conjur-api 6.3.1 → 6.4.0.pre.849

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7b56e1d0e5d393556c564aec43aed82569aee4fce4506f2781af39308dde858
-  data.tar.gz: 0e0f305d3ade218a69a327e0e7bb394ec70317719897942925fe13d4296a63b5
+  metadata.gz: a1cdd341c320a370b2fe2a1acc7897da7cf46646b0f2e753c4a36210b9bedad5
+  data.tar.gz: 98e3471100dfd37156b37f1f60d8ff6dfb730879e3ad1f919cca1334a429a295
 SHA512:
-  metadata.gz: 25cbc42d0c2b063b0eea9c575d2991fcb49c9097bb1b8b2389a3d718fe589aa0565b147053ec30aaa6696e0f340639fc8792ff8dfcc134dc9c075df9d6263178
-  data.tar.gz: 3aec2b8ee3ad4b6a58206dd50d8e3b57c369e370559518ccfcea6b0ee3a0b83a955430dbc6d1dc346447e4f0f9ccb490da406cb20126e4fe38297f5311f8ad72
+  metadata.gz: e4db5cfec0074e9aad0cd89f5fd3331a70c664c0132d3bed6b6cc14baa08bb4b986e3dcd553340675887d627298daf146bd3a282d416f310e46640bd0c94c7b6
+  data.tar.gz: 28cd1578c740d4913764573d7ebcdc04b7008a33a43526bd07cfa8c725fa388b5bb47d846dd2a9d7aa391cd0a1b21c3fd8d4a9afa11e0016001c0383955411f7

data/CHANGELOG.md

@@ -6,6 +6,33 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## Unreleased
 
+## [6.4.0] - 2026-08-06
+### Added
+- Cloud-native authenticators for Azure Managed Identity (`authn-azure`),
+  AWS IAM (`authn-iam`), and GCP workload identity (`authn-gcp`), exposed
+  via `Conjur::API.new_from_azure`, `.new_from_iam`, and `.new_from_gcp`
+  (CNJR-14213).
+- Live integration features for the cloud authenticators, gated behind the
+  `RUN_AWS_TESTS` / `RUN_AZURE_TESTS` / `RUN_GCP_TESTS` pipeline params and run
+  on dedicated cloud agents (excluded from the default suite) (CNJR-14213).
+
+### Changed
+- CI uses Conjur Enterprise 1.27.0+, which removed the `GET /public_keys` endpoint
+  (CNJR-11339). Dropped the Cucumber scenario that exercised that API; the client
+  method remains for open-source Conjur.
+- Retrieve the Cucumber admin API key via `conjurctl` in `test.sh` instead of rake,
+  avoiding Rails boot output corrupting the key on current Conjur images.
+- CI now tests against Ruby 3.3, 3.4, and 4.0. Dropped Ruby 3.2 (end of life)
+  and raised the minimum supported Ruby version accordingly.
+
+### Fixed
+- Set `CONJUR_AUTHN_ALLOWED_IP_RANGES` and `CONJUR_AUTHN_HTTP_ALLOWLIST` in the
+  test environment so Conjur's new SSRF guard does not block the authn-oidc
+  `provider-uri` fetch to the compose-local Keycloak server. (CNJR-13786)
+- Corrected `Conjur::API.new_from_gcp` / `authenticate_gcp` to target the
+  serviceless `authn-gcp` endpoint (`/authn-gcp/{account}/authenticate`) instead
+  of `authn-jwt`; the `service_id` argument was removed accordingly (CNJR-14213).
+
 ## [6.3.1] - 2026-07-16
 
 ### Added
@@ -24,15 +51,6 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Added `Conjur::API#fetch_policy` for retrieving policy data from the server,
   as YAML or JSON, with optional tree depth and size limits.
 
-### Changed
-- CI uses Conjur Enterprise 1.27.0+, which removed the `GET /public_keys` endpoint
-  (CNJR-11339). Dropped the Cucumber scenario that exercised that API; the client
-  method remains for open-source Conjur.
-- Retrieve the Cucumber admin API key via `conjurctl` in `test.sh` instead of rake,
-  avoiding Rails boot output corrupting the key on current Conjur images.
-- CI now tests against Ruby 3.3, 3.4, and 4.0. Dropped Ruby 3.2 (end of life)
-  and raised the minimum supported Ruby version accordingly.
-
 ## [6.2.0] - 2026-06-05
 
