Policy Template Factory

.gitignore

@@ -70,4 +70,7 @@ gems/*/Gemfile.lock
 # Container commit marker
 conjur_git_commit
 
+# AuthnOIDC V2 w/ Identity setup
+dev/policies/authenticators/authn-oidc/identity-users.yml
+
 VERSION

CHANGELOG.md

@@ -9,17 +9,25 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Nothing should go in this section, please add to the latest unreleased version
   (and update the corresponding date), or add a new version.
 
-## [1.19.3] - 2023-03-21
+## [1.19.5] - 2023-05-16
+
+### Security
+- Update bundler to 2.2.33 to remove CVE-2021-43809
+  [cyberark/conjur#2804](https://github.com/cyberark/conjur/pull/2804/files)
+
+### Fixed
+- AuthnJWT now supports claims that include hyphens and inline namespaces.
+  [cyberark/conjur#2792](https://github.com/cyberark/conjur/pull/2792)
+- Authn-IAM now uses the host in the signed headers to determine which STS endpoint
+  (global or regional) to use for validation.
+
+## [1.19.4] - 2023-05-12
 
 ### Changed
-- Removes support for disabling the `CONJUR_FEATURE_PKCE_SUPPORT_ENABLED` flag.
-  [cyberark/conjur#2713](https://github.com/cyberark/conjur/pull/2713)
-- Routes on the `/roles/` API endpoints now correctly verify the existing of
-  a Role and return `404` when it doesn't exist or the caller has insufficient
-  privilege.
-  [cyberark/conjur#2755](https://github.com/cyberark/conjur/pull/2755)
+- OIDC tokens will now have a default ttl of 60 mins
+  [cyberark/conjur#2800](https://github.com/cyberark/conjur/pull/2800)
 
-## [1.19.2] - 2023-02-01
+## [1.19.3] - 2023-04-17
 
 ### Added
 - Conjur now logs when it detects that the Conjur configuration file
@@ -31,11 +39,22 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
   access controls work as expected for this role to access itself.
   [cyberark/conjur#2757](https://github.com/cyberark/conjur/pull/2757)
 
+### Changed
+- Removes support for disabling the `CONJUR_FEATURE_PKCE_SUPPORT_ENABLED` flag.
+  [cyberark/conjur#2713](https://github.com/cyberark/conjur/pull/2713)
+- Routes on the `/roles/` API endpoints now correctly verify the existing of
+  a Role and return `404` when it doesn't exist or the caller has insufficient
+  privilege.
+  [cyberark/conjur#2755](https://github.com/cyberark/conjur/pull/2755)
+
 ### Fixed
 - Fixed a thread-safety bug in secret retrieval when multiple threads attempt
   to decrypt a secret value with Slosilo/OpenSSL.
   [cyberark/slosilo#31](https://github.com/cyberark/slosilo/pull/31)
   [cyberark/conjur#2718](https://github.com/cyberark/conjur/pull/2718)
+- Incomplete HTTP proxy support in the Kubernetes Authenticator is fixed. This
+  allows for an HTTP proxy between Conjur and the Kubernetes API.
+  [cyberark/conjur#2766](https://github.com/cyberark/conjur/pull/2766)
 
 ### Security
 - Updated github-pages version in docs/Gemfile to allow upgrading activesupport
@@ -45,6 +64,11 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
   [cyberark/conjur#2739](https://github.com/cyberark/conjur/pull/2739)
 - Upgraded rack to v2.2.6.4 to resolve CVE-2023-27539
   [cyberark/conjur#2750](https://github.com/cyberark/conjur/pull/2750)
+- Updated nokogiri to 1.14.3 for CVE-2023-29469 and CVE-2023-28484 and rails to
+  6.1.7.3 for CVE-2023-28120 in Gemfile.lock, nokogiri to 1.1.4.3 for CVE-2023-29469
+  and commonmarker to 0.23.9 for CVE-2023-24824 and CVE-2023-26485 in docs/Gemfile.lock
+  (all Medium severity issues flagged by Dependabot)
+  [cyberark/conjur#2776](https://github.com/cyberark/conjur/pull/2776)
 
 ## [1.19.2] - 2022-01-13
 
@@ -114,7 +138,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ### Added
 - List resources request (`GET /resources`) now produce audit events.
-  ([cyberark/conjur#2652](https://github.com/cyberark/conjur/pull/2652)
+  [cyberark/conjur#2652](https://github.com/cyberark/conjur/pull/2652)
 
 ### Changed
 - AWS Access Key Rotation now preserves only one key
@@ -1021,7 +1045,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 ### Added
 - The first tagged version.
 
-[Unreleased]: https://github.com/cyberark/conjur/compare/v1.19.0...HEAD
+[Unreleased]: https://github.com/cyberark/conjur/compare/v1.19.3...HEAD
+[1.19.3]: https://github.com/cyberark/conjur/compare/v1.19.2...v1.19.3
+[1.19.2]: https://github.com/cyberark/conjur/compare/v1.19.1...v1.19.2
+[1.19.1]: https://github.com/cyberark/conjur/compare/v1.19.0...v1.19.1
 [1.19.0]: https://github.com/cyberark/conjur/compare/v1.18.5...v1.19.0
 [1.18.5]: https://github.com/cyberark/conjur/compare/v1.18.4...v1.18.5
 [1.18.4]: https://github.com/cyberark/conjur/compare/v1.18.3...v1.18.4

Dockerfile.fpm

@@ -5,7 +5,7 @@ RUN apt-get update -y && \
     apt-get install -y zlib1g-dev \
                        liblzma-dev
 
-ENV BUNDLER_VERSION 2.2.30
+ENV BUNDLER_VERSION 2.2.33
 RUN gem install --no-document bundler:$BUNDLER_VERSION fpm
 
 RUN mkdir -p /src/opt/conjur/project

Gemfile

@@ -46,7 +46,7 @@ gem "loofah", ">= 2.2.3"
 # the branch doesn't immediately break this link
 gem 'conjur-api', '~> 5.pre'
 gem 'conjur-policy-parser', path: 'gems/policy-parser'
-gem 'conjur-rack'
+gem 'conjur-rack', path: 'gems/conjur-rack'
 gem 'conjur-rack-heartbeat'
 gem 'rack-rewrite'
 
@@ -77,6 +77,8 @@ gem 'openid_connect'
 gem "anyway_config"
 gem 'i18n', '~> 1.8.11'
 
+gem 'json_schemer'
+
 group :development, :test do
   gem 'aruba'
   gem 'ci_reporter_rspec'
@@ -90,6 +92,7 @@ group :development, :test do
   gem 'faye-websocket'
   gem 'net-ssh'
   gem 'parallel'
+  gem 'parallel_tests'
   gem 'pry-byebug'
   gem 'pry-rails'
   gem 'rails-controller-testing'