iam' : ENV['CLOUD_AUTHN_TAG']
+    t.cucumber_opts = "--tags '#{tag}' --format pretty --format junit --out features/reports"
+  end
+
+  task :validate_cloud_authn_tag do
+    if ENV['CLOUD_AUTHN_TAG'].to_s.empty?
+      raise 'CLOUD_AUTHN_TAG must be set (e.g. @authn_iam) to run jenkins_cucumber_cloud'
+    end
   end
 
   begin
@@ -33,6 +59,7 @@ begin
     task :jenkins_init => [ :init_coverage, :cuke_report_cleanup ]
     task :jenkins_spec => [ :"ci:setup:rspec", :spec ]
     task :jenkins_cucumber => [ :cucumber ]
+    task :jenkins_cucumber_cloud => [ :validate_cloud_authn_tag, :cucumber_cloud ]
   rescue LoadError
     warn "ci_reporter_rspec not found, jenkins task will be unavailable"
   end

data/VERSION

@@ -1 +1 @@
-6.3.1-846
+6.3.1-848

data/ci/get_gcp_token.sh

@@ -0,0 +1,43 @@
+#!/bin/bash -e
+#
+# Fetch a GCP identity token from the instance metadata service.
+#
+# This is meant to run ON a GCP executor agent. GCP agents typically lack a
+# Docker runtime, so the authn-jwt/gcp integration test itself runs on a
+# different (e.g. AWS) agent. This script fetches a real identity token here,
+# writes it to a file, and the Jenkins pipeline stashes it and hands it to the
+# test container via the GCP_ID_TOKEN env var.
+#
+# Usage: ./ci/get_gcp_token.sh <host-id> <account> <output-dir>
+#   host-id     Conjur host id WITHOUT the "host/" prefix
+#               (e.g. "data/test/gcp-apps/test-app")
+#   account     Conjur account (e.g. "cucumber")
+#   output-dir  directory to write "token" and "project-id" into
+
+HOST_ID="${1:?host-id (without host/ prefix) is required}"
+ACCOUNT="${2:?account is required}"
+OUT_DIR="${3:?output directory is required}"
+
+METADATA_BASE="http://metadata.google.internal/computeMetadata/v1"
+AUDIENCE="conjur/${ACCOUNT}/host/${HOST_ID}"
+
+mkdir -p "${OUT_DIR}"
+
+echo "Fetching GCP identity token for audience: ${AUDIENCE}"
+token="$(curl -sS --noproxy '*' -H 'Metadata-Flavor: Google' \
+  "${METADATA_BASE}/instance/service-accounts/default/identity?audience=${AUDIENCE}&format=full")"
+
+# Sanity-check that we got a 3-part JWT rather than an HTML error page.
+if [[ "$(grep -o '\.' <<< "${token}" | wc -l | tr -d ' ')" != "2" ]]; then
+  echo "ERROR: metadata service did not return a JWT. Got:" >&2
+  echo "${token}" >&2
+  exit 1
+fi
+
+project_id="$(curl -sS --noproxy '*' -H 'Metadata-Flavor: Google' \
+  "${METADATA_BASE}/project/project-id")"
+
+printf '%s' "${token}"      > "${OUT_DIR}/token"
+printf '%s' "${project_id}" > "${OUT_DIR}/project-id"
+
+echo "Wrote ${OUT_DIR}/token and ${OUT_DIR}/project-id"

data/conjur-api.gemspec

@@ -40,4 +40,8 @@ Gem::Specification.new do |gem|
   gem.add_development_dependency 'pry-byebug'
   gem.add_development_dependency 'nokogiri'
   gem.add_development_dependency 'webrick'
+  # Optional runtime dependency for the IAM authenticator (authn-iam); not a
+  # hard dependency of the gem, but required to exercise it in the integration
+  # tests.
+  gem.add_development_dependency 'aws-sdk-core'
 end

data/docker-compose.yml

@@ -11,6 +11,14 @@ services:
     environment:
       DATABASE_URL: postgres://postgres@pg/postgres
       CONJUR_DATA_KEY: 'WMfApcDBtocRWV+ZSUP3Tjr5XNU+Z2FdBb6BEezejIs='
+      # NOTE: CONJUR_AUTHENTICATORS is intentionally left unset. When unset the
+      # server is permissive, so both the existing authn-oidc tests and the
+      # cloud-authenticator features can enable their authenticators at runtime
+      # via authenticator_enable. Setting an explicit allowlist here makes the
+      # server strict and breaks the authn-oidc scenarios, and any authenticators
+      # listed would show up in authenticator_list's "enabled" set (which the
+      # authenticators.feature assertions depend on staying ["authn"]).
+      #
       # Conjur's SSRF guard blocks authenticator fetches (authn-oidc provider-uri here) that
       # resolve to loopback/RFC1918 ranges or use plain HTTP. Keycloak is reached by compose
       # service name, so it resolves inside the bridge network's private subnet and its

