mirror of
https://github.com/pomerium/pomerium.git
synced 2025-07-08 12:28:18 +02:00
docs: replace httpbin with verify (#1702)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
This commit is contained in:
parent
4eec2ed1d5
commit
c23c8b34b3
34 changed files with 154 additions and 154 deletions
|
@ -89,7 +89,7 @@ We use [Netlify](https://www.netlify.com) to build and host our docs. One of nic
|
|||
[configuration variables]: ../../reference/readme.md
|
||||
[download]: https://github.com/pomerium/pomerium/releases
|
||||
[environmental configuration variables]: https://12factor.net/config
|
||||
[httpbin]: https://httpbin.org/
|
||||
[verify]: https://verify.pomerium.com/
|
||||
[identity provider]: ../identity-providers/readme.md
|
||||
[make]: https://en.wikipedia.org/wiki/Make_(software)
|
||||
[tls certificates]: ../topics/certificates.md
|
||||
|
|
|
@ -39,10 +39,10 @@ Finally, source the configuration `env` file and run pomerium specifying the `co
|
|||
|
||||
## Navigate
|
||||
|
||||
Browse to `external-httpbin.your.domain.example`. Connections between you and [httpbin] will now be proxied and managed by Pomerium.
|
||||
Browse to `external-verify.your.domain.example`. Connections between you and [verify] will now be proxied and managed by Pomerium.
|
||||
|
||||
[configuration variables]: ../../reference/readme.md
|
||||
[download]: https://github.com/pomerium/pomerium/releases
|
||||
[httpbin]: https://httpbin.org/
|
||||
[verify]: https://verify.pomerium.com/
|
||||
[identity provider]: ../identity-providers/
|
||||
[tls certificates]: ../topics/certificates.md
|
||||
|
|
|
@ -69,10 +69,10 @@ make && ./bin/pomerium -config config.yaml
|
|||
|
||||
### Navigate
|
||||
|
||||
Browse to `httpbin.localhost.pomerium.io`. Connections between you and [httpbin] will now be proxied and managed by Pomerium.
|
||||
Browse to `verify.localhost.pomerium.io`. Connections between you and [verify] will now be proxied and managed by Pomerium.
|
||||
|
||||
[configuration variables]: ../../reference/readme.md
|
||||
[httpbin]: https://httpbin.org/
|
||||
[verify]: https://verify.pomerium.com/
|
||||
[identity provider]: ../identity-providers/
|
||||
[make]: https://en.wikipedia.org/wiki/Make_(software)
|
||||
[tls certificates]: ../topics/certificates.md
|
||||
|
|
|
@ -46,9 +46,9 @@ Run [./scripts/helm_gke.sh] which will:
|
|||
|
||||
## Navigate
|
||||
|
||||
Open a browser and navigate to `httpbin.your.domain.example`.
|
||||
Open a browser and navigate to `verify.your.domain.example`.
|
||||
|
||||
You can also navigate to the special pomerium endpoint `httpbin.your.domain.example/.pomerium/` to see your current user details.
|
||||
You can also navigate to the special pomerium endpoint `verify.your.domain.example/.pomerium/` to see your current user details.
|
||||
|
||||

|
||||
|
||||
|
|
|
@ -58,11 +58,11 @@ Finally, simply run docker compose.
|
|||
docker-compose up
|
||||
```
|
||||
|
||||
Docker will automatically download the required [container images] for Pomerium and [httpbin]. Then, Pomerium will run with the configuration details set in the previous steps.
|
||||
Docker will automatically download the required [container images] for Pomerium and [verify]. Then, Pomerium will run with the configuration details set in the previous steps.
|
||||
|
||||
You should now be able access to the routes (e.g. `https://httpbin.corp.yourdomain.example`) as specified in your policy file.
|
||||
You should now be able access to the routes (e.g. `https://verify.localhost.pomerium.io`) as specified in your policy file.
|
||||
|
||||
You can also navigate to the special pomerium endpoint `httpbin.corp.yourdomain.example/.pomerium/` to see your current user details.
|
||||
You can also navigate to the special pomerium endpoint `verify.corp.yourdomain.example/.pomerium/` to see your current user details.
|
||||
|
||||

|
||||
|
||||
|
@ -70,6 +70,6 @@ You can also navigate to the special pomerium endpoint `httpbin.corp.yourdomain.