 ## [6.1.0] - 2025-12-10

data/Jenkinsfile

@@ -30,8 +30,23 @@ pipeline {
   }
 
   triggers {
-    cron(getDailyCronString())
-    parameterizedCron(getWeeklyCronString("H(1-5)","%MODE=RELEASE"))
+    // Declarative pipelines allow only one parameterizedCron trigger, so both
+    // schedules live in a single multi-line string. The daily build also
+    // exercises the cloud authenticators end-to-end; PR builds leave the
+    // RUN_*_TESTS params false, so those stages are skipped there.
+    parameterizedCron("""
+      ${getDailyCronString("%RUN_AWS_TESTS=true;RUN_AZURE_TESTS=true;RUN_GCP_TESTS=true")}
+      ${getWeeklyCronString("H(1-5)","%MODE=RELEASE")}
+    """)
+  }
+
+  parameters {
+    booleanParam(name: 'RUN_AWS_TESTS', defaultValue: false,
+      description: 'Run the authn-iam integration test on an AWS executor agent')
+    booleanParam(name: 'RUN_AZURE_TESTS', defaultValue: false,
+      description: 'Run the authn-azure integration test on an Azure executor agent')
+    booleanParam(name: 'RUN_GCP_TESTS', defaultValue: false,
+      description: 'Run the authn-jwt/gcp integration test (token fetched on a GCP agent)')
   }
 
   stages {
@@ -61,6 +76,17 @@ pipeline {
       steps {
         script {
           infrapool = getInfraPoolAgent.connected(type: "ExecutorV2", quantity: 1, duration: 1)[0]
+          // Provision dedicated cloud agents only when the matching cloud test
+          // is requested. These are real Azure/GCP VMs whose managed identity /
+          // service account the authenticators exercise against the live
+          // metadata service. The AWS test reuses the standard ExecutorV2 agent
+          // (which itself runs in AWS with an instance profile).
+          if (params.RUN_AZURE_TESTS) {
+            azureInfrapool = getInfraPoolAgent.connected(type: "AzureExecutorV2", quantity: 1, duration: 1)[0]
+          }
+          if (params.RUN_GCP_TESTS) {
+            gcpInfrapool = getInfraPoolAgent.connected(type: "GcpExecutorV2", quantity: 1, duration: 1)[0]
+          }
         }
       }
     }
@@ -125,6 +151,12 @@ pipeline {
         script {
           infrapool.agentSh "./test.sh"
           infrapool.agentStash name: 'reports4.0', includes: '**/reports/*.xml'
+          // Stash coverage from the full suite now. The cloud stages below run
+          // ./test.sh again on this agent, and jenkins_init wipes and regenerates
+          // coverage/ from a single cloud feature (no rspec) — which would drop
+          // the reported coverage well below the quality gate. Capturing it here
+          // keeps the submitted coverage that of the complete unit+cucumber run.
+          infrapool.agentStash name: 'coverage', includes: '**/coverage/**'
         }
       }
       post {
@@ -134,16 +166,101 @@ pipeline {
       }
     }
 