data/features/README.md

@@ -0,0 +1,80 @@
+# Cucumber integration features
+
+The default suite (run by `rake jenkins_cucumber` via `test.sh`) exercises the
+API against a local Conjur brought up by `docker-compose`.
+
+## Cloud authenticator features
+
+`authn_iam.feature`, `authn_azure.feature`, and `authn_gcp.feature` are **live
+integration tests** for the AWS IAM / Azure / GCP authenticators. They are
+tagged `@authn_iam` / `@authn_azure` / `@authn_gcp` and are **excluded from the
+default run** (see `Rakefile`), because they only pass on the matching cloud
+provider's infrastructure.
+
+### How they run in CI
+
+They are gated behind Jenkins boolean params `RUN_AWS_TESTS` / `RUN_AZURE_TESTS`
+/ `RUN_GCP_TESTS` (default `false`; enabled by the daily cron). When a flag is
+set, `test.sh` runs only that authenticator's feature against a real Conjur
+(with `CONJUR_AUTHENTICATORS` including the cloud authenticators) plus the real
+cloud metadata/STS service:
+
+- **AWS IAM** — runs on the standard `ExecutorV2` agent, which is itself in AWS
+  and carries an instance profile. The stage derives the caller identity with
+  `aws sts get-caller-identity` and passes `AWS_ACCOUNT_ID` / `AWS_ROLE_NAME`;
+  the Conjur host id is `<account-id>/<role-name>` (authn-iam matches the host
+  to the signing role). `new_from_iam` signs a real STS `GetCallerIdentity`
+  request.
+- **Azure** — runs on an `AzureExecutorV2` agent. `summon -e azure` injects
+  `AZURE_SUBSCRIPTION_ID`, `AZURE_RESOURCE_GROUP`, and
+  `USER_ASSIGNED_IDENTITY_CLIENT_ID`. `new_from_azure` fetches a JWT from the
+  real Azure IMDS (`169.254.169.254`); the feature derives the `provider-uri`
+  from that token's `iss` claim and annotates the host with the
+  subscription-id / resource-group restrictions.
+- **GCP** — GCP agents lack a Docker runtime, so the flow is split:
+  `ci/get_gcp_token.sh` fetches a real identity token on a `GcpExecutorV2`
+  agent, Jenkins stashes it, and the test runs on the AWS agent with the token
+  passed via `GCP_ID_TOKEN` (and `GCP_PROJECT_ID` for the host's
+  `authn-gcp/project-id` annotation). `new_from_gcp` exchanges that pre-fetched
+  token via the serviceless `authn-gcp` endpoint, bypassing the metadata service.
+
+`test.sh` forwards the cloud env vars into the tester container and clears
+`HTTP(S)_PROXY` / sets `NO_PROXY` so the link-local metadata endpoints are
+reachable directly.
+
+### Running one locally
+
+You must be on (or have credentials for) the relevant cloud. For example, on an
+AWS host with an appropriate instance profile / credentials:
+
+```sh
+RUN_AWS_TESTS=true ./test.sh
+```
+
+For GCP, fetch a token first (on a GCP host), then point the test at it:
+
+```sh
+./ci/get_gcp_token.sh data/test/gcp-apps/test-app cucumber gcp-ctx
+GCP_ID_TOKEN="$(cat gcp-ctx/token)" RUN_GCP_TESTS=true ./test.sh
+```
+
+### CI infrastructure these depend on
+
+The cloud stages authenticate against real provider infrastructure, so they
+rely on the following being in place (all currently provisioned in the
+Conjur-Enterprise CI):
+
+1. `AzureExecutorV2` / `GcpExecutorV2` InfraPool agent types, plus the standard
+   AWS `ExecutorV2` agent (used for AWS IAM and to run the GCP test).
+2. The `!var` references in `secrets.yml` (`ci/azure/...`) resolvable from the
+   CI Conjur vault, so `summon -e azure` can supply the `AZURE_*` /
+   `USER_ASSIGNED_IDENTITY_CLIENT_ID` values.
+3. Cloud identities matching how each feature builds its Conjur host:
+   - **AWS**: the executor's instance-profile role (host id `<account>/<role>`,
+     derived at runtime).
+   - **Azure**: the managed identity in the given subscription / resource-group.
+   - **GCP**: the `GcpExecutorV2` agent's service account, mapped to
+     `data/test/gcp-apps/test-app` via the `authn-gcp/project-id` annotation.
+
+If any of these change, a stage may fail with an opaque `401`; `test.sh` dumps
+the Conjur server log on cloud-test failure so the precise reason is visible.

data/features/authn_azure.feature

@@ -0,0 +1,15 @@
+@authn_azure
+Feature: Authenticate to Conjur using Azure Managed Identity (authn-azure)
+
+  This scenario is a live integration test: it exercises new_from_azure against
+  the real Azure Instance Metadata Service (IMDS). It is tagged @authn_azure and
+  is only run in CI on an Azure executor agent, gated by RUN_AZURE_TESTS, which
+  also supplies AZURE_SUBSCRIPTION_ID / AZURE_RESOURCE_GROUP / the user-assigned
+  identity client id. See Jenkinsfile and features/README.md.
+
+  Scenario: Authenticate with a system-assigned identity and retrieve a secret
+    Given I enable the authn-azure authenticator "prod" for host "test/azure-apps/test-app" using Azure environment config
+    And the secret "test/azure-apps/db-password" has value "s3cr3t"
+    When I authenticate via authn-azure as "host/test/azure-apps/test-app" with service id "prod"
+    Then I receive a Conjur access token
+    And I can retrieve the secret "test/azure-apps/db-password" with value "s3cr3t"

data/features/authn_gcp.feature

@@ -0,0 +1,19 @@
+@authn_gcp
+Feature: Authenticate to Conjur using GCP workload identity (authn-gcp)
+
+  This scenario is a live integration test. GCP executor agents typically lack a
+  Docker runtime, so the flow is split: ci/get_gcp_token.sh fetches a real GCP
+  identity token on the GCP agent, the pipeline hands it to this test via
+  GCP_ID_TOKEN, and new_from_gcp exchanges that pre-fetched token with Conjur
+  (bypassing the metadata service). Tagged @authn_gcp, gated by RUN_GCP_TESTS.
+  See Jenkinsfile and features/README.md.
+
+  authn-gcp is a serviceless authenticator: the host is identified by its
+  authn-gcp/project-id annotation (set from GCP_PROJECT_ID), not a service id.
+
+  Scenario: Authenticate with a pre-fetched GCP identity token and retrieve a secret
+    Given I enable the authn-gcp authenticator for host "data/test/gcp-apps/test-app"
+    And the secret "data/test/gcp-apps/db-password" has value "s3cr3t"
+    When I authenticate via authn-gcp as "host/data/test/gcp-apps/test-app" using the pre-fetched token
+    Then I receive a Conjur access token
+    And I can retrieve the secret "data/test/gcp-apps/db-password" with value "s3cr3t"

