Abstract authentication flow into new interface

[szh]

Note: To see implementation in the CLI, see cyberark/cyberark-conjur-cli#410

Desired Outcome

Create a new AuthenticationStrategy interface that will allow us to abstract the authentication flow. The interface should
take a CredentialProvider and Conjur account as inputs, as well as any other arguments that are needed to authenticate,
such as service_id for LDAP. The interface should have a authenticate method which returns a Conjur auth token. All details of authentication should be handled by the AuthenticationStrategy interface.
Include unit tests and update existing unit and integration tests.

Implemented Changes

• Added AuthenticationStrategyInterface to abstract authentication logic
• Added AuthnAuthenticationStrategy which implements the interface for the default authn strategy
• Updated the Api class to use the interface to implement authentication

Connected Issue/Story

CyberArk internal issue link: ONYX-20429

Changelog

• The CHANGELOG has been updated, or
• This PR does not include user-facing changes and doesn't require a
  CHANGELOG update

Test coverage

• This PR includes new unit and integration tests to go with the code
  changes, or
• The changes in this PR do not require tests

Documentation

• Docs (e.g. READMEs) were updated in this PR
• A follow-up issue to update official docs has been filed here: insert issue ID
• This PR does not require updating any documentation

Behavior

• This PR changes product behavior and has been reviewed by a PO, or
• These changes are part of a larger initiative that will be reviewed later, or
• No behavior was changed with this PR

Security

• Security architect has reviewed the changes in this PR,
• These changes are part of a larger initiative with a separate security review, or
• There are no security aspects to these changes

[doodlesbykumbi]

Left some comments

[doodlesbykumbi]

I might be missing something on the authenticate signature on this interface. Not all authenticators use the api_key parameter. I think they each have their own set of parameters required to carry out authentication.

[szh]

Can you give me an example of an authenticator that doesn't use an api key? If you're referring to the JWT or GCP authenticators, they still have a string value that takes the place of an api_token. Maybe we can call this something else to make it more general?

[jvanderhoof]

I agree w/ @doodlesbykumbi. Only the default authenticator uses the API key. All other authenticators validate the external identity and return a Conjur Auth token.

What about injecting the strategy along the lines of:

credentials = CredentialsData(username=username, password=password, machine=conjur_url)
credentials_provider = SimpleCredentialsProvider()
credentials_provider.save(credentials)
del credentials

client = Client(connection_info,
                authentication_strategy=Authn(credentials_provider=credentials_provider)
                ssl_verification_mode=ssl_verification_mode)

client = Client(connection_info,
                authentication_strategy=AuthnLdap(credentials_provider=credentials_provider)
                ssl_verification_mode=ssl_verification_mode)

client = Client(connection_info,
                authentication_strategy=AuthnJwt(jwt='path-to-jwt')
                ssl_verification_mode=ssl_verification_mode)

If the Authentication Strategy interface includes a method (maybe authenticate), and returns a Conjur Auth Token, we can inject the "how" into our client.

[jvanderhoof]

As mentioned above, having this method take CredentialsData via a SimpleCredentialsProvider allows the authentication to be handled here.

As a note, we may need to add a second/alternative CredentialsData type to handle hostname/api key. Users exchange a username/password for an api key, then authenticate with the username/api key combination. Hosts authenticate with host/<hostname>/api key combination (note the host in front of the hostname).

[rpothier]

LGTM, if there are remaining items from Jason or Kumbi they can be addressed in a follow up so this can move forward.