authorize: add authorization (#59)

* authorize: authorization module adds support for per-route access policy. In this release we support the most common forms of identity based access policy: `allowed_users`, `allowed_groups`, and `allowed_domains`. In future versions, the authorization module will also support context and device based authorization policy and decisions. See website documentation for more details.
 * docs: updated `env.example` to include a `POLICY` setting example.
 * docs:  added `IDP_SERVICE_ACCOUNT` to  `env.example` .
 * docs: removed `PROXY_ROOT_DOMAIN` settings which has been replaced by `POLICY`.
 * all: removed `ALLOWED_DOMAINS` settings which has been replaced by `POLICY`. Authorization is now handled by the authorization service and is defined in the policy configuration files.
 * proxy: `ROUTES` settings which has been replaced by `POLICY`.
* internal/log: `http.Server` and `httputil.NewSingleHostReverseProxy` now uses pomerium's logging package instead of the standard library's built in one.

Closes #54
Closes #41
Closes #61
Closes #58

docs/docs/config-reference.md

@@ -19,7 +19,7 @@ Global settings are configuration variables that are shared by all services.
 - Environmental Variable: `SERVICES`
 - Type: `string`
 - Default: `all`
-- Options: `all` `authenticate` or `proxy`
+- Options: `all` `authenticate` `authorize` or `proxy`
 
 Service mode sets the pomerium service(s) to run. If testing, you may want to set to `all` and run pomerium in "all-in-one mode." In production, you'll likely want to spin of several instances of each service mode for high availability.
 
@@ -43,6 +43,17 @@ Shared Secret is the base64 encoded 256-bit key used to mutually authenticate re
 head -c32 /dev/urandom | base64
 ```
 
+### Policy
+
+- Environmental Variable: either `POLICY` or `POLICY_FILE`
+- Type: [base64 encoded] `string` or relative file location
+- Filetype: `json` or `yaml`
+- Required
+
+Policy contains the routes, and their access policies. For example,
+
+<<< @/policy.example.yaml
+
 ### Debug
 
 - Environmental Variable: `POMERIUM_DEBUG`
@@ -51,7 +62,7 @@ head -c32 /dev/urandom | base64
 
 By default, JSON encoded logs are produced. Debug enables colored, human-readable, and more verbose logs to be streamed to [standard out](https://en.wikipedia.org/wiki/Standard_streams#Standard_output_(stdout)). In production, it's recommended to be set to `false`.
 
-For example, if true.
+For example, if `true`.
 
 ```
 10:37AM INF cmd/pomerium version=v0.0.1-dirty+ede4124
@@ -60,7 +71,7 @@ For example, if true.
 10:37AM INF proxy/authenticator: grpc connection OverrideCertificateName= addr=auth.corp.beyondperimeter.com:443
 ```
 
-If false:
+If `false`:
 
 ```
 {"level":"info","version":"v0.0.1-dirty+ede4124","time":"2019-02-18T10:41:03-08:00","message":"cmd/pomerium"}
@@ -96,21 +107,6 @@ Certificate key is the x509 _private-key_ used to establish secure HTTP and gRPC
 
 Redirect URL is the url the user will be redirected to following authentication with the third-party identity provider (IdP). Note the URL ends with `/oauth2/callback`. This setting will mirror the URL set when configuring your [identity provider]. Typically, on the provider side, this is called an _authorized callback url_.
 
-### Allowed Email Domains
-
-::: warning 
-This setting will be deprecated with the upcoming release of the authorization service.
-:::
-
-- Environmental Variable: `ALLOWED_DOMAINS`
-- Type: `[]string` (e.g. comma separated list of strings)
-- Required
-- Example: `engineering.corp-b.com,devops.corp-a.com`
-
-The allowed email domains settings dictates which email domains are valid for access. If an authenticated user has a email ending in a non-whitelisted domain, the request will be denied as unauthorized.
-
-
-
 ### Proxy Root Domains
 
 - Environmental Variable: `PROXY_ROOT_DOMAIN`
@@ -126,7 +122,7 @@ Proxy Root Domains specifies the sub-domains that can proxy requests. For exampl
 - Required
 - Options: `azure` `google` `okta` `gitlab` `onelogin` or `oidc`
 
-Provider is the short-hand name of a built-in OpenID Connect (oidc) identity provider to be used for authentication. To use a generic provider,set to `oidc`. 
+Provider is the short-hand name of a built-in OpenID Connect (oidc) identity provider to be used for authentication. To use a generic provider,set to `oidc`.
 