data/features/authn_iam.feature

@@ -0,0 +1,18 @@
+@authn_iam
+Feature: Authenticate to Conjur using AWS IAM (authn-iam)
+
+  This scenario is a live integration test: it exercises new_from_iam against
+  the real AWS STS service using the credentials of the host it runs on. It is
+  tagged @authn_iam and is only run in CI on an AWS executor agent, gated by
+  RUN_AWS_TESTS. See Jenkinsfile and features/README.md.
+
+  authn-iam identifies the Conjur host by the AWS caller identity, so the host
+  id is "<AWS_ACCOUNT_ID>/<AWS_ROLE_NAME>" (derived on the agent from
+  `aws sts get-caller-identity` and passed in via env).
+
+  Scenario: Authenticate and retrieve a secret via authn-iam
+    Given I enable the authn-iam authenticator "prod" for the AWS caller identity host
+    And the secret "test/iam-apps/db-password" has value "s3cr3t"
+    When I authenticate via authn-iam as the AWS caller identity host with service id "prod"
+    Then I receive a Conjur access token
+    And I can retrieve the secret "test/iam-apps/db-password" with value "s3cr3t"

data/features/step_definitions/cloud_authn_steps.rb

@@ -0,0 +1,182 @@
+require 'base64'
+require 'json'
+
+# Step definitions for the cloud authenticator integration features
+# (authn-iam, authn-azure, authn-gcp).
+#
+# These steps drive real Conjur (brought up by docker-compose) against the
+# cloud provider's real metadata/STS services. They are only meaningful when
+# run on the matching cloud agent, so the features carry @authn_iam /
+# @authn_azure / @authn_gcp tags and are gated by RUN_AWS_TESTS /
+# RUN_AZURE_TESTS / RUN_GCP_TESTS in the pipeline.
+
+# --- authn-iam -------------------------------------------------------------
+
+# authn-iam matches the Conjur host to the AWS caller identity, so the host id
+# must be "<account-id>/<role-name>" (supplied via env by the AWS CI stage).
+def aws_caller_identity_host_id
+  account = ENV.fetch('AWS_ACCOUNT_ID')
+  role    = ENV.fetch('AWS_ROLE_NAME')
+  "#{account}/#{role}"
+end
+
+Given(/^I enable the authn-iam authenticator "([^"]+)" for the AWS caller identity host$/) do |service_id|
+  host_id = aws_caller_identity_host_id
+  $conjur.load_policy 'root', <<-POLICY
+  - !policy
+    id: conjur/authn-iam/#{service_id}
+    body:
+    - !webservice
+    - !group apps
+    - !permit
+      role: !group apps
+      privilege: [ read, authenticate ]
+      resource: !webservice
+
+  - !host
+    id: #{host_id}
+    annotations:
+      authn-iam/#{service_id}: true
+
+  - !grant
+    role: !group conjur/authn-iam/#{service_id}/apps
+    member: !host #{host_id}
+  POLICY
+
+  @cloud_host_id = host_id
+  $conjur.authenticator_enable('authn-iam', service_id)
+end
+
+When(/^I authenticate via authn-iam as the AWS caller identity host with service id "([^"]+)"$/) do |service_id|
+  identity = "host/#{aws_caller_identity_host_id}"
+  @cloud_api = Conjur::API.new_from_iam(identity, service_id: service_id)
+  @result = @cloud_api.token
+end
+
+# --- authn-azure -----------------------------------------------------------
+
+# The authn-azure provider-uri must equal the token's actual issuer
+# (https://sts.windows.net/<tenant>/). Derive it from a real IMDS token's `iss`
+# claim rather than hardcoding, matching conjur-api-java's resolveProviderUriFromImds.
+def azure_provider_uri
+  jwt = Conjur::API.send(:fetch_azure_jwt,
+                         resource_uri: Conjur::API::AzureAuthenticator::DEFAULT_RESOURCE,
+                         client_id: (ENV['USER_ASSIGNED_IDENTITY_CLIENT_ID'] unless ENV['USER_ASSIGNED_IDENTITY_CLIENT_ID'].to_s.empty?),
+                         imds_base_url: Conjur::API::AzureAuthenticator::DEFAULT_IMDS_BASE,
+                         imds_api_version: Conjur::API::AzureAuthenticator::DEFAULT_IMDS_VER)
+  payload = JSON.parse(Base64.decode64(jwt.split('.')[1]))
+  issuer  = payload.fetch('iss')
+  issuer.end_with?('/') ? issuer : "#{issuer}/"
+end
+
+Given(/^I enable the authn-azure authenticator "([^"]+)" for host "([^"]+)" using Azure environment config$/) do |service_id, host_id|
+  subscription   = ENV.fetch('AZURE_SUBSCRIPTION_ID')
+  resource_group = ENV.fetch('AZURE_RESOURCE_GROUP')
+  provider_uri   = azure_provider_uri
+
+  $conjur.load_policy 'root', <<-POLICY
+  - !policy
+    id: conjur/authn-azure/#{service_id}
+    body:
+    - !webservice
+    - !variable provider-uri
+    - !group apps
+    - !permit
+      role: !group apps
+      privilege: [ read, authenticate ]
+      resource: !webservice
+
+  - !host
+    id: #{host_id}
+    annotations:
+      authn-azure/subscription-id: "#{subscription}"
+      authn-azure/resource-group: "#{resource_group}"
+
+  - !grant
+    role: !group conjur/authn-azure/#{service_id}/apps
+    member: !host #{host_id}
+  POLICY
+
+  @cloud_host_id = host_id
+  $conjur.resource("cucumber:variable:conjur/authn-azure/#{service_id}/provider-uri")
+         .add_value(provider_uri)
+  $conjur.authenticator_enable('authn-azure', service_id)
+end
+
+When(/^I authenticate via authn-azure as "([^"]+)" with service id "([^"]+)"(?: and client id "([^"]*)")?$/) do |identity, service_id, client_id|
+  # new_from_azure takes service_id and identity positionally; client_id is a keyword.
+  opts = {}
+  opts[:client_id] = client_id if client_id && !client_id.empty?
+  @cloud_api = Conjur::API.new_from_azure(service_id, identity, **opts)
+  @result = @cloud_api.token
+end
+
+# --- authn-gcp -------------------------------------------------------------
+
+Given(/^I enable the authn-gcp authenticator for host "([^"]+)"$/) do |host_id|
+  # authn-gcp is serviceless. The host is matched to the GCP identity token via
+  # its authn-gcp/project-id annotation, so the project id must be the one the
+  # token was issued for (supplied by ci/get_gcp_token.sh as GCP_PROJECT_ID).
+  project_id = ENV.fetch('GCP_PROJECT_ID')
+
+  $conjur.load_policy 'root', <<-POLICY
+  - !policy
+    id: conjur/authn-gcp
+    body:
+    - !webservice
+    - !group apps
+    - !permit
+      role: !group apps
+      privilege: [ read, authenticate ]
+      resource: !webservice
+
+  - !host
+    id: #{host_id}
+    annotations:
+      authn-gcp/project-id: "#{project_id}"
+
+  - !grant
+    role: !group conjur/authn-gcp/apps
+    member: !host #{host_id}
+  POLICY
+
+  @cloud_host_id = host_id
+  $conjur.authenticator_enable('authn-gcp', '')
+end
+
+When(/^I authenticate via authn-gcp as "([^"]+)" using the pre-fetched token$/) do |identity|
+  jwt = ENV['GCP_ID_TOKEN']
+  raise 'GCP_ID_TOKEN is not set; run ci/get_gcp_token.sh on a GCP agent first' if jwt.nil? || jwt.empty?
+
+  @cloud_api = Conjur::API.new_from_gcp(identity, jwt: jwt)
+  @result = @cloud_api.token
+end
+
+# --- shared assertions -----------------------------------------------------
+
+Then(/^I receive a Conjur access token$/) do
+  # Conjur access tokens are returned parsed into a Hash of the JWT parts.
+  expect(@result).to be_a(Hash)
+  expect(@result).to include('protected', 'payload', 'signature')
+end
+
+Given(/^the secret "([^"]+)" has value "([^"]+)"$/) do |var_id, value|
+  # Declare the variable and grant the cloud host permission to read it, then
+  # set the value. @cloud_host_id is captured by the "enable ... authenticator"
+  # step that always runs first.
+  raise 'no cloud host configured; run the "enable authenticator" step first' unless @cloud_host_id
+
+  $conjur.load_policy 'root', <<-POLICY
+  - !variable #{var_id}
+  - !permit
+    role: !host #{@cloud_host_id}
+    privilege: [ read, execute ]
+    resource: !variable #{var_id}
+  POLICY
+
+  $conjur.resource("cucumber:variable:#{var_id}").add_value(value)
+end
+
+Then(/^I can retrieve the secret "([^"]+)" with value "([^"]+)"$/) do |var_id, value|
+  expect(@cloud_api.resource("cucumber:variable:#{var_id}").value).to eq(value)
+end

