Class: Conjur::API::GCPAuthenticator

Inherits:
Object
  • Object
show all
Includes:
TokenExpiration
Defined in:
lib/conjur/api/authn_gcp.rb

Overview

Authenticator that uses a GCP identity token to obtain Conjur access tokens. Fetches an identity JWT from the GCP Instance Metadata Service, then POSTs it to the Conjur authn-gcp endpoint.

authn-gcp is a serviceless authenticator: there is no service ID, and Conjur identifies the calling host from the token's claims (matched against the host's authn-gcp/project-id annotation), so the host id is not sent in the authenticate URL.

An explicit JWT may be supplied to bypass the metadata service fetch — useful in CI environments where the token is pre-fetched on a GCP agent.

Constant Summary collapse

DEFAULT_METADATA_URL = 
'http://metadata.google.internal/computeMetadata/v1' \
'/instance/service-accounts/default/identity'.freeze

Constants included from TokenExpiration

TokenExpiration::TOKEN_STALE

Instance Attribute Summary collapse

Attributes included from TokenExpiration

#token_born

Instance Method Summary collapse

Methods included from TokenExpiration

#gettime, #needs_token_refresh?, #token_age, #update_token_born

Constructor Details

#initialize(account, identity, jwt: nil, gcp_identity_url: DEFAULT_METADATA_URL) ⇒ GCPAuthenticator

Returns a new instance of GCPAuthenticator.



29
30
31
32
33
34
35
36
 
# File 'lib/conjur/api/authn_gcp.rb', line 29

def initialize(, identity, jwt: nil,
               gcp_identity_url: DEFAULT_METADATA_URL)
  @account          = 
  @identity         = identity
  @jwt              = jwt
  @gcp_identity_url = gcp_identity_url
  update_token_born
end

Instance Attribute Details

#account ⇒ Object (readonly)

Returns the value of attribute account.



27
28
29
 
# File 'lib/conjur/api/authn_gcp.rb', line 27

def 
  @account
end

#gcp_identity_url ⇒ Object (readonly)

Returns the value of attribute gcp_identity_url.



27
28
29
 
# File 'lib/conjur/api/authn_gcp.rb', line 27

def gcp_identity_url
  @gcp_identity_url
end

#identity ⇒ Object (readonly)

Returns the value of attribute identity.



27
28
29
 
# File 'lib/conjur/api/authn_gcp.rb', line 27

def identity
  @identity
end

#jwt ⇒ Object (readonly)

Returns the value of attribute jwt.



27
28
29
 
# File 'lib/conjur/api/authn_gcp.rb', line 27

def jwt
  @jwt
end

Instance Method Details

#refresh_token ⇒ Object 



38
39
40
41
42
43
44
 
# File 'lib/conjur/api/authn_gcp.rb', line 38

def refresh_token
  Conjur::API.authenticate_gcp(identity, account: ,
                                         jwt: jwt,
                                         gcp_identity_url: gcp_identity_url).tap do
    update_token_born
  end
end