3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-07-30 23:09:23 +02:00
Code Issues Projects Releases Packages Wiki Activity

docs: update upgrading document for breaking changes (#974)

Browse source
This commit is contained in:
Caleb Doxsey 2020-06-22 15:26:42 -06:00 • committed by GitHub
parent f33bf07334
commit 24b523c043
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

19
docs/docs/upgrading.md
View file

@ -9,6 +9,25 @@ description: >-
## Breaking
### Service Accounts and `allowed_groups`
With this release we now query group information asynchronously using a service account. This was already the behavior
for Google, but for all other providers a `idp_service_account` configuration will need to be supplied. The format of
this field varies and is specified in each identity provider's documentation.
If no `idp_service_account` is supplied, the `allowed_groups` policy configuration will not work.
### Cache Service
The cache service now stores user and session data in-memory (rather than in a browser cookie). As a consequence running
more than one instance of the cache service is no longer supported, and restarting the cache service will result in all
users having to re-login.
If high availability or persistence is needed, there's a new
[databroker gRPC interface](https://github.com/pomerium/pomerium/blob/master/internal/grpc/databroker/databroker.proto)
and `databroker_url` configuration option. For an example implementation, the in-memory database used by the cache
service can be found here: [internal/databroker/memory](https://github.com/pomerium/pomerium/tree/master/internal/databroker/memory).
### Identity headers
With this release, pomerium will not insert identity headers (X-Pomerium-Jwt-Asserttion/X-Pomerium-Claim-*) by default. To get pre 0.9.0 behavior, you