data/lib/conjur/api/authn_gcp.rb

@@ -9,94 +9,82 @@ module Conjur
   class API
     # Authenticator that uses a GCP identity token to obtain Conjur access tokens.
     # Fetches an identity JWT from the GCP Instance Metadata Service, then POSTs it
-    # to the Conjur authn-jwt/gcp endpoint.
+    # to the Conjur authn-gcp endpoint.
+    #
+    # authn-gcp is a serviceless authenticator: there is no service ID, and Conjur
+    # identifies the calling host from the token's claims (matched against the
+    # host's authn-gcp/project-id annotation), so the host id is not sent in the
+    # authenticate URL.
     #
     # An explicit JWT may be supplied to bypass the metadata service fetch —
     # useful in CI environments where the token is pre-fetched on a GCP agent.
     class GCPAuthenticator
       include TokenExpiration
 
-      DEFAULT_SERVICE_ID   = 'gcp'.freeze
       DEFAULT_METADATA_URL = 'http://metadata.google.internal/computeMetadata/v1' \
                              '/instance/service-accounts/default/identity'.freeze
 
-      attr_reader :account, :service_id, :identity, :jwt, :gcp_identity_url, :audience
+      attr_reader :account, :identity, :jwt, :gcp_identity_url
 
-      def initialize(account, service_id, identity, jwt: nil,
-                     gcp_identity_url: DEFAULT_METADATA_URL, audience: nil)
+      def initialize(account, identity, jwt: nil,
+                     gcp_identity_url: DEFAULT_METADATA_URL)
         @account          = account
-        @service_id       = service_id
         @identity         = identity
         @jwt              = jwt
         @gcp_identity_url = gcp_identity_url
-        @audience         = audience
         update_token_born
       end
 
       def refresh_token
         Conjur::API.authenticate_gcp(identity, account: account,
-                                               service_id: service_id,
                                                jwt: jwt,
-                                               gcp_identity_url: gcp_identity_url,
-                                               audience: audience).tap do
+                                               gcp_identity_url: gcp_identity_url).tap do
           update_token_born
         end
       end
     end
 
     class << self
-      # Create a {Conjur::API} instance authenticated via GCP workload identity (authn-jwt/gcp).
+      # Create a {Conjur::API} instance authenticated via GCP workload identity (authn-gcp).
       #
-      # @param [String] identity Conjur host identity (e.g. "host/data/test/gcp-apps/test-app")
-      # @param [String] service_id the authn-jwt service ID (default: "gcp")
+      # @param [String] identity Conjur host identity (e.g. "host/data/test/gcp-apps/test-app").
+      #   Used to build the metadata-service audience; Conjur itself derives the
+      #   host from the token, so it is not sent in the authenticate request.
       # @param [String] account the Conjur organization account
       # @param [String, nil] jwt pre-obtained GCP identity token; when supplied the metadata
       #   service is not called. Useful in tests and CI where the token is pre-fetched.
       # @param [String] gcp_identity_url override for the GCP metadata identity URL (for tests)
-      # @param [String, nil] audience the audience claim requested from the metadata service.
-      #   Must match the audience configured in the authn-jwt/gcp policy. Defaults to
-      #   "conjur/{account}/host/{identity}" when not supplied.
       # @param [String, nil] remote_ip optional IP address recorded in the audit log
       # @return [Conjur::API]
       def new_from_gcp(identity,
                        account: Conjur.configuration.account,
-                       service_id: GCPAuthenticator::DEFAULT_SERVICE_ID,
                        jwt: nil,
                        gcp_identity_url: GCPAuthenticator::DEFAULT_METADATA_URL,
-                       audience: nil,
                        remote_ip: nil)
-        self.new.init_from_gcp(identity, account: account, service_id: service_id,
-                                          jwt: jwt, gcp_identity_url: gcp_identity_url,
-                                          audience: audience, remote_ip: remote_ip)
+        self.new.init_from_gcp(identity, account: account,
+                                         jwt: jwt, gcp_identity_url: gcp_identity_url,
+                                         remote_ip: remote_ip)
       end
 