|
|||
[container images]: https://hub.docker.com/r/pomerium/pomerium
|
||||
[docker]: https://docs.docker.com/install/
|
||||
[docker-compose]: https://docs.docker.com/compose/install/
|
||||
[httpbin]: https://httpbin.org/
|
||||
[verify]: https://verify.pomerium.com/
|
||||
[identity provider]: ../identity-providers/readme.md
|
||||
[tls certificates]: ../topics/certificates.md
|
||||
|
|
|
@ -18,9 +18,9 @@ The API returns a cryptographically signed sign-in url that can be used to compl
|
|||
For example:
|
||||
|
||||
```bash
|
||||
$ curl "https://httpbin.example.com/.pomerium/api/v1/login?redirect_uri=http://localhost:8000"
|
||||
$ curl "https://verify.example.com/.pomerium/api/v1/login?redirect_uri=http://localhost:8000"
|
||||
|
||||
https://authenticate.example.com/.pomerium/sign_in?redirect_uri=http%3A%2F%2Flocalhost%3Fpomerium_callback_uri%3Dhttps%253A%252F%252Fhttpbin.corp.example%252F.pomerium%252Fapi%252Fv1%252Flogin%253Fredirect_uri%253Dhttp%253A%252F%252Flocalhost&sig=hsLuzJctmgsN4kbMeQL16fe_FahjDBEcX0_kPYfg8bs%3D&ts=1573262981
|
||||
https://authenticate.example.com/.pomerium/sign_in?redirect_uri=http%3A%2F%2Flocalhost%3Fpomerium_callback_uri%3Dhttps%253A%252F%verify.corp.example%252F.pomerium%252Fapi%252Fv1%252Flogin%253Fredirect_uri%253Dhttp%253A%252F%252Flocalhost&sig=hsLuzJctmgsN4kbMeQL16fe_FahjDBEcX0_kPYfg8bs%3D&ts=1573262981
|
||||
```
|
||||
|
||||
### Callback handler
|
||||
|
@ -35,13 +35,13 @@ Your script or application should anticipate the possibility that your underlyin
|
|||
|
||||
## High level workflow
|
||||
|
||||
The application interacting with Pomerium must manage the following workflow. Consider the following example where a script or program desires delegated, programmatic access to the domain `httpbin.corp.domain.example`:
|
||||
The application interacting with Pomerium must manage the following workflow. Consider the following example where a script or program desires delegated, programmatic access to the domain `verify.corp.domain.example`:
|
||||
|
||||
1. The script or application requests a new login url from the pomerium managed endpoint (e.g. `https://httpbin.corp.domain.example/.pomerium/api/v1/login`) and takes a `redirect_uri` as an argument.
|
||||
1. The script or application requests a new login url from the pomerium managed endpoint (e.g. `https://verify.corp.domain.example/.pomerium/api/v1/login`) and takes a `redirect_uri` as an argument.
|
||||
1. The script or application opens a browser or redirects the user to the returned login page.
|
||||
1. The user completes the identity providers login flow.
|
||||
1. The identity provider makes a callback to pomerium's authenticate service (e.g. `authenticate.corp.domain.example`) .
|
||||
1. Pomerium's authenticate service creates a user session and redirect token, then redirects back to the managed endpoint (e.g. `httpbin.corp.domain.example`)
|
||||
1. Pomerium's authenticate service creates a user session and redirect token, then redirects back to the managed endpoint (e.g. `verify.corp.domain.example`)
|
||||
1. Pomerium's proxy service makes a callback request to the original `redirect_uri` with the user session and as an argument.
|
||||
1. The script or application is responsible for handling that http callback request, and securely handling the callback session (`pomerium_jwt`) queryparam.
|
||||
1. The script or application can now make any requests as normal to the upstream application by setting the `Authorization: Pomerium ${pomerium_jwt}` header.
|
||||
|
@ -52,7 +52,7 @@ Please consider see the following minimal but complete python example.
|
|||
|
||||
```bash
|
||||
python3 scripts/programmatic_access.py \
|
||||
--dst https://httpbin.example.com/headers
|
||||
--dst https://verify.example.com/headers
|
||||
```
|
||||
|
||||
<<< @/scripts/programmatic_access.py
|
||||
|
|
|
@ -241,15 +241,15 @@ Previous programmatic authentication endpoints (`/api/v1/token`) has been remove
|
|||
|
||||
### Forward-auth route change
|
||||
|
||||
Previously, routes were verified by taking the downstream applications hostname in the form of a path `(e.g. ${forwardauth}/.pomerium/verify/httpbin.some.example`) variable. The new method for verifying a route using forward authentication is to pass the entire requested url in the form of a query string `(e.g. ${forwardauth}/.pomerium/verify?url=https://httpbin.some.example)` where the routed domain is the value of the `uri` key.
