Project: CyberArk Conjur (Provisioning / Key Management)
File: authenticator_management_improvement.md

- - - - - - - - - - - - - - - - - Conjur authenticators are defined as sub-policies, under the `conjur` policy. Currently to define an authenticator, the user needs to complete the following steps: Read the documentation Understand how the authenticator policy is structured Create a policy yaml file that defines the authenticator Load the policy using Conjur CLI Fill the authenticator policy variables with their values Enable the authenticator through an environment variable or REST API call To delete an authenticator, the user needs to complete these steps. Either: Create a policy with a `!delete` statement, on the authenticator policy Load the policy using Conjur CLI Or: Update the `conjur` policy yaml file and take out the authenticator Reload the `conjur` policy using the `--replace` option The current user experience requires a certain level of expertise. The user needs to understand the policy structure of each authenticator and the process is comprised of multiple steps. This proposal offers an easier way for managing authenticators. The proposed solution is to add a few simple Conjur CLI commands (and possibly APIs, see two alternatives below), that would hide the complexity and provide a single step to perform each action: Defines a new authenticator in Conjur. Behind the scenes, this command will creat the authenticator policy and fill it with all its required data. If the data is not required to be given by the user, like the `authn-k8s` CA cert and key, the information will be generated automatically. conjur config authenticator add authenticator-type/service-id [parameters] ```shell script $ conjur config authenticator add authn-oidc/my-idp --provider-uri my-uri --id-token-user-property prop ``` URL `/:authenticator/:service_id/:account` Example: `/authn-oidc/my-idp/my-company` Method: `POST` URL Parameters: `:authenticator` - The authenticator type (e.g. authn-k8s, authn-oidc). `:service_id` - The name of the specific authenticator instance to be created. `:account` - The Conjur account in which to create the authenticator. Return Value: The API will return the appropriate HTTP code. If the operation was successful, it will also return the policy yaml that was loaded for the newly created authenticator. Deletes an existing authenticator in Conjur. Deletes the authenticator policy and deletes the authenticator from the enabled/disabled authenticators list. conjur config authenticator delete authenticator-type/service-id ```shell script $ conjur config authenticator delete authn-oidc/my-idp ``` URL `/:authenticator/:service_id/:account` Example: `/authn-oidc/my-idp/my-company` Method: `DELETE` URL Parameters: `:authenticator` - The authenticator type (e.g. authn-k8s, authn-oidc). `:service_id` - The name of the specific authenticator instance to be deleted. `:account` - The Conjur account in which to delete the authenticator. Return Value: The API will return the appropriate HTTP code. Updates an existing authenticator in Conjur. Updates the authenticator variables. conjur config authenticator update authenticator-type/service-id [parameters] ```shell script $ conjur config authenticator update authn-oidc/my-idp --provider-uri new-uri ``` URL `/:authenticator/:service_id/:account` Example: `/authn-oidc/my-idp/my-company` Method: `PATCH` URL Parameters: `:authenticator` - The authenticator type (e.g. authn-k8s,

`:service_id` - The name of the specific authenticator instance to update. `:account` - The Conjur account in which to update the authenticator. Return Value: The API will return the appropriate HTTP code. If the operation was successful, it will also return the update policy yaml of the modified authenticator. Enables an authenticator in the Conjur database (can be overriden by environment variable). conjur config authenticator enable authenticator-type/service-id ```shell script $ conjur config authenticator enable authn-oidc/my-idp ``` This already exists, please see the relevant documentation. Disables an authenticator in the Conjur database (can be overriden by environment variable). conjur config authenticator disable authenticator-type/service-id ```shell script $ conjur config authenticator disable authn-oidc/my-idp ``` This already exists, please see the relevant documentation. The new functionality will be developed on the Conjur side. New APIs will be exposed for this new functionality. The CLI will use these new APIs. In order for the CLI to remain up to date with the authenticator types, their required parameters and optional parameters, Conjur will expose an internal API that would provide this authenticator schema information. This API will be called by the CLI whenever this information will be needed. For example, when running `conjur config authenticator add/update {authenticator-type}/{service-id} --help`. The authenticators keep their same structure in Conjur. Users could still manage them in the way it's done today. These CLI commands are uniting policy loads and variable updates into a single step, therefore running the commands requires permissions to both load a policy under the `conjur` policy and to update the variables in that policy. The proposal only simplifies the steps, not adding or changing them, therefore the performance remain the same. No security implications. These new CLI commands perform the same action, with an easier experience. We will need to update the docs of every authenticator, to specify how to use the new CLI commands. In addition, we will need to add documentation for enabling/disabling authenticators. This feature requires Conjur + CLI release. High level delivery plan includes the following steps: | Functionality | Dev | Tests | |--|--|--| | Adding authenticators in Conjur | 5 days | 3 days | | Adding authenticators in CLI | 2 days | 1 days | | Deleting authenticators in Conjur | 3 days | 2 days | | Deleting authenticators in CLI | 1 days | 1 days | | Updating authenticators in Conjur | 2 days | 2 days | | Updating authenticators in CLI | 1 days | 1 days | | Enabling authenticators in CLI | 1 days | 2 days | | Disabling authenticators in CLI | 1 days | 2 days | | Adding Conjur authn schema internal API | 2 days | 2 days | | Modify deployment examples | 3 days | - | | Documentation | 2 days | - | Total: 39 days