-      # Authenticate via authn-jwt/gcp and return a parsed Conjur access token.
+      # Authenticate via authn-gcp and return a parsed Conjur access token.
       #
-      # @param [String] identity Conjur host identity
-      # @param [String] service_id the authn-jwt service ID
+      # @param [String] identity Conjur host identity (used to build the audience)
       # @param [String] account the Conjur organization account
       # @param [String, nil] jwt pre-obtained GCP identity token
       # @param [String] gcp_identity_url override for the GCP metadata identity URL
-      # @param [String, nil] audience the audience claim requested from the metadata service.
-      #   Must match the audience configured in the authn-jwt/gcp policy. Defaults to
-      #   "conjur/{account}/host/{identity}" when not supplied.
       # @return [Hash] parsed access token
       def authenticate_gcp(identity,
                            account: Conjur.configuration.account,
-                           service_id: GCPAuthenticator::DEFAULT_SERVICE_ID,
                            jwt: nil,
-                           gcp_identity_url: GCPAuthenticator::DEFAULT_METADATA_URL,
-                           audience: nil)
-        raise ArgumentError, "identity is required"   if identity.nil?   || identity.empty?
-        raise ArgumentError, "service_id is required" if service_id.nil? || service_id.empty?
+                           gcp_identity_url: GCPAuthenticator::DEFAULT_METADATA_URL)
+        raise ArgumentError, "identity is required" if identity.nil? || identity.empty?
 
         if Conjur.log
-          Conjur.log << "Authenticating #{identity} to account #{account} via authn-jwt/#{service_id}\n"
+          Conjur.log << "Authenticating #{identity} to account #{account} via authn-gcp\n"
         end
 
-        token = jwt || fetch_gcp_jwt(account, identity,
-                                     gcp_identity_url: gcp_identity_url, audience: audience)
-        JSON.parse(url_for(:authn_gcp_authenticate, account, service_id, identity)
+        token = jwt || fetch_gcp_jwt(account, identity, gcp_identity_url: gcp_identity_url)
+        JSON.parse(url_for(:authn_gcp_authenticate, account)
           .post("jwt=#{CGI.escape(token)}", content_type: 'application/x-www-form-urlencoded'))
       end
 
@@ -106,11 +94,10 @@ module Conjur
       # Uses a direct Net::HTTP connection (proxy addr = nil) because the metadata
       # link-local address must never be routed through a proxy.
       #
-      # When +audience+ is nil the default "conjur/{account}/host/{identity}" is used,
-      # matching the conventional authn-jwt/gcp policy. Pass an explicit audience to
-      # match a policy configured with a different value.
-      def fetch_gcp_jwt(account, identity, gcp_identity_url:, audience: nil)
-        aud = audience || default_gcp_audience(account, identity)
+      # The requested audience is "conjur/{account}/host/{identity}", matching what
+      # the authn-gcp authenticator expects.
+      def fetch_gcp_jwt(account, identity, gcp_identity_url:)
+        aud = gcp_audience(account, identity)
         url = "#{gcp_identity_url}?#{URI.encode_www_form(audience: aud, format: 'full')}"
 
         uri  = URI(url)
@@ -127,10 +114,10 @@ module Conjur
         token
       end
 
-      # Builds the conventional authn-jwt/gcp audience for a Conjur host identity,
-      # e.g. "conjur/myorg/host/data/app". The "host/" prefix is optional in the
+      # Builds the authn-gcp audience for a Conjur host identity, e.g.
+      # "conjur/myorg/host/data/app". The "host/" prefix is optional in the
       # supplied identity and is normalized away before being re-applied.
-      def default_gcp_audience(account, identity)
+      def gcp_audience(account, identity)
         normalized = identity.start_with?('host/') ? identity['host/'.length..] : identity
         "conjur/#{account}/host/#{normalized}"
       end
@@ -138,15 +125,12 @@ module Conjur
 
     def init_from_gcp(identity,
                       account: Conjur.configuration.account,
-                      service_id: GCPAuthenticator::DEFAULT_SERVICE_ID,
                       jwt: nil,
                       gcp_identity_url: GCPAuthenticator::DEFAULT_METADATA_URL,
-                      audience: nil,
                       remote_ip: nil)
       @remote_ip     = remote_ip
-      @authenticator = GCPAuthenticator.new(account, service_id, identity,
-                                             jwt: jwt, gcp_identity_url: gcp_identity_url,
-                                             audience: audience)
+      @authenticator = GCPAuthenticator.new(account, identity,
+                                             jwt: jwt, gcp_identity_url: gcp_identity_url)
       self
     end
   end

data/lib/conjur/api/router.rb

@@ -58,12 +58,15 @@ module Conjur
         )['authn-iam'][fully_escape service_id][fully_escape account][fully_escape identity]['authenticate']
       end
 
-      # POST /authn-jwt/{service_id}/{account}/{login}/authenticate
-      def authn_gcp_authenticate account, service_id, identity
+      # POST /authn-gcp/{account}/authenticate
+      # authn-gcp is a serviceless authenticator: Conjur derives the host from
+      # the GCP identity token's claims, so neither a service id nor the login
+      # appears in the path.
+      def authn_gcp_authenticate account
         RestClient::Resource.new(
           Conjur.configuration.core_url,
           Conjur.configuration.rest_client_options
-        )['authn-jwt'][fully_escape service_id][fully_escape account][fully_escape identity]['authenticate']
+        )['authn-gcp'][fully_escape account]['authenticate']
       end
 
