Class: Conjur::API::CertAuthenticator

Inherits:
Object
  • Object
show all
Includes:
TokenExpiration
Defined in:
lib/conjur/api/authn_cert.rb

Overview

Authenticator that uses mutual TLS (authn-cert) to obtain Conjur access tokens. The client certificate is presented during the TLS handshake; an empty POST to the authn-cert endpoint returns a Conjur access token.

Two modes:

  • Request mode: host_id is provided; Conjur validates the cert matches the host.
  • SPIFFE mode: host_id is nil; Conjur derives the host from the cert's SPIFFE SAN URI.

Constant Summary

Constants included from TokenExpiration

TokenExpiration::TOKEN_STALE

Instance Attribute Summary collapse

Attributes included from TokenExpiration

#token_born

Instance Method Summary collapse

Methods included from TokenExpiration

#gettime, #needs_token_refresh?, #token_age, #update_token_born

Constructor Details

#initialize(account, service_id, cert, key, host_id = nil) ⇒ CertAuthenticator

Returns a new instance of CertAuthenticator.



20
21
22
23
24
25
26
27
 
# File 'lib/conjur/api/authn_cert.rb', line 20

def initialize(, service_id, cert, key, host_id = nil)
  @account    = 
  @service_id = service_id
  @cert       = cert
  @key        = key
  @host_id    = host_id
  update_token_born
end

Instance Attribute Details

#account ⇒ Object (readonly)

Returns the value of attribute account.



18
19
20
 
# File 'lib/conjur/api/authn_cert.rb', line 18

def 
  @account
end

#cert ⇒ Object (readonly)

Returns the value of attribute cert.



18
19
20
 
# File 'lib/conjur/api/authn_cert.rb', line 18

def cert
  @cert
end

#host_id ⇒ Object (readonly)

Returns the value of attribute host_id.



18
19
20
 
# File 'lib/conjur/api/authn_cert.rb', line 18

def host_id
  @host_id
end

#key ⇒ Object (readonly)

Returns the value of attribute key.



18
19
20
 
# File 'lib/conjur/api/authn_cert.rb', line 18

def key
  @key
end

#service_id ⇒ Object (readonly)

Returns the value of attribute service_id.



18
19
20
 
# File 'lib/conjur/api/authn_cert.rb', line 18

def service_id
  @service_id
end

Instance Method Details

#refresh_token ⇒ Object 



29
30
31
32
33
 
# File 'lib/conjur/api/authn_cert.rb', line 29

def refresh_token
  Conjur::API.authenticate_cert(service_id, cert, key, account: , host_id: host_id).tap do
    update_token_born
  end
end