-    stage('Submit Coverage Report'){
-      steps{
+    stage('Run AWS IAM tests') {
+      when { expression { params.RUN_AWS_TESTS } }
+      environment {
+        INFRAPOOL_RUN_AWS_TESTS = 'true'
+        INFRAPOOL_RUBY_VERSION  = '3.3'
+        INFRAPOOL_REGISTRY_URL  = "registry.tld"
+      }
+      steps {
         script {
-          infrapool.agentStash name: 'coverage', includes: '**/coverage/**'
+          // authn-iam identifies the Conjur host by the AWS caller identity, so
+          // the host id in the policy must be "<account-id>/<role-name>". Derive
+          // those from the agent's own instance profile (as conjur-api-java does)
+          // and pass them to the feature via env.
+          def callerIdentityJson = infrapool.agentSh(script: 'aws sts get-caller-identity', returnStdout: true).trim()
+          def awsAccountId = (callerIdentityJson =~ /"Account"\s*:\s*"([^"]+)"/)[0][1]
+          def awsArn       = (callerIdentityJson =~ /"Arn"\s*:\s*"([^"]+)"/)[0][1]
+          def awsRoleName  = awsArn.tokenize('/')[1]  // arn:...:assumed-role/<role>/<session>
+          infrapool.agentSh """
+            export INFRAPOOL_AWS_ACCOUNT_ID='${awsAccountId}'
+            export INFRAPOOL_AWS_ROLE_NAME='${awsRoleName}'
+            ./test.sh
+          """
+        }
+      }
+      post {
+        always {
+          script { infrapool.agentStash name: 'reports-aws', includes: '**/reports/*.xml' }
+          unstash 'reports-aws'
+        }
+      }
+    }
+
+    stage('Run Azure tests') {
+      when { expression { params.RUN_AZURE_TESTS } }
+      environment {
+        INFRAPOOL_RUN_AZURE_TESTS = 'true'
+        INFRAPOOL_RUBY_VERSION    = '3.3'
+        INFRAPOOL_REGISTRY_URL    = "registry.tld"
+      }
+      steps {
+        script {
+          // summon injects AZURE_SUBSCRIPTION_ID / AZURE_RESOURCE_GROUP /
+          // USER_ASSIGNED_IDENTITY_CLIENT_ID from the CI vault; the test hits
+          // the real Azure IMDS on this Azure VM.
+          azureInfrapool.agentSh "summon -e azure ./test.sh"
+        }
+      }
+      post {
+        always {
+          script { azureInfrapool.agentStash name: 'reports-azure', includes: '**/reports/*.xml' }
+          unstash 'reports-azure'
+        }
+      }
+    }
+
+    stage('Run GCP tests') {
+      when { expression { params.RUN_GCP_TESTS } }
+      environment {
+        INFRAPOOL_RUN_GCP_TESTS = 'true'
+        INFRAPOOL_RUBY_VERSION  = '3.3'
+        INFRAPOOL_REGISTRY_URL  = "registry.tld"
+        GCP_CTX_DIR = "gcp-ctx"
+      }
+      steps {
+        script {
+          // GCP agents lack a Docker runtime, so fetch a real identity token on
+          // the GCP VM, stash it, then run the actual test on the AWS agent with
+          // the token supplied via GCP_ID_TOKEN.
+          gcpInfrapool.agentSh "./ci/get_gcp_token.sh data/test/gcp-apps/test-app cucumber ${GCP_CTX_DIR}"
+          gcpInfrapool.agentStash name: 'gcp-token', includes: "${GCP_CTX_DIR}/*"
+          infrapool.agentUnstash name: 'gcp-token'
+          infrapool.agentSh """
+            export GCP_ID_TOKEN="\$(cat ${GCP_CTX_DIR}/token)"
+            export GCP_PROJECT_ID="\$(cat ${GCP_CTX_DIR}/project-id)"
+            ./test.sh
+          """
+        }
+      }
+      post {
+        always {
+          script { infrapool.agentStash name: 'reports-gcp', includes: '**/reports/*.xml' }
+          unstash 'reports-gcp'
         }
+      }
+    }
+
+    stage('Submit Coverage Report'){
+      steps{
+        // Coverage was stashed at the end of 'Test Ruby 4.0', before the cloud
+        // stages regenerated a partial coverage/ on the agent.
         unstash 'coverage'
 
         recordCoverage(
           tools: [[parser: 'COBERTURA', pattern: 'coverage/coverage.xml']],
-          sourceCodeEncoding: 'ASCII',
+          sourceCodeEncoding: 'UTF-8',
           qualityGates: [
             [threshold: 70.0, metric: 'LINE', baseline: 'PROJECT', unstable: true],
             [threshold: 70.0, metric: 'BRANCH', baseline: 'PROJECT', unstable: true],

data/Rakefile

@@ -23,8 +23,34 @@ begin
   require 'cucumber'
   require 'cucumber/rake/task'
 
+  # Cloud-authenticator features (authn-iam / authn-azure / authn-jwt gcp) are
+  # live integration tests that only work on the matching cloud agent, so they
+  # are excluded from the default suite and opted into via the CLOUD_AUTHN_TAG
+  # env var by the dedicated jenkins_cucumber_cloud task.
+  CLOUD_AUTHN_TAGS = %w[@authn_iam @authn_azure @authn_gcp].freeze
+
   Cucumber::Rake::Task.new(:cucumber) do |t|
-    t.cucumber_opts = "--tags 'not @wip' --format pretty --format junit --out features/reports"
+    exclude = (['@wip'] + CLOUD_AUTHN_TAGS).map { |tag| "not #{tag}" }.join(' and ')
+    t.cucumber_opts = "--tags '#{exclude}' --format pretty --format junit --out features/reports"
+  end
+
+  # Runs a single cloud-authenticator feature, selected by CLOUD_AUTHN_TAG
+  # (e.g. CLOUD_AUTHN_TAG=@authn_iam). Used by the cloud CI stages.
+  #
+  # NOTE: this block runs at Rakefile load time, so it must not raise when
+  # CLOUD_AUTHN_TAG is unset (that would break every other rake invocation).
+  # The value is validated in the :validate_cloud_authn_tag prerequisite,
+  # which only runs when this task is actually invoked. The fallback tag here
+  # is only a placeholder for the load-time cucumber_opts string.
+  Cucumber::Rake::Task.new(:cucumber_cloud) do |t|
+    tag = ENV['CLOUD_AUTHN_TAG'].to_s.empty? ? '@authn_iam' : ENV['CLOUD_AUTHN_TAG']
+    t.cucumber_opts = "--tags '#{tag}' --format pretty --format junit --out features/reports"
+  end
+
+  task :validate_cloud_authn_tag do
+    if ENV['CLOUD_AUTHN_TAG'].to_s.empty?
+      raise 'CLOUD_AUTHN_TAG must be set (e.g. @authn_iam) to run jenkins_cucumber_cloud'
+    end
   end
 
   begin
@@ -33,6 +59,7 @@ begin
     task :jenkins_init => [ :init_coverage, :cuke_report_cleanup ]
     task :jenkins_spec => [ :"ci:setup:rspec", :spec ]
     task :jenkins_cucumber => [ :cucumber ]
+    task :jenkins_cucumber_cloud => [ :validate_cloud_authn_tag, :cucumber_cloud ]
   rescue LoadError
     warn "ci_reporter_rspec not found, jenkins task will be unavailable"
   end

data/VERSION

@@ -1 +1 @@
-6.3.1
+6.4.0-849

data/ci/get_gcp_token.sh

@@ -0,0 +1,43 @@
+#!/bin/bash -e
+#
+# Fetch a GCP identity token from the instance metadata service.
+#
+# This is meant to run ON a GCP executor agent. GCP agents typically lack a
+# Docker runtime, so the authn-jwt/gcp integration test itself runs on a
+# different (e.g. AWS) agent. This script fetches a real identity token here,
+# writes it to a file, and the Jenkins pipeline stashes it and hands it to the
+# test container via the GCP_ID_TOKEN env var.
+#
+# Usage: ./ci/get_gcp_token.sh <host-id> <account> <output-dir>
+#   host-id     Conjur host id WITHOUT the "host/" prefix
+#               (e.g. "data/test/gcp-apps/test-app")
+#   account     Conjur account (e.g. "cucumber")
+#   output-dir  directory to write "token" and "project-id" into
+
+HOST_ID="${1:?host-id (without host/ prefix) is required}"
+ACCOUNT="${2:?account is required}"
+OUT_DIR="${3:?output directory is required}"
+
+METADATA_BASE="http://metadata.google.internal/computeMetadata/v1"
+AUDIENCE="conjur/${ACCOUNT}/host/${HOST_ID}"
+
+mkdir -p "${OUT_DIR}"
+
+echo "Fetching GCP identity token for audience: ${AUDIENCE}"
+token="$(curl -sS --noproxy '*' -H 'Metadata-Flavor: Google' \
+  "${METADATA_BASE}/instance/service-accounts/default/identity?audience=${AUDIENCE}&format=full")"
+
+# Sanity-check that we got a 3-part JWT rather than an HTML error page.
+if [[ "$(grep -o '\.' <<< "${token}" | wc -l | tr -d ' ')" != "2" ]]; then
+  echo "ERROR: metadata service did not return a JWT. Got:" >&2
+  echo "${token}" >&2
+  exit 1
+fi
+
+project_id="$(curl -sS --noproxy '*' -H 'Metadata-Flavor: Google' \
+  "${METADATA_BASE}/project/project-id")"
+
+printf '%s' "${token}"      > "${OUT_DIR}/token"
+printf '%s' "${project_id}" > "${OUT_DIR}/project-id"
+
+echo "Wrote ${OUT_DIR}/token and ${OUT_DIR}/project-id"

data/conjur-api.gemspec

@@ -40,4 +40,8 @@ Gem::Specification.new do |gem|
   gem.add_development_dependency 'pry-byebug'
   gem.add_development_dependency 'nokogiri'
   gem.add_development_dependency 'webrick'
+  # Optional runtime dependency for the IAM authenticator (authn-iam); not a
+  # hard dependency of the gem, but required to exercise it in the integration
+  # tests.
+  gem.add_development_dependency 'aws-sdk-core'
 end