       # Builds the RestClient::Resource for an authn-cert authentication request.
@@ -86,10 +89,14 @@ module Conjur
       end
 
       def authenticator account, authenticator, service_id, credentials
-        RestClient::Resource.new(
+        resource = RestClient::Resource.new(
           Conjur.configuration.core_url,
           Conjur.configuration.create_rest_client_options(credentials)
-        )[fully_escape authenticator][fully_escape service_id][fully_escape account]
+        )[fully_escape authenticator]
+        # Serviceless authenticators (e.g. authn-gcp) have no service id segment:
+        # the path is authn-<type>/<account>.
+        resource = resource[fully_escape service_id] unless service_id.nil? || service_id.empty?
+        resource[fully_escape account]
       end
 
       def authenticators

data/secrets.yml

@@ -0,0 +1,13 @@
+# Summon secrets for CI. `summon -e <env> ./test.sh` resolves the !var
+# references below from the CI Conjur vault and exports them into the
+# environment for the wrapped command.
+#
+# The azure environment supplies the values the authn-azure integration
+# feature needs (see features/authn_azure.feature and features/README.md).
+# Mirrors the layout used by conjur-api-java / conjur-api-dotnet.
+azure:
+  RUN_AZURE_TESTS: "true"
+  AZURE_SUBSCRIPTION_ID: !var ci/azure/subscription-id
+  AZURE_RESOURCE_GROUP: !var ci/azure/authn-test/resource-group
+  USER_ASSIGNED_IDENTITY: !var ci/azure/authn-test/user-assigned-id
+  USER_ASSIGNED_IDENTITY_CLIENT_ID: !var ci/azure/authn-test/user-assigned-id-client-id

data/spec/authn_gcp_spec.rb

@@ -5,7 +5,6 @@ require 'cgi'
 require 'conjur/api/router'
 
 describe Conjur::API, api: :dummy do
-  let(:service_id) { 'gcp' }
   let(:identity)   { 'host/data/test/gcp-apps/test-app' }
   let(:gcp_jwt)    { 'eyJhbGciOiJSUzI1NiJ9.gcp-payload.sig' }
   let(:raw_token)  { { 'protected' => 'p', 'payload' => 'pl', 'signature' => 's' } }
@@ -24,7 +23,7 @@ describe Conjur::API, api: :dummy do
 
     before do
       allow(Conjur::API).to receive(:url_for)
-        .with(:authn_gcp_authenticate, account, service_id, identity)
+        .with(:authn_gcp_authenticate, account)
         .and_return(resource)
       allow(resource).to receive(:post)
         .with("jwt=#{CGI.escape(gcp_jwt)}", content_type: 'application/x-www-form-urlencoded')
@@ -34,9 +33,7 @@ describe Conjur::API, api: :dummy do
     context 'with a pre-supplied JWT' do
       it 'returns a parsed token without calling the metadata service' do
         expect(Conjur::API).not_to receive(:fetch_gcp_jwt)
-        token = Conjur::API.authenticate_gcp(identity, account: account,
-                                                        service_id: service_id,
-                                                        jwt: gcp_jwt)
+        token = Conjur::API.authenticate_gcp(identity, account: account, jwt: gcp_jwt)
         expect(token).to eq(raw_token)
       end
     end
@@ -44,7 +41,7 @@ describe Conjur::API, api: :dummy do
     context 'without a pre-supplied JWT' do
       it 'fetches from the metadata service' do
         allow(Conjur::API).to receive(:fetch_gcp_jwt).and_return(gcp_jwt)
-        token = Conjur::API.authenticate_gcp(identity, account: account, service_id: service_id)
+        token = Conjur::API.authenticate_gcp(identity, account: account)
         expect(token).to eq(raw_token)
       end
     end
@@ -53,27 +50,20 @@ describe Conjur::API, api: :dummy do
       expect { Conjur::API.authenticate_gcp('', account: account) }
         .to raise_error(ArgumentError, /identity is required/)
     end
-
-    it 'raises ArgumentError when service_id is empty' do
-      expect { Conjur::API.authenticate_gcp(identity, account: account, service_id: '') }
-        .to raise_error(ArgumentError, /service_id is required/)
-    end
   end
 
   describe 'GCPAuthenticator#refresh_token' do
     context 'with a pre-supplied JWT' do
       subject(:authenticator) do
-        Conjur::API::GCPAuthenticator.new(account, service_id, identity, jwt: gcp_jwt)
+        Conjur::API::GCPAuthenticator.new(account, identity, jwt: gcp_jwt)
       end
 
       it 'passes the stored JWT to authenticate_gcp' do
         expect(Conjur::API).to receive(:authenticate_gcp)
           .with(identity,
                 account: account,
-                service_id: service_id,
                 jwt: gcp_jwt,
-                gcp_identity_url: Conjur::API::GCPAuthenticator::DEFAULT_METADATA_URL,
-                audience: nil)
+                gcp_identity_url: Conjur::API::GCPAuthenticator::DEFAULT_METADATA_URL)
           .and_return(raw_token)
         expect(authenticator.refresh_token).to eq(raw_token)
       end
@@ -81,72 +71,29 @@ describe Conjur::API, api: :dummy do
 
     context 'without a pre-supplied JWT' do
       subject(:authenticator) do
-        Conjur::API::GCPAuthenticator.new(account, service_id, identity)
+        Conjur::API::GCPAuthenticator.new(account, identity)
       end
 
       it 'passes nil jwt to authenticate_gcp (which then calls metadata service)' do
         expect(Conjur::API).to receive(:authenticate_gcp)
           .with(identity,
                 account: account,
-                service_id: service_id,
-                jwt: nil,
-                gcp_identity_url: Conjur::API::GCPAuthenticator::DEFAULT_METADATA_URL,
-                audience: nil)
-          .and_return(raw_token)
-        expect(authenticator.refresh_token).to eq(raw_token)
-      end
-    end
-
-    context 'with a custom audience' do
-      subject(:authenticator) do
-        Conjur::API::GCPAuthenticator.new(account, service_id, identity,
-                                          audience: 'my-custom-audience')
-      end
-
-      it 'passes the stored audience to authenticate_gcp' do
-        expect(Conjur::API).to receive(:authenticate_gcp)
-          .with(identity,
-                account: account,
-                service_id: service_id,
                 jwt: nil,
-                gcp_identity_url: Conjur::API::GCPAuthenticator::DEFAULT_METADATA_URL,
-                audience: 'my-custom-audience')
+                gcp_identity_url: Conjur::API::GCPAuthenticator::DEFAULT_METADATA_URL)
           .and_return(raw_token)
         expect(authenticator.refresh_token).to eq(raw_token)
       end
     end
   end
 