|
||||
Previously, routes were verified by taking the downstream applications hostname in the form of a path `(e.g. ${forwardauth}/.pomerium/verify/verify.some.example`) variable. The new method for verifying a route using forward authentication is to pass the entire requested url in the form of a query string `(e.g. ${forwardauth}/.pomerium/verify?url=https://verify.some.example)` where the routed domain is the value of the `uri` key.
|
||||
|
||||
Note that the verification URL is no longer nested under the `.pomerium` endpoint.
|
||||
|
||||
For example, in nginx this would look like:
|
||||
|
||||
```diff
|
||||
- nginx.ingress.kubernetes.io/auth-url: https://forwardauth.corp.example.com/.pomerium/verify/httpbin.corp.example.com?no_redirect=true
|
||||
- nginx.ingress.kubernetes.io/auth-signin: https://forwardauth.corp.example.com/.pomerium/verify/httpbin.corp.example.com
|
||||
- nginx.ingress.kubernetes.io/auth-url: https://forwardauth.corp.example.com/.pomerium/verify/verify.corp.example.com?no_redirect=true
|
||||
- nginx.ingress.kubernetes.io/auth-signin: https://forwardauth.corp.example.com/.pomerium/verify/verify.corp.example.com
|
||||
+ nginx.ingress.kubernetes.io/auth-url: https://forwardauth.corp.example.com/verify?uri=$scheme://$host$request_uri
|
||||
+ nginx.ingress.kubernetes.io/auth-signin: https://forwardauth.corp.example.com?uri=$scheme://$host$request_uri
|
||||
```
|
||||
|
@ -324,12 +324,12 @@ Previously, it was allowable to define a policy without a schema (e.g. `http`/`h
|
|||
|
||||
```yaml
|
||||
policy:
|
||||
- from: httpbin.corp.domain.example
|
||||
to: http://httpbin
|
||||
- from: verify.corp.domain.example
|
||||
to: http://verify
|
||||
allowed_domains:
|
||||
- pomerium.io
|
||||
- from: external-httpbin.corp.domain.example
|
||||
to: https://httpbin.org
|
||||
- from: external-verify.corp.domain.example
|
||||
to: https://verify.pomerium.com
|
||||
allow_public_unauthenticated_access: true
|
||||
```
|
||||
|
||||
|
@ -337,12 +337,12 @@ Should now be:
|
|||
|
||||
```yaml
|
||||
policy:
|
||||
- from: https://httpbin.corp.domain.example
|
||||
to: http://httpbin
|
||||
- from: https://verify.corp.domain.example
|
||||
to: http://verify
|
||||
allowed_domains:
|
||||
- pomerium.io
|
||||
- from: https://external-httpbin.corp.domain.example
|
||||
to: https://httpbin.org
|
||||
- from: https://external-verify.corp.domain.example
|
||||
to: https://verify.pomerium.com
|
||||
allow_public_unauthenticated_access: true
|
||||
```
|
||||
|
||||
|
@ -364,8 +364,8 @@ Usage of the POLICY_FILE envvar is no longer supported. Support for file based p
|
|||
Old:
|
||||
|
||||
```yaml
|
||||
- from: httpbin.corp.beyondperimeter.com
|
||||
to: http://httpbin
|
||||
- from: verify.localhost.pomerium.io
|
||||
to: http://verify
|
||||
allowed_domains:
|
||||
- pomerium.io
|
||||
cors_allow_preflight: true
|
||||
|
@ -376,8 +376,8 @@ Usage of the POLICY_FILE envvar is no longer supported. Support for file based p
|
|||
|
||||
```yaml
|
||||
policy:
|
||||
- from: httpbin.corp.beyondperimeter.com
|
||||
to: http://httpbin
|
||||
- from: verify.localhost.pomerium.io
|
||||
to: http://verify
|
||||
allowed_domains:
|
||||
- pomerium.io
|
||||
cors_allow_preflight: true
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue