Allow STS regional requests without 'Host' header

CHANGELOG.md

@@ -9,6 +9,12 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Nothing should go in this section, please add to the latest unreleased version
   (and update the corresponding date), or add a new version.
 
+## [1.19.6] - 2023-07-05
+
+### Fixed
+- Support Authn-IAM regional requests when host value is missing from signed headers.
+  [cyberark/conjur#2827](https://github.com/cyberark/conjur/pull/2827)
+
 ## [1.19.5] - 2023-06-29
 
 ### Security

app/domain/authentication/authn_iam/authenticator.rb

@@ -54,13 +54,34 @@ def extract_relevant_data(response)
 
       # Call to AWS STS endpoint using the provided authentication header
       def attempt_signed_request(signed_headers)
-        aws_request = URI("https://#{signed_headers['host']}/?Action=GetCallerIdentity&Version=2011-06-15")
-        begin
-          @client.get_response(aws_request, signed_headers)
+        region = extract_sts_region(signed_headers)
+
+        # Attempt request using the discovered region and return immediately if successful
+        response = aws_call(region: region, headers: signed_headers)
+        return response if response.code.to_i == 200
+
+        # If the discovered region is `us-east-1`, fallback to the global endpoint
+        if region == 'us-east-1'
+          @logger.debug(LogMessages::Authentication::AuthnIam::RetryWithGlobalEndpoint.new)
+          fallback_response = aws_call(region: 'global', headers: signed_headers)
+          return fallback_response if fallback_response.code.to_i == 200
+        end
 
-          # Handle any network failures with a generic verification error
+        return response
+      end
+
+      def aws_call(region:, headers:)
+        host = if region == 'global'
+          'sts.amazonaws.com'
+        else
+          "sts.#{region}.amazonaws.com"
+        end
+        aws_request = URI("https://#{host}/?Action=GetCallerIdentity&Version=2011-06-15")
+        begin
+          @client.get_response(aws_request, headers)
         rescue StandardError => e
-          raise(Errors::Authentication::AuthnIam::VerificationError.new(e))
+          # Handle any network failures with a generic verification error
+          raise(Errors::Authentication::AuthnIam::VerificationError, e)
         end
       end
 
@@ -76,6 +97,25 @@ def response_from_signed_request(aws_headers)
           body.dig('ErrorResponse', 'Error', 'Message').to_s.strip
         )
       end
+
+      # Extracts the STS region from the host header if it exists.
+      # If not, we use the authorization header's credential string, i.e.:
+      # Credential=AKIAIOSFODNN7EXAMPLE/20220830/us-east-1/sts/aws4_request
+      def extract_sts_region(signed_headers)
+        host = signed_headers['host']
+
+        if host == 'sts.amazonaws.com'
+          return 'global'
+        end
+
+        match = host&.match(%r{sts.([\w\-]+).amazonaws.com})
+        return match.captures.first if match
+
+        match = signed_headers['authorization']&.match(%r{Credential=[^/]+/[^/]+/([^/]+)/})
+        return match.captures.first if match
+
+        raise Errors::Authentication::AuthnIam::InvalidAWSHeaders, 'Failed to extract AWS region from authorization header'
+      end
     end
   end
 end

app/domain/logs.rb

@@ -282,6 +282,11 @@ module AuthnIam
         code: "CONJ00036D"
       )
 
+      RetryWithGlobalEndpoint = ::Util::TrackableLogMessageClass.new(
+        msg: "Retrying IAM request signed in 'us-east-1' region with global STS endpoint.",
+        code: "CONJ00043D"
+      )
+
     end
 
     module AuthnAzure

config/environments/development.rb

@@ -15,7 +15,7 @@
   # https://guides.rubyonrails.org/configuring.html#actiondispatch-hostauthorization
 
   # Accept multiple hosts for parallel tests
-  config.hosts << /^conjur[0-9]*$/
+  config.hosts << /conjur[0-9]*/
 
   # eager_load needed to make authentication work without the hacky
   # loading code...

dev/start

@@ -4,10 +4,6 @@
 set -ex
 set -o pipefail
 
-# CC servers can't find it for some reason.  Local shellcheck is fine.
-# shellcheck disable=SC1091
-source "../ci/oauth/keycloak/keycloak_functions.sh"
-
 # SCRIPT GLOBAL STATE
 
 # Set up VERSION file for local development
@@ -229,7 +225,14 @@ configure_oidc_authenticators() {
 }
 
 setup_keycloak() {
-  # Start keycloak docker compose service
+
+  pushd "../ci"
+  # CC servers can't find it for some reason.  Local shellcheck is fine.
+  # shellcheck disable=SC1091
+  source "oauth/keycloak/keycloak_functions.sh"
+  popd
+
+  # Start keycloak docker-compose service
   services+=(keycloak)
   docker compose up -d --no-deps "${services[@]}"