-  describe 'GCPAuthenticator audience building' do
-    it 'passes the identity and nil audience to fetch_gcp_jwt by default' do
-      allow(Conjur::API).to receive(:url_for).and_return(double(post: raw_token.to_json))
-      allow(Conjur::API).to receive(:fetch_gcp_jwt) do |acct, ident, gcp_identity_url:, audience:|
-        expect(ident).to eq(identity)
-        expect(audience).to be_nil
-        gcp_jwt
-      end
-      Conjur::API.authenticate_gcp(identity, account: account, service_id: service_id)
-    end
-
-    it 'forwards an explicit audience to fetch_gcp_jwt' do
-      allow(Conjur::API).to receive(:url_for).and_return(double(post: raw_token.to_json))
-      allow(Conjur::API).to receive(:fetch_gcp_jwt) do |acct, ident, gcp_identity_url:, audience:|
-        expect(audience).to eq('my-custom-audience')
-        gcp_jwt
-      end
-      Conjur::API.authenticate_gcp(identity, account: account, service_id: service_id,
-                                             audience: 'my-custom-audience')
-    end
-  end
-
-  describe '.default_gcp_audience' do
+  describe '.gcp_audience' do
     it 'strips a leading host/ and rebuilds the conjur audience' do
-      expect(Conjur::API.send(:default_gcp_audience, account, 'host/data/app'))
+      expect(Conjur::API.send(:gcp_audience, account, 'host/data/app'))
         .to eq("conjur/#{account}/host/data/app")
     end
 
     it 'assumes a host identity when the host/ prefix is absent' do
-      expect(Conjur::API.send(:default_gcp_audience, account, 'data/app'))
+      expect(Conjur::API.send(:gcp_audience, account, 'data/app'))
         .to eq("conjur/#{account}/host/data/app")
     end
   end
@@ -154,8 +101,6 @@ end
 
 describe Conjur::API::Router do
   let(:account)    { 'myaccount' }
-  let(:service_id) { 'gcp' }
-  let(:identity)   { 'host/data/test/gcp-apps/test-app' }
 
   before do
     allow(Conjur.configuration).to receive(:core_url).and_return('https://conjur.example.com')
@@ -163,14 +108,14 @@ describe Conjur::API::Router do
   end
 
   describe '#authn_gcp_authenticate' do
-    subject { described_class.authn_gcp_authenticate(account, service_id, identity) }
+    subject { described_class.authn_gcp_authenticate(account) }
 
     it 'returns a RestClient::Resource' do
       expect(subject).to be_a(RestClient::Resource)
     end
 
-    it 'builds the correct URL using authn-jwt path' do
-      expect(subject.url).to end_with('/authn-jwt/gcp/myaccount/host%2Fdata%2Ftest%2Fgcp-apps%2Ftest-app/authenticate')
+    it 'builds the correct URL using the serviceless authn-gcp path' do
+      expect(subject.url).to end_with('/authn-gcp/myaccount/authenticate')
     end
   end
 end

data/test.sh

@@ -7,6 +7,22 @@ RUBY_VERSION="$(cut -d '-' -f 2 <<< "$RUBY_VERSION")"
 export REGISTRY_URL=${INFRAPOOL_REGISTRY_URL:-"docker.io"}
 export RUBY_VERSION="${INFRAPOOL_RUBY_VERSION:-$RUBY_VERSION}"
 
+# Cloud-authenticator integration toggles. These accept both plain and
+# INFRAPOOL_-prefixed variants (Jenkins injects the latter). When any is
+# "true", ONLY that authenticator's tagged feature runs against real cloud
+# infrastructure; the normal suite is skipped. Left unset by default so PR
+# builds run the ordinary unit + cucumber suite.
+RUN_AWS_TESTS="${INFRAPOOL_RUN_AWS_TESTS:-${RUN_AWS_TESTS:-false}}"
+RUN_AZURE_TESTS="${INFRAPOOL_RUN_AZURE_TESTS:-${RUN_AZURE_TESTS:-false}}"
+RUN_GCP_TESTS="${INFRAPOOL_RUN_GCP_TESTS:-${RUN_GCP_TESTS:-false}}"
+export RUN_AWS_TESTS RUN_AZURE_TESTS RUN_GCP_TESTS
+
+# authn-iam identifies the Conjur host by the AWS caller identity; the AWS stage
+# derives these from `aws sts get-caller-identity` on the agent.
+AWS_ACCOUNT_ID="${INFRAPOOL_AWS_ACCOUNT_ID:-${AWS_ACCOUNT_ID:-}}"
+AWS_ROLE_NAME="${INFRAPOOL_AWS_ROLE_NAME:-${AWS_ROLE_NAME:-}}"
+export AWS_ACCOUNT_ID AWS_ROLE_NAME
+
 source ./ci/oauth/keycloak/keycloak_functions.sh
 TOP_LEVEL=$(git rev-parse --show-toplevel)
 
@@ -23,6 +39,23 @@ if [ ! -f "${TOP_LEVEL}/VERSION" ]; then
   echo -n "0.0.dev" > "${TOP_LEVEL}/VERSION"
 fi
 
+# Returns the cloud-authn cucumber tag to run when a RUN_*_TESTS flag is set,
+# or empty for a normal run. Validates required env vars for the chosen cloud.
+function cloudAuthnTag() {
+  if [[ "$RUN_AWS_TESTS" == "true" ]]; then
+    : "${AWS_ACCOUNT_ID:?AWS_ACCOUNT_ID is required for IAM tests (derived from aws sts get-caller-identity)}"
+    : "${AWS_ROLE_NAME:?AWS_ROLE_NAME is required for IAM tests (derived from aws sts get-caller-identity)}"
+    echo '@authn_iam'
+  elif [[ "$RUN_AZURE_TESTS" == "true" ]]; then
+    : "${AZURE_SUBSCRIPTION_ID:?AZURE_SUBSCRIPTION_ID is required for Azure tests}"
+    : "${AZURE_RESOURCE_GROUP:?AZURE_RESOURCE_GROUP is required for Azure tests}"
+    echo '@authn_azure'
+  elif [[ "$RUN_GCP_TESTS" == "true" ]]; then
+    : "${GCP_ID_TOKEN:?GCP_ID_TOKEN is required for GCP tests (run ci/get_gcp_token.sh first)}"
+    echo '@authn_gcp'
+  fi
+}
+
 function main() {
   if ! docker info >/dev/null 2>&1; then
     echo "Docker does not seem to be running, run it first and retry"
@@ -31,6 +64,8 @@ function main() {
   # Generate reports folders locally
   mkdir -p spec/reports features/reports
 
+  CLOUD_AUTHN_TAG="$(cloudAuthnTag)"
+
   startConjur
   runTests
 }
@@ -54,6 +89,15 @@ function runTests() {
 
   local api_key=$(docker compose exec -T conjur conjurctl role retrieve-key cucumber:user:admin | tr -d '\r\n')
 
+  if [[ -n "$CLOUD_AUTHN_TAG" ]]; then
+    runCloudAuthnTests "$api_key"
+  else
+    runDefaultTests "$api_key"
+  fi
+}
+
+function runDefaultTests() {
+  local api_key="$1"
   echo 'Running tests'
   echo '-----'
   docker compose run --rm \
@@ -63,4 +107,38 @@ function runTests() {
     "/scripts/fetch_certificate && bundle exec rake jenkins_init jenkins_spec jenkins_cucumber"
 }
 
+# Runs a single cloud-authenticator feature against real cloud infrastructure.
+# Forwards the cloud provider env vars and clears proxies so the container can
+# reach the link-local metadata endpoints (169.254.169.254, metadata.google.internal).
+function runCloudAuthnTests() {
+  local api_key="$1"
+  echo "Running cloud authenticator tests: $CLOUD_AUTHN_TAG"
+  echo '-----'
+  local rc=0
+  docker compose run --rm \
+    -e CONJUR_AUTHN_API_KEY="$api_key" \
+    -e CLOUD_AUTHN_TAG="$CLOUD_AUTHN_TAG" \
+    -e NO_PROXY="169.254.169.254,metadata.google.internal,localhost,127.0.0.1,conjur" \
+    -e HTTP_PROXY="" -e HTTPS_PROXY="" -e http_proxy="" -e https_proxy="" \
+    -e AZURE_SUBSCRIPTION_ID="${AZURE_SUBSCRIPTION_ID:-}" \
+    -e AZURE_RESOURCE_GROUP="${AZURE_RESOURCE_GROUP:-}" \
+    -e USER_ASSIGNED_IDENTITY_CLIENT_ID="${USER_ASSIGNED_IDENTITY_CLIENT_ID:-}" \
+    -e GCP_ID_TOKEN="${GCP_ID_TOKEN:-}" \
+    -e GCP_PROJECT_ID="${GCP_PROJECT_ID:-}" \
+    -e AWS_ACCOUNT_ID="${AWS_ACCOUNT_ID:-}" \
+    -e AWS_ROLE_NAME="${AWS_ROLE_NAME:-}" \
+    tester \
+    "bundle exec rake jenkins_init jenkins_cucumber_cloud" || rc=$?
+
+  # On failure, dump the Conjur server log: authn-azure/iam/gcp rejections are
+  # logged there with the precise reason (issuer/annotation/audience mismatch),
+  # which the client only ever sees as an opaque 401.
+  if [[ $rc -ne 0 ]]; then
+    echo "=== cloud authn test failed; last 100 lines of Conjur server log ==="
+    docker compose logs --tail=100 conjur || true
+    echo '=== end Conjur server log ==='
+  fi
+  return $rc
+}
+
 main

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: conjur-api
 version: !ruby/object:Gem::Version
-  version: 6.3.1.pre.846
+  version: 6.3.1.pre.848
 platform: ruby
 authors:
 - CyberArk Maintainers
@@ -261,6 +261,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-core
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Conjur API
 email:
 - conj_maintainers@cyberark.com
@@ -291,6 +305,7 @@ files:
 - SECURITY.md
 - VERSION
 - ci/configure.sh
+- ci/get_gcp_token.sh
 - ci/oauth/keycloak/create_client
 - ci/oauth/keycloak/create_user
 - ci/oauth/keycloak/fetch_certificate
@@ -305,8 +320,12 @@ files:
 - dev/stop
 - docker-compose.yml
 - example/demo.rb
+- features/README.md
 - features/authenticators.feature
 - features/authn.feature
+- features/authn_azure.feature
+- features/authn_gcp.feature
+- features/authn_iam.feature
 - features/authn_local.feature
 - features/exists.feature
 - features/group.feature
@@ -322,6 +341,7 @@ files:
 - features/role_fields.feature
 - features/rotate_api_key.feature
 - features/step_definitions/api_steps.rb
+- features/step_definitions/cloud_authn_steps.rb
 - features/step_definitions/policy_steps.rb
 - features/step_definitions/result_steps.rb
 - features/support/env.rb
@@ -388,6 +408,7 @@ files:
 - lib/conjur/variable.rb
 - lib/conjur/webservice.rb
 - publish.sh
+- secrets.yml
 - spec/.conjurrc
 - spec/api/host_factories_spec.rb
 - spec/api/policies_spec.rb
@@ -443,8 +464,12 @@ rubygems_version: 4.0.10
 specification_version: 4
 summary: Conjur API
 test_files:
+- features/README.md
 - features/authenticators.feature
 - features/authn.feature
+- features/authn_azure.feature
+- features/authn_gcp.feature
+- features/authn_iam.feature
 - features/authn_local.feature
 - features/exists.feature
 - features/group.feature
@@ -460,6 +485,7 @@ test_files:
 - features/role_fields.feature
 - features/rotate_api_key.feature
 - features/step_definitions/api_steps.rb
+- features/step_definitions/cloud_authn_steps.rb
 - features/step_definitions/policy_steps.rb
 - features/step_definitions/result_steps.rb
 - features/support/env.rb