 See [identity provider] for details.
 
@@ -161,19 +157,18 @@ Provider URL is the base path to an identity provider's [OpenID connect discover
 - Default: `oidc`,`profile`, `email`, `offline_access` (typically)
 - Optional for built-in identity providers.
 
-Identity provider scopes correspond to access privilege scopes as defined in Section 3.3 of OAuth 2.0 RFC6749. The scopes associated with Access Tokens determine what resources will be available when they are used to access OAuth 2.0 protected endpoints. If you are using a built-in provider, you probably don't want to set customized scopes.
+Identity provider scopes correspond to access privilege scopes as defined in Section 3.3 of OAuth 2.0 RFC6749\. The scopes associated with Access Tokens determine what resources will be available when they are used to access OAuth 2.0 protected endpoints. If you are using a built-in provider, you probably don't want to set customized scopes.
+
+### Identity Provider Service Account
+
+- Environmental Variable: `IDP_SERVICE_ACCOUNT`
+- Type: `string`
+- Required, depending on provider
+
+Identity Provider Service Account is field used to configure any additional user account or access-token that may be required for querying additional user information during authentication. For a concrete example, Google an additional service account and to make a follow-up request to query a user's group membership. For more information, refer to the [identity provider] docs to see if your provider requires this setting.
 
 ## Proxy Service
 
-### Routes
-
-- Environmental Variable: `ROUTES`
-- Type: `map[string]string` comma separated mapping of managed entities.
-- Required
-- Example: `https://httpbin.corp.example.com=http://httpbin,https://hello.corp.example.com=http://hello:8080/`
-
-The routes setting contains a mapping of routes to be managed by pomerium.
-
 ### Signing Key
 
 - Environmental Variable: `SIGNING_KEY`
@@ -198,17 +193,25 @@ Authenticate Service URL is the externally accessible URL for the authenticate s
 - Optional
 - Example: `pomerium-authenticate-service.pomerium.svc.cluster.local`
 
-Authenticate Internal Service URL is the internal location of the authenticate service. This setting is used to override the authenticate service url for when you need to do "behind-the-ingress" inter-service communication. This is typically required for ingresses and load balancers that do not support HTTP/2 or gRPC termination.
+Authenticate Internal Service URL is the internally routed dns name of the authenticate service. This setting is used to override the authenticate service url for when you need to do "behind-the-ingress" inter-service communication. This is typically required for ingresses and load balancers that do not support HTTP/2 or gRPC termination.
 
-### Authenticate Service Port
+### Authorize Service URL
 
-- Environmental Variable: `AUTHENTICATE_SERVICE_PORT`
-- Type: `int`
+- Environmental Variable: `AUTHORIZE_SERVICE_URL`
+- Type: `URL`
+- Required
+- Example: `https://access.corp.example.com`
+
+Authorize Service URL is the externally accessible URL for the authorize service.
+
+### Authorize Internal Service URL
+
+- Environmental Variable: `AUTHORIZE_INTERNAL_URL`
+- Type: `string`
 - Optional
-- Default: `443`
-- Example: `8443`
+- Example: `pomerium-authorize-service.pomerium.svc.cluster.local`
 
-Authenticate Service Port is used to set the port value for authenticate service communication.
+Authorize Internal Service URL is the internally routed dns name of the authorize service. This setting is used to override the authorize service url for when you need to do "behind-the-ingress" inter-service communication. This is typically required for ingresses and load balancers that do not support HTTP/2 or gRPC termination.
 
 ### Override Certificate Name
 
@@ -217,7 +220,7 @@ Authenticate Service Port is used to set the port value for authenticate service
 - Optional (but typically required if Authenticate Internal Service Address is set)
 - Example: `*.corp.example.com` if wild card or `authenticate.corp.example.com`
 
-When Authenticate Internal Service Address is set, secure service communication can fail because the external certificate name will not match the internally routed service url. This setting allows you to override that check. 
+When Authenticate Internal Service Address is set, secure service communication can fail because the external certificate name will not match the internally routed service url. This setting allows you to override that check.
 