data/docker-compose.yml

@@ -11,6 +11,21 @@ services:
     environment:
       DATABASE_URL: postgres://postgres@pg/postgres
       CONJUR_DATA_KEY: 'WMfApcDBtocRWV+ZSUP3Tjr5XNU+Z2FdBb6BEezejIs='
+      # NOTE: CONJUR_AUTHENTICATORS is intentionally left unset. When unset the
+      # server is permissive, so both the existing authn-oidc tests and the
+      # cloud-authenticator features can enable their authenticators at runtime
+      # via authenticator_enable. Setting an explicit allowlist here makes the
+      # server strict and breaks the authn-oidc scenarios, and any authenticators
+      # listed would show up in authenticator_list's "enabled" set (which the
+      # authenticators.feature assertions depend on staying ["authn"]).
+      #
+      # Conjur's SSRF guard blocks authenticator fetches (authn-oidc provider-uri here) that
+      # resolve to loopback/RFC1918 ranges or use plain HTTP. Keycloak is reached by compose
+      # service name, so it resolves inside the bridge network's private subnet and its
+      # discovery document advertises http://keycloak:8080 endpoints. Both guards must be
+      # opted out of for this test env. Mirrors conjur's own ci/docker-compose.yml.
+      CONJUR_AUTHN_ALLOWED_IP_RANGES: ${CONJUR_AUTHN_ALLOWED_IP_RANGES:-0.0.0.0/0,::/0}
+      CONJUR_AUTHN_HTTP_ALLOWLIST: ${CONJUR_AUTHN_HTTP_ALLOWLIST:-keycloak}
     volumes:
       - authn_local:/run/authn-local
       - ./ci/oauth/keycloak:/scripts

data/features/README.md

@@ -0,0 +1,80 @@
+# Cucumber integration features
+
+The default suite (run by `rake jenkins_cucumber` via `test.sh`) exercises the
+API against a local Conjur brought up by `docker-compose`.
+
+## Cloud authenticator features
+
+`authn_iam.feature`, `authn_azure.feature`, and `authn_gcp.feature` are **live
+integration tests** for the AWS IAM / Azure / GCP authenticators. They are
+tagged `@authn_iam` / `@authn_azure` / `@authn_gcp` and are **excluded from the
+default run** (see `Rakefile`), because they only pass on the matching cloud
+provider's infrastructure.
+
+### How they run in CI
+
+They are gated behind Jenkins boolean params `RUN_AWS_TESTS` / `RUN_AZURE_TESTS`
+/ `RUN_GCP_TESTS` (default `false`; enabled by the daily cron). When a flag is
+set, `test.sh` runs only that authenticator's feature against a real Conjur
+(with `CONJUR_AUTHENTICATORS` including the cloud authenticators) plus the real
+cloud metadata/STS service:
+
+- **AWS IAM** — runs on the standard `ExecutorV2` agent, which is itself in AWS
+  and carries an instance profile. The stage derives the caller identity with
+  `aws sts get-caller-identity` and passes `AWS_ACCOUNT_ID` / `AWS_ROLE_NAME`;
+  the Conjur host id is `<account-id>/<role-name>` (authn-iam matches the host
+  to the signing role). `new_from_iam` signs a real STS `GetCallerIdentity`
+  request.
+- **Azure** — runs on an `AzureExecutorV2` agent. `summon -e azure` injects
+  `AZURE_SUBSCRIPTION_ID`, `AZURE_RESOURCE_GROUP`, and
+  `USER_ASSIGNED_IDENTITY_CLIENT_ID`. `new_from_azure` fetches a JWT from the
+  real Azure IMDS (`169.254.169.254`); the feature derives the `provider-uri`
+  from that token's `iss` claim and annotates the host with the
+  subscription-id / resource-group restrictions.
+- **GCP** — GCP agents lack a Docker runtime, so the flow is split:
+  `ci/get_gcp_token.sh` fetches a real identity token on a `GcpExecutorV2`
+  agent, Jenkins stashes it, and the test runs on the AWS agent with the token
+  passed via `GCP_ID_TOKEN` (and `GCP_PROJECT_ID` for the host's
+  `authn-gcp/project-id` annotation). `new_from_gcp` exchanges that pre-fetched
+  token via the serviceless `authn-gcp` endpoint, bypassing the metadata service.
+
+`test.sh` forwards the cloud env vars into the tester container and clears
+`HTTP(S)_PROXY` / sets `NO_PROXY` so the link-local metadata endpoints are
+reachable directly.
+
+### Running one locally
+
+You must be on (or have credentials for) the relevant cloud. For example, on an
+AWS host with an appropriate instance profile / credentials:
+
+```sh
+RUN_AWS_TESTS=true ./test.sh
+```
+
+For GCP, fetch a token first (on a GCP host), then point the test at it:
+
+```sh
+./ci/get_gcp_token.sh data/test/gcp-apps/test-app cucumber gcp-ctx
+GCP_ID_TOKEN="$(cat gcp-ctx/token)" RUN_GCP_TESTS=true ./test.sh
+```
+
+### CI infrastructure these depend on
+
+The cloud stages authenticate against real provider infrastructure, so they
+rely on the following being in place (all currently provisioned in the
+Conjur-Enterprise CI):
+
+1. `AzureExecutorV2` / `GcpExecutorV2` InfraPool agent types, plus the standard
+   AWS `ExecutorV2` agent (used for AWS IAM and to run the GCP test).
+2. The `!var` references in `secrets.yml` (`ci/azure/...`) resolvable from the
+   CI Conjur vault, so `summon -e azure` can supply the `AZURE_*` /
+   `USER_ASSIGNED_IDENTITY_CLIENT_ID` values.
+3. Cloud identities matching how each feature builds its Conjur host:
+   - **AWS**: the executor's instance-profile role (host id `<account>/<role>`,
+     derived at runtime).
+   - **Azure**: the managed identity in the given subscription / resource-group.
+   - **GCP**: the `GcpExecutorV2` agent's service account, mapped to
+     `data/test/gcp-apps/test-app` via the `authn-gcp/project-id` annotation.
+
+If any of these change, a stage may fail with an opaque `401`; `test.sh` dumps
+the Conjur server log on cloud-test failure so the precise reason is visible.

