v6.4.0

[6.4.0] - 2026-08-06

Added

• Cloud-native authenticators for Azure Managed Identity (authn-azure),
  AWS IAM (authn-iam), and GCP workload identity (authn-gcp), exposed
  via Conjur::API.new_from_azure, .new_from_iam, and .new_from_gcp
  (CNJR-14213).
• Live integration features for the cloud authenticators, gated behind the
  RUN_AWS_TESTS / RUN_AZURE_TESTS / RUN_GCP_TESTS pipeline params and run
  on dedicated cloud agents (excluded from the default suite) (CNJR-14213).

Changed

• CI uses Conjur Enterprise 1.27.0+, which removed the GET /public_keys endpoint
  (CNJR-11339). Dropped the Cucumber scenario that exercised that API; the client
  method remains for open-source Conjur.
• Retrieve the Cucumber admin API key via conjurctl in test.sh instead of rake,
  avoiding Rails boot output corrupting the key on current Conjur images.
• CI now tests against Ruby 3.3, 3.4, and 4.0. Dropped Ruby 3.2 (end of life)
  and raised the minimum supported Ruby version accordingly.

Fixed

• Set CONJUR_AUTHN_ALLOWED_IP_RANGES and CONJUR_AUTHN_HTTP_ALLOWLIST in the
  test environment so Conjur's new SSRF guard does not block the authn-oidc
  provider-uri fetch to the compose-local Keycloak server. (CNJR-13786)
• Corrected Conjur::API.new_from_gcp / authenticate_gcp to target the
  serviceless authn-gcp endpoint (/authn-gcp/{account}/authenticate) instead
  of authn-jwt; the service_id argument was removed accordingly (CNJR-14213).