 ### Certificate Authority
 

docs/docs/examples.md

@@ -56,20 +56,6 @@ Customize for your identity provider run `docker-compose up -f nginx.docker-comp
 
 <<< @/docs/docs/examples/docker/nginx.docker-compose.yml
 
-### Gitlab On-Prem
-
-- Docker and Docker-Compose based.
-- Uses pre-configured built-in nginx load balancer
-- Runs separate containers for each service
-- Comes with a pre-configured instance of on-prem Gitlab-CE
-- Routes default to on-prem [helloworld], [httpbin], and [gitlab].
-
-Customize for your identity provider run `docker-compose up -f gitlab.docker-compose.yml`
-
-#### gitlab.docker-compose.yml
-
-<<< @/docs/docs/examples/docker/gitlab.docker-compose.yml
-
 ## Kubernetes
 
 ### Google Kubernetes Engine
@@ -103,7 +89,6 @@ Customize for your identity provider run `docker-compose up -f gitlab.docker-com
 
 <<< @/docs/docs/examples/kubernetes/ingress.yml
 
-[gitlab]: https://docs.gitlab.com/ee/user/project/container_registry.html
 [helloworld]: https://hub.docker.com/r/tutum/hello-world
 [httpbin]: https://httpbin.org/
 [https load balancing]: https://cloud.google.com/kubernetes-engine/docs/concepts/ingress

docs/docs/examples/docker/basic.docker-compose.yml

@@ -1,43 +1,35 @@
 # Example Pomerium configuration.
 #
 # NOTE! Change IDP_* settings to match your identity provider settings!
-# NOTE! Generate new SHARED_SECRET and COOKIE_SECRET keys!
+# NOTE! Generate new SHARED_SECRET and COOKIE_SECRET keys! e.g. `head -c32 /dev/urandom | base64`
 # NOTE! Replace `corp.beyondperimeter.com` with whatever your domain is
 # NOTE! Make sure certificate files (cert.pem/privkey.pem) are in the same directory as this file
-# NOTE! Wrap URLs in quotes to avoid parse errors
+# NOTE! Make sure your policy file (policy.example.yaml) is in the same directory as this file
+
 version: "3"
 services:
-  pomerium-all:
+  pomerium:
     image: pomerium/pomerium:latest # or `build: .` to build from source
     environment:
+      - POMERIUM_DEBUG=true
       - SERVICES=all
-      # auth settings
       - REDIRECT_URL=https://auth.corp.beyondperimeter.com/oauth2/callback
-      # Identity Provider Settings (Must be changed!)
       - IDP_PROVIDER=google
       - IDP_PROVIDER_URL=https://accounts.google.com
       - IDP_CLIENT_ID=REPLACE_ME.apps.googleusercontent.com
       - IDP_CLIENT_SECRET=REPLACE_ME
-      # - SCOPE="openid email"
       - PROXY_ROOT_DOMAIN=beyondperimeter.com
-      - ALLOWED_DOMAINS=*
-      # shared service settings
-      # Generate 256 bit random keys  e.g. `head -c32 /dev/urandom | base64`
       - SHARED_SECRET=aDducXQzK2tPY3R4TmdqTGhaYS80eGYxcTUvWWJDb2M=
       - COOKIE_SECRET=V2JBZk0zWGtsL29UcFUvWjVDWWQ2UHExNXJ0b2VhcDI=
-      # proxy settings
+      - CERTIFICATE_FILE=cert.pem
+      - CERTIFICATE_KEY_FILE=privkey.pem
       - AUTHENTICATE_SERVICE_URL=https://auth.corp.beyondperimeter.com
-      - ROUTES=https://httpbin.corp.beyondperimeter.com=http://httpbin,https://helloworld.corp.beyondperimeter.com=http://helloworld:8080/
-      # - SIGNING_KEY=LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU0zbXBaSVdYQ1g5eUVneFU2czU3Q2J0YlVOREJTQ0VBdFFGNWZVV0hwY1FvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFaFBRditMQUNQVk5tQlRLMHhTVHpicEVQa1JyazFlVXQxQk9hMzJTRWZVUHpOaTRJV2VaLwpLS0lUdDJxMUlxcFYyS01TYlZEeXI5aWp2L1hoOThpeUV3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
-      # if passing certs as files
-      # - CERTIFICATE_KEY=corp.beyondperimeter.com.crt
-      # - CERTIFICATE_KEY_FILE=corp.beyondperimeter.com.key
-      # Or, you can pass certifcates as bas64 encoded values. e.g. `base64 -i cert.pem`
-      # - CERTIFICATE=
-      # - CERTIFICATE_KEY=
-    volumes: # volumes is optional; used if passing certificates as files
+      - AUTHORIZE_SERVICE_URL=https://access.corp.beyondperimeter.com
+      - POLICY_FILE=./policy.yaml
+    volumes:
       - ./cert.pem:/pomerium/cert.pem:ro
       - ./privkey.pem:/pomerium/privkey.pem:ro
+      - ./policy.example.yaml:/pomerium/policy.yaml:ro
     ports:
       - 443:443
 