data/features/authn_azure.feature

@@ -0,0 +1,15 @@
+@authn_azure
+Feature: Authenticate to Conjur using Azure Managed Identity (authn-azure)
+
+  This scenario is a live integration test: it exercises new_from_azure against
+  the real Azure Instance Metadata Service (IMDS). It is tagged @authn_azure and
+  is only run in CI on an Azure executor agent, gated by RUN_AZURE_TESTS, which
+  also supplies AZURE_SUBSCRIPTION_ID / AZURE_RESOURCE_GROUP / the user-assigned
+  identity client id. See Jenkinsfile and features/README.md.
+
+  Scenario: Authenticate with a system-assigned identity and retrieve a secret
+    Given I enable the authn-azure authenticator "prod" for host "test/azure-apps/test-app" using Azure environment config
+    And the secret "test/azure-apps/db-password" has value "s3cr3t"
+    When I authenticate via authn-azure as "host/test/azure-apps/test-app" with service id "prod"
+    Then I receive a Conjur access token
+    And I can retrieve the secret "test/azure-apps/db-password" with value "s3cr3t"

data/features/authn_gcp.feature

@@ -0,0 +1,19 @@
+@authn_gcp
+Feature: Authenticate to Conjur using GCP workload identity (authn-gcp)
+
+  This scenario is a live integration test. GCP executor agents typically lack a
+  Docker runtime, so the flow is split: ci/get_gcp_token.sh fetches a real GCP
+  identity token on the GCP agent, the pipeline hands it to this test via
+  GCP_ID_TOKEN, and new_from_gcp exchanges that pre-fetched token with Conjur
+  (bypassing the metadata service). Tagged @authn_gcp, gated by RUN_GCP_TESTS.
+  See Jenkinsfile and features/README.md.
+
+  authn-gcp is a serviceless authenticator: the host is identified by its
+  authn-gcp/project-id annotation (set from GCP_PROJECT_ID), not a service id.
+
+  Scenario: Authenticate with a pre-fetched GCP identity token and retrieve a secret
+    Given I enable the authn-gcp authenticator for host "data/test/gcp-apps/test-app"
+    And the secret "data/test/gcp-apps/db-password" has value "s3cr3t"
+    When I authenticate via authn-gcp as "host/data/test/gcp-apps/test-app" using the pre-fetched token
+    Then I receive a Conjur access token
+    And I can retrieve the secret "data/test/gcp-apps/db-password" with value "s3cr3t"