@@ -46,9 +38,8 @@ services:
     image: kennethreitz/httpbin:latest
     expose:
       - 80
-
-  # https://helloworld.corp.beyondperimeter.com
-  helloworld:
+  # https://hello.corp.beyondperimeter.com
+  hello:
     image: gcr.io/google-samples/hello-app:1.0
     expose:
       - 8080

docs/docs/examples/docker/gitlab.docker-compose.yml

@@ -1,94 +0,0 @@
-version: "3"
-
-services:
-  nginx:
-    image: pomerium/nginx-proxy:latest
-    ports:
-      - "443:443"
-    volumes:
-      # NOTE!!! : nginx must be supplied with your wildcard certificates. And it expects
-      # it in the format of whatever your wildcard domain name is in.
-      # see : https://github.com/jwilder/nginx-proxy#wildcard-certificates
-      # So, if your subdomain is corp.beyondperimeter.com, you'd have the following :
-      - ./cert.pem:/etc/nginx/certs/corp.beyondperimeter.com.crt:ro
-      - ./privkey.pem:/etc/nginx/certs/corp.beyondperimeter.com.key:ro
-      - /var/run/docker.sock:/tmp/docker.sock:ro
-
-  pomerium-authenticate:
-    build: .
-    restart: always
-    environment:
-      - POMERIUM_DEBUG=true
-      - SERVICES=authenticate
-      # auth settings
-      - REDIRECT_URL=https://auth.corp.beyondperimeter.com/oauth2/callback
-      # Identity Provider Settings (Must be changed!)
-      - IDP_PROVIDER=google
-      - IDP_PROVIDER_URL=https://accounts.google.com
-      - IDP_CLIENT_ID=REPLACEME
-      - IDP_CLIENT_SECRET=REPLACE_ME
-      - PROXY_ROOT_DOMAIN=corp.beyondperimeter.com
-      - ALLOWED_DOMAINS=*
-      - SKIP_PROVIDER_BUTTON=false
-      # shared service settings
-      # Generate 256 bit random keys  e.g. `head -c32 /dev/urandom | base64`
-      - SHARED_SECRET=aDducXQzK2tPY3R4TmdqTGhaYS80eGYxcTUvWWJDb2M=
-      - COOKIE_SECRET=V2JBZk0zWGtsL29UcFUvWjVDWWQ2UHExNXJ0b2VhcDI=
-      - VIRTUAL_PROTO=https
-      - VIRTUAL_HOST=auth.corp.beyondperimeter.com
-      - VIRTUAL_PORT=443
-    volumes: # volumes is optional; used if passing certificates as files
-      - ./cert.pem:/pomerium/cert.pem:ro
-      - ./privkey.pem:/pomerium/privkey.pem:ro
-    expose:
-      - 443
-  pomerium-proxy:
-    build: .
-    restart: always
-    environment:
-      - POMERIUM_DEBUG=true
-      - SERVICES=proxy
-      # proxy settings
-      - AUTHENTICATE_SERVICE_URL=https://auth.corp.beyondperimeter.com
-      # IMPORTANT! If you are running pomerium behind another ingress (loadbalancer/firewall/etc)
-      # you must tell pomerium proxy how to communicate using an internal hostname for RPC
-      - AUTHENTICATE_INTERNAL_URL=pomerium-authenticate:443
-      # When communicating internally, rPC is going to get a name conflict expecting an external
-      # facing certificate name (i.e. authenticate-service.local vs *.corp.example.com).
-      - OVERRIDE_CERTIFICATE_NAME=*.corp.beyondperimeter.com
-      - ROUTES=https://gitlab.corp.beyondperimeter.com=https://gitlab
-      # Generate 256 bit random keys  e.g. `head -c32 /dev/urandom | base64`
-      - SHARED_SECRET=aDducXQzK2tPY3R4TmdqTGhaYS80eGYxcTUvWWJDb2M=
-      - COOKIE_SECRET=V2JBZk0zWGtsL29UcFUvWjVDWWQ2UHExNXJ0b2VhcDI=
-      # nginx settings
-      - VIRTUAL_PROTO=https
-      - VIRTUAL_HOST=*.corp.beyondperimeter.com
-      - VIRTUAL_PORT=443
-    volumes: # volumes is optional; used if passing certificates as files
-      - ./cert.pem:/pomerium/cert.pem:ro
-      - ./privkey.pem:/pomerium/privkey.pem:ro
-    expose:
-      - 443
-
-  gitlab:
-    hostname: gitlab.corp.beyondperimeter.com
-    image: gitlab/gitlab-ce:latest
-    restart: always
-    expose:
-      - 443
-      - 80
-      - 22
-    environment:
-      GITLAB_OMNIBUS_CONFIG: |
-        external_url 'https://gitlab.corp.beyondperimeter.com'
-        nginx['ssl_certificate'] = '/etc/gitlab/trusted-certs/corp.beyondperimeter.com.crt'
-        nginx['ssl_certificate_key'] = '/etc/gitlab/trusted-certs/corp.beyondperimeter.com.key'
-      VIRTUAL_PROTO: https
-      VIRTUAL_HOST: gitlab.corp.beyondperimeter.com
-      VIRTUAL_PORT: 443
-    volumes:
-      - ./cert.pem:/etc/gitlab/trusted-certs/corp.beyondperimeter.com.crt
-      - ./privkey.pem:/etc/gitlab/trusted-certs/corp.beyondperimeter.com.key
-      - $HOME/gitlab/config:/etc/gitlab
-      - $HOME/gitlab/logs:/var/log/gitlab
-      - $HOME/gitlab/data:/var/opt/gitlab

docs/docs/examples/docker/nginx.docker-compose.yml

@@ -15,59 +15,75 @@ services:
       - /var/run/docker.sock:/tmp/docker.sock:ro
 
   pomerium-authenticate:
-    build: .
+    image: pomerium/pomerium:latest # or `build: .` to build from source
     restart: always
     environment:
       - POMERIUM_DEBUG=true
       - SERVICES=authenticate
-      # auth settings
       - REDIRECT_URL=https://auth.corp.beyondperimeter.com/oauth2/callback
       # Identity Provider Settings (Must be changed!)
       - IDP_PROVIDER=google
       - IDP_PROVIDER_URL=https://accounts.google.com
-      - IDP_CLIENT_ID=REPLACEME
+      - IDP_CLIENT_ID=REPLACE_ME.apps.googleusercontent.com
       - IDP_CLIENT_SECRET=REPLACE_ME
       - PROXY_ROOT_DOMAIN=corp.beyondperimeter.com
-      - ALLOWED_DOMAINS=*
-      - SKIP_PROVIDER_BUTTON=false
-      # shared service settings
-      # Generate 256 bit random keys  e.g. `head -c32 /dev/urandom | base64`
       - SHARED_SECRET=aDducXQzK2tPY3R4TmdqTGhaYS80eGYxcTUvWWJDb2M=
       - COOKIE_SECRET=V2JBZk0zWGtsL29UcFUvWjVDWWQ2UHExNXJ0b2VhcDI=
+      # nginx settings
       - VIRTUAL_PROTO=https
       - VIRTUAL_HOST=auth.corp.beyondperimeter.com
       - VIRTUAL_PORT=443
-    volumes: # volumes is optional; used if passing certificates as files
+    volumes:
       - ./cert.pem:/pomerium/cert.pem:ro
       - ./privkey.pem:/pomerium/privkey.pem:ro
     expose:
       - 443
-  pomerium-proxy:
-    build: .
-    restart: always
 
+  pomerium-proxy:
+    image: pomerium/pomerium:latest # or `build: .` to build from source
+    restart: always
     environment:
       - POMERIUM_DEBUG=true
       - SERVICES=proxy
-      # proxy settings
+      - POLICY_FILE=policy.yaml
       - AUTHENTICATE_SERVICE_URL=https://auth.corp.beyondperimeter.com
+      - AUTHORIZE_SERVICE_URL=https://access.corp.beyondperimeter.com
       # IMPORTANT! If you are running pomerium behind another ingress (loadbalancer/firewall/etc)
       # you must tell pomerium proxy how to communicate using an internal hostname for RPC
       - AUTHENTICATE_INTERNAL_URL=pomerium-authenticate:443
+      - AUTHORIZE_INTERNAL_URL=pomerium-authorize:443
       # When communicating internally, rPC is going to get a name conflict expecting an external
       # facing certificate name (i.e. authenticate-service.local vs *.corp.example.com).
       - OVERRIDE_CERTIFICATE_NAME=*.corp.beyondperimeter.com
-      - ROUTES=https://httpbin.corp.beyondperimeter.com=http://httpbin,https://hello.corp.beyondperimeter.com=http://hello:8080/
-      # Generate 256 bit random keys  e.g. `head -c32 /dev/urandom | base64`
       - SHARED_SECRET=aDducXQzK2tPY3R4TmdqTGhaYS80eGYxcTUvWWJDb2M=
       - COOKIE_SECRET=V2JBZk0zWGtsL29UcFUvWjVDWWQ2UHExNXJ0b2VhcDI=
       # nginx settings
       - VIRTUAL_PROTO=https
       - VIRTUAL_HOST=*.corp.beyondperimeter.com
       - VIRTUAL_PORT=443
-    volumes: # volumes is optional; used if passing certificates as files
+    volumes:
       - ./cert.pem:/pomerium/cert.pem:ro
       - ./privkey.pem:/pomerium/privkey.pem:ro
+      - ./policy.example.yaml:/pomerium/policy.yaml:ro
+    expose:
+      - 443
+
+  pomerium-authorize:
+    image: pomerium/pomerium:latest # or `build: .` to build from source
+    restart: always
+    environment:
+      - POMERIUM_DEBUG=true
+      - SERVICES=authorize
+      - POLICY_FILE=policy.yaml
+      - SHARED_SECRET=aDducXQzK2tPY3R4TmdqTGhaYS80eGYxcTUvWWJDb2M=
+      # nginx settings
+      - VIRTUAL_PROTO=https
+      - VIRTUAL_HOST=access.corp.beyondperimeter.com
+      - VIRTUAL_PORT=443
+    volumes:
+      - ./cert.pem:/pomerium/cert.pem:ro
+      - ./privkey.pem:/pomerium/privkey.pem:ro
+      - ./policy.example.yaml:/pomerium/policy.yaml:ro
     expose:
       - 443
 

docs/docs/examples/kubernetes/ingress.nginx.yml

@@ -8,6 +8,7 @@ metadata:
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
     nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
     nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
+    # to avoid ingress routing, enable
     # nginx.ingress.kubernetes.io/ssl-passthrough: "true"
 
 spec:
@@ -16,6 +17,8 @@ spec:
       hosts:
         - "*.corp.beyondperimeter.com"
         - "auth.corp.beyondperimeter.com"
+        - "access.corp.beyondperimeter.com"
+
   rules:
     - host: "*.corp.beyondperimeter.com"
       http:
@@ -32,3 +35,10 @@ spec:
             backend:
               serviceName: pomerium-authenticate-service
               servicePort: https
+    - host: "access.corp.beyondperimeter.com"
+      http:
+        paths:
+          - paths:
+            backend:
+              serviceName: pomerium-authorize-service
+              servicePort: https

docs/docs/examples/kubernetes/ingress.yml

@@ -13,6 +13,8 @@ spec:
       hosts:
         - "*.corp.beyondperimeter.com"
         - "auth.corp.beyondperimeter.com"
+        - "access.corp.beyondperimeter.com"
+
   rules:
     - host: "*.corp.beyondperimeter.com"
       http:
@@ -29,3 +31,10 @@ spec:
             backend:
               serviceName: pomerium-authenticate-service
               servicePort: https
+    - host: "access.corp.beyondperimeter.com"
+      http:
+        paths:
+          - paths:
+            backend:
+              serviceName: pomerium-authorize-service
+              servicePort: https

docs/docs/examples/kubernetes/proxy.deploy.yml

@@ -23,10 +23,12 @@ spec:
               name: https
               protocol: TCP
           env:
-            - name: ROUTES
-              value: https://httpbin.corp.beyondperimeter.com=https://httpbin.org,https://hi.corp.beyondperimeter.com=http://hello-app.pomerium.svc.cluster.local:8080
             - name: SERVICES
               value: proxy
+            - name: AUTHORIZE_SERVICE_URL
+              value: https://access.corp.beyondperimeter.com
+            - name: AUTHORIZE_INTERNAL_URL
+              value: "pomerium-authorize-service.pomerium.svc.cluster.local"
             - name: AUTHENTICATE_SERVICE_URL
               value: https://auth.corp.beyondperimeter.com
             - name: AUTHENTICATE_INTERNAL_URL

docs/docs/identity-providers.md

@@ -120,7 +120,7 @@ IDP_CLIENT_SECRET="REPLACE-ME"
 
 :::warning
 
-Support was removed in v0.0.3 because Gitlab does not provide callers with a user email, under any scope, to a caller unless that user has selected her email to be public. Pomerium until [this gitlab bug](https://gitlab.com/gitlab-org/gitlab-ce/issues/44435#note_88150387) is fixed.
+Support was removed in v0.0.3 because Gitlab does not provide callers with a user email, under any scope, to a caller unless that user has selected her email to be public. Pomerium support is blocked until [this gitlab bug](https://gitlab.com/gitlab-org/gitlab-ce/issues/44435#note_88150387) is fixed.
 
 :::
 
@@ -192,14 +192,16 @@ In order to have Pomerium validate group membership, we'll also need to configur
 
 ![Google create service account](./google/google-create-sa.png)
 
-Then, you'll need to manually open an editor add an `impersonate_user` key to the downloaded public/private key file. In this case, we'd be impersonating the admin account `user@pomerium.io`.
+Then, you'll need to manually open an editor and add an `impersonate_user` field to the downloaded public/private key file. In this case, we'd be impersonating the admin account `user@pomerium.io`.
 
 ::: warning
 
-You MUST add the `impersonate_user` field to your json key file. [Google requires](https://stackoverflow.com/questions/48585700/is-it-possible-to-call-apis-from-service-account-without-acting-on-behalf-of-a-u/48601364#48601364) that service accounts act on behalf of another user.
+ [Google requires](https://stackoverflow.com/questions/48585700/is-it-possible-to-call-apis-from-service-account-without-acting-on-behalf-of-a-u/48601364#48601364) that service accounts act on behalf of another user. You MUST add the `impersonate_user` field to your json key file.
 
 :::
 
+
+
 ```json
 {
   "type": "service_account",
@@ -210,7 +212,7 @@ You MUST add the `impersonate_user` field to your json key file. [Google require
 }
 ```
 
-The base64 encoded contents of this public/private key pair json file will used for the value of the `IDP_SERVICE_ACCOUNT` configuration setting.
+The base64 encoded contents of this public/private key pair json file will used for the value of the `IDP_SERVICE_ACCOUNT` configuration setting. 
 
 Next we'll delegate G-suite group membership access to the service account we just created .
 

docs/docs/readme.md

@@ -6,7 +6,7 @@ Pomerium is an open-source, identity-aware access proxy.
 
 ## Why
 
-Traditional [perimeter](https://www.redbooks.ibm.com/redpapers/pdfs/redp4397.pdf) [security](https://en.wikipedia.org/wiki/Perimeter_Security)has some shortcomings, namely:
+Traditional [perimeter](https://www.redbooks.ibm.com/redpapers/pdfs/redp4397.pdf) [security](https://en.wikipedia.org/wiki/Perimeter_Security) has some shortcomings, namely:
 
 - Insider threat is not well addressed and 28% of breaches are [by internal actors](http://www.documentwereld.nl/files/2018/Verizon-DBIR_2018-Main_report.pdf).
 - Impenetrable fortress in theory falls in practice; multiple entry points (like VPNs), lots of firewall rules, network segmentation creep.