data/features/authn_iam.feature

@@ -0,0 +1,18 @@
+@authn_iam
+Feature: Authenticate to Conjur using AWS IAM (authn-iam)
+
+  This scenario is a live integration test: it exercises new_from_iam against
+  the real AWS STS service using the credentials of the host it runs on. It is
+  tagged @authn_iam and is only run in CI on an AWS executor agent, gated by
+  RUN_AWS_TESTS. See Jenkinsfile and features/README.md.
+
+  authn-iam identifies the Conjur host by the AWS caller identity, so the host
+  id is "<AWS_ACCOUNT_ID>/<AWS_ROLE_NAME>" (derived on the agent from
+  `aws sts get-caller-identity` and passed in via env).
+
+  Scenario: Authenticate and retrieve a secret via authn-iam
+    Given I enable the authn-iam authenticator "prod" for the AWS caller identity host
+    And the secret "test/iam-apps/db-password" has value "s3cr3t"
+    When I authenticate via authn-iam as the AWS caller identity host with service id "prod"
+    Then I receive a Conjur access token
+    And I can retrieve the secret "test/iam-apps/db-password" with value "s3cr3t"

data/features/step_definitions/cloud_authn_steps.rb

@@ -0,0 +1,182 @@
+require 'base64'
+require 'json'
+
+# Step definitions for the cloud authenticator integration features
+# (authn-iam, authn-azure, authn-gcp).
+#
+# These steps drive real Conjur (brought up by docker-compose) against the
+# cloud provider's real metadata/STS services. They are only meaningful when
+# run on the matching cloud agent, so the features carry @authn_iam /
+# @authn_azure / @authn_gcp tags and are gated by RUN_AWS_TESTS /
+# RUN_AZURE_TESTS / RUN_GCP_TESTS in the pipeline.
+
+# --- authn-iam -------------------------------------------------------------
+
+# authn-iam matches the Conjur host to the AWS caller identity, so the host id
+# must be "<account-id>/<role-name>" (supplied via env by the AWS CI stage).
+def aws_caller_identity_host_id
+  account = ENV.fetch('AWS_ACCOUNT_ID')
+  role    = ENV.fetch('AWS_ROLE_NAME')
+  "#{account}/#{role}"
+end
+
+Given(/^I enable the authn-iam authenticator "([^"]+)" for the AWS caller identity host$/) do |service_id|
+  host_id = aws_caller_identity_host_id
+  $conjur.load_policy 'root', <<-POLICY
+  - !policy
+    id: conjur/authn-iam/#{service_id}
+    body:
+    - !webservice
+    - !group apps
+    - !permit
+      role: !group apps
+      privilege: [ read, authenticate ]
+      resource: !webservice
+
+  - !host
+    id: #{host_id}
+    annotations:
+      authn-iam/#{service_id}: true
+
+  - !grant
+    role: !group conjur/authn-iam/#{service_id}/apps
+    member: !host #{host_id}
+  POLICY
+
+  @cloud_host_id = host_id
+  $conjur.authenticator_enable('authn-iam', service_id)
+end
+
+When(/^I authenticate via authn-iam as the AWS caller identity host with service id "([^"]+)"$/) do |service_id|
+  identity = "host/#{aws_caller_identity_host_id}"
+  @cloud_api = Conjur::API.new_from_iam(identity, service_id: service_id)
+  @result = @cloud_api.token
+end
+
+# --- authn-azure -----------------------------------------------------------
+
+# The authn-azure provider-uri must equal the token's actual issuer
+# (https://sts.windows.net/<tenant>/). Derive it from a real IMDS token's `iss`
+# claim rather than hardcoding, matching conjur-api-java's resolveProviderUriFromImds.
+def azure_provider_uri
+  jwt = Conjur::API.send(:fetch_azure_jwt,
+                         resource_uri: Conjur::API::AzureAuthenticator::DEFAULT_RESOURCE,
+                         client_id: (ENV['USER_ASSIGNED_IDENTITY_CLIENT_ID'] unless ENV['USER_ASSIGNED_IDENTITY_CLIENT_ID'].to_s.empty?),
+                         imds_base_url: Conjur::API::AzureAuthenticator::DEFAULT_IMDS_BASE,
+                         imds_api_version: Conjur::API::AzureAuthenticator::DEFAULT_IMDS_VER)
+  payload = JSON.parse(Base64.decode64(jwt.split('.')[1]))
+  issuer  = payload.fetch('iss')
+  issuer.end_with?('/') ? issuer : "#{issuer}/"
+end
+
+Given(/^I enable the authn-azure authenticator "([^"]+)" for host "([^"]+)" using Azure environment config$/) do |service_id, host_id|
+  subscription   = ENV.fetch('AZURE_SUBSCRIPTION_ID')
+  resource_group = ENV.fetch('AZURE_RESOURCE_GROUP')
+  provider_uri   = azure_provider_uri
+
+  $conjur.load_policy 'root', <<-POLICY
+  - !policy
+    id: conjur/authn-azure/#{service_id}
+    body:
+    - !webservice
+    - !variable provider-uri
+    - !group apps
+    - !permit
+      role: !group apps
+      privilege: [ read, authenticate ]
+      resource: !webservice
+
+  - !host
+    id: #{host_id}
+    annotations:
+      authn-azure/subscription-id: "#{subscription}"
+      authn-azure/resource-group: "#{resource_group}"
+
+  - !grant
+    role: !group conjur/authn-azure/#{service_id}/apps
+    member: !host #{host_id}
+  POLICY
+
+  @cloud_host_id = host_id
+  $conjur.resource("cucumber:variable:conjur/authn-azure/#{service_id}/provider-uri")
+         .add_value(provider_uri)
+  $conjur.authenticator_enable('authn-azure', service_id)
+end
+
+When(/^I authenticate via authn-azure as "([^"]+)" with service id "([^"]+)"(?: and client id "([^"]*)")?$/) do |identity, service_id, client_id|
+  # new_from_azure takes service_id and identity positionally; client_id is a keyword.
+  opts = {}
+  opts[:client_id] = client_id if client_id && !client_id.empty?
+  @cloud_api = Conjur::API.new_from_azure(service_id, identity, **opts)
+  @result = @cloud_api.token
+end
+
+# --- authn-gcp -------------------------------------------------------------
+
+Given(/^I enable the authn-gcp authenticator for host "([^"]+)"$/) do |host_id|
+  # authn-gcp is serviceless. The host is matched to the GCP identity token via
+  # its authn-gcp/project-id annotation, so the project id must be the one the
+  # token was issued for (supplied by ci/get_gcp_token.sh as GCP_PROJECT_ID).
+  project_id = ENV.fetch('GCP_PROJECT_ID')
+
+  $conjur.load_policy 'root', <<-POLICY
+  - !policy
+    id: conjur/authn-gcp
+    body:
+    - !webservice
+    - !group apps
+    - !permit
+      role: !group apps
+      privilege: [ read, authenticate ]
+      resource: !webservice
+
+  - !host
+    id: #{host_id}
+    annotations:
+      authn-gcp/project-id: "#{project_id}"
+
+  - !grant
+    role: !group conjur/authn-gcp/apps
+    member: !host #{host_id}
+  POLICY
+
+  @cloud_host_id = host_id
+  $conjur.authenticator_enable('authn-gcp', '')
+end
+
+When(/^I authenticate via authn-gcp as "([^"]+)" using the pre-fetched token$/) do |identity|
+  jwt = ENV['GCP_ID_TOKEN']
+  raise 'GCP_ID_TOKEN is not set; run ci/get_gcp_token.sh on a GCP agent first' if jwt.nil? || jwt.empty?
+
+  @cloud_api = Conjur::API.new_from_gcp(identity, jwt: jwt)
+  @result = @cloud_api.token
+end
+
+# --- shared assertions -----------------------------------------------------
+
+Then(/^I receive a Conjur access token$/) do
+  # Conjur access tokens are returned parsed into a Hash of the JWT parts.
+  expect(@result).to be_a(Hash)
+  expect(@result).to include('protected', 'payload', 'signature')
+end
+
+Given(/^the secret "([^"]+)" has value "([^"]+)"$/) do |var_id, value|
+  # Declare the variable and grant the cloud host permission to read it, then
+  # set the value. @cloud_host_id is captured by the "enable ... authenticator"
+  # step that always runs first.
+  raise 'no cloud host configured; run the "enable authenticator" step first' unless @cloud_host_id
+
+  $conjur.load_policy 'root', <<-POLICY
+  - !variable #{var_id}
+  - !permit
+    role: !host #{@cloud_host_id}
+    privilege: [ read, execute ]
+    resource: !variable #{var_id}
+  POLICY
+
+  $conjur.resource("cucumber:variable:#{var_id}").add_value(value)
+end
+
+Then(/^I can retrieve the secret "([^"]+)" with value "([^"]+)"$/) do |var_id, value|
+  expect(@cloud_api.resource("cucumber:variable:#{var_id}").value).to eq(value)
+end