From ca704e17f14a3a2ef6bf0e5a0aa701bc3e914b94 Mon Sep 17 00:00:00 2001 From: "backport-actions-token[bot]" <87506591+backport-actions-token[bot]@users.noreply.github.com> Date: Wed, 15 Sep 2021 20:34:04 +0000 Subject: [PATCH] Document recovery token generation (#2579) (#2601) * document recovery token generation * run console anywhere to generate token Co-authored-by: Alex Fornuto --- docs/enterprise/install/helm.md | 4 ++++ docs/enterprise/install/img/recovery-token.png | 1 + docs/enterprise/install/quickstart.md | 6 ++++++ docs/partials/generate-recovery-token.md | 17 +++++++++++++++++ docs/partials/img/recovery-token.png | Bin 0 -> 9469 bytes 5 files changed, 28 insertions(+) create mode 120000 docs/enterprise/install/img/recovery-token.png create mode 100644 docs/partials/generate-recovery-token.md create mode 100644 docs/partials/img/recovery-token.png diff --git a/docs/enterprise/install/helm.md b/docs/enterprise/install/helm.md index f7d56c491..81eee94b3 100644 --- a/docs/enterprise/install/helm.md +++ b/docs/enterprise/install/helm.md @@ -162,3 +162,7 @@ kubectl delete svc pomerium-proxy [Pomerium using Helm]: /docs/install/helm.md [cert-manager]: https://cert-manager.io/docs/ + +### Generate Recovery Token + +!!!include(generate-recovery-token.md)!!! diff --git a/docs/enterprise/install/img/recovery-token.png b/docs/enterprise/install/img/recovery-token.png new file mode 120000 index 000000000..b89316549 --- /dev/null +++ b/docs/enterprise/install/img/recovery-token.png @@ -0,0 +1 @@ +../../../partials/img/recovery-token.png \ No newline at end of file diff --git a/docs/enterprise/install/quickstart.md b/docs/enterprise/install/quickstart.md index c0e9741fa..91948a086 100644 --- a/docs/enterprise/install/quickstart.md +++ b/docs/enterprise/install/quickstart.md @@ -212,3 +212,9 @@ audience: console.localhost.pomerium.com ## Next Steps Pomerium Enterprise assumes access to a [Prometheus](https://prometheus.io/) data store for metrics. See [Prometheus Metrics](/enterprise/prometheus.md) to learn how to configure access. + +## Troubleshooting + +### Generate Recovery Token + +!!!include(generate-recovery-token.md)!!! \ No newline at end of file diff --git a/docs/partials/generate-recovery-token.md b/docs/partials/generate-recovery-token.md new file mode 100644 index 000000000..c3804c3c2 --- /dev/null +++ b/docs/partials/generate-recovery-token.md @@ -0,0 +1,17 @@ +There could arise several situations that prevent Pomerium from authenticating users to Pomerium Enterprise. In these situations, you may be presented with the recovery sign in page: + +![Pomerium Enterprise Recovery Sign In](./img/recovery-token.png) + +This page requires a recovery token. To generate a token, run the `pomerium-console generate-recovery token` with the following flags: + +| Flag | Description | +| --------------------------- | ----------- | +| `--database-encryption-key` | base64-encoded encryption key for encrypting sensitive data in the database. | +| `--database-url` | The database to connect to (default "`postgresql://pomerium:pomerium@localhost:5432/dashboard?sslmode=disable`"). | +| `--namespace` | The namespace to use (default "`9d8dbd2c-8cce-4e66-9c1f-c490b4a07243`" for Global). | +| `--out` | Where to save the JWT. If not specified, it will be printed to stdout. | +| `--ttl` | The amount of time before the recovery token expires. Requires a unit (example: `30s`, `5m`).| + +::: tip +You can run the `pomerium-console` binary from any device with access to the database. +::: \ No newline at end of file diff --git a/docs/partials/img/recovery-token.png b/docs/partials/img/recovery-token.png new file mode 100644 index 0000000000000000000000000000000000000000..17c97ad519f8a63ce5f54950a6f13ec10cdac96e GIT binary patch literal 9469 zcmch7cUaR)w{8^6R#dhdDI(xj1l+I*(z_86kuD%0fqPQErHqM; z)Cn#b4%v1ge3|O2-<@?$bPGMdxX&)saS&Ct_0OS40_~jA9i7RE;}&-Cn6RJ3LWjQn zwBp~WRUdTf7Vp!ONeo6nfZ%3klB5iEU3$}ZJ!$>eklS$xB*UF86au+KfIxmlKp-!m z5D0BAakEEadB}82?=3gVI`$?RR{zfA0MB4={#pxaO?vK z61LhgIqU@=W4>{G6)UZo1O`}fP%4nr_x z&KfEyZc*ti1kxdO`ZzQNb?@FiM}cPT1qdX%wWUQ{PY<>HwDD9J!u{UeyKZ`WAnAES z@2VCES?|27e!1zs2U2sX$_N#oZj9C4qo<=Y;;eT$iZx*aYPN^tA9EMxa=CwkEZ|N z#k0VjfB6myzWnXp|9gjNh^?(Hw*S!CJg{#9IapD&WZ#kQxfpry82?oF zYm-_(M#zzq*=fwC(>DVG0x~WJPWKiKmfCliQ6vLlk)VJnM}O(Q+T;k za7c&~_3*YA*Vh5}?;nEe*4R$T-+#&YIUT*@o8ADqW?p50nZs#C3$9+@zi(gJ{eJ25 z=RbFJbOia%57!DD(`vBnv~3!&`|$J-c+>>tqTHeGzsGxQYBbLb7fxTid+UuHD_;9XEHi7l%N) zjHUa}Jt*m4U!KHBSoQ+%^cGo?!DIy8YVY}qIwJ)nv|Hk(ZqU|Zvr*2~a#yN#CFjpS zcV=sbKVmx=w9=(zzWuX7n({pg!=7w51==UE#emq^5Jkg#qUp-$p z?IJFV=<4bMi*e@68O=a*uvFRE*{T?5$1DpXyoE(Xdhs^YWZ&{ww+C-OndT#V3QSkm z5#lv-lxlB!uf&B5ok3M*cSa>Q*C#XB6Gx}IawKb4V#@=sU%x(B;XJ!3sh=$SV7nTo z6ZglQxL^9pk>>5maPw8jdPi*{(>12GR*&PD? zvS?r-KfZP~d527;qCrgb;*qWG?P_k{E_I}<6@_-zqtP7LFCHpjUliV5o#`hPn2P6< z>p+mIxP5ycc}l_V?%jA1M2=RpJo)0*LSs@=(td@$N>`gmKDjpe@87>eiT4afc2`J- z>@K5jis?Zcj-`1k;a0gEZbXpa* zhY^D9GXi_>=j_j*qiUJM{+g7}C3l+Nv>(>Lm6ZEMgJl?9Y zy~=};kC)L>HQ}i7v9X)@tK3_1{M_`ot`0S3YB);neqV8?XA1UCbClf|^(O~>&mz(X z_kfVO*IBF)dQ3k_x@m{~h_IrfqOdUbN+IsyLx{&Lh`(@x3cd2zI!3Q0lxTXNqs`xF zsZFNC=kKRQR8;(zC)!sv`yTFL(}~A{FyY!XPGPA0!Xp76JBw%v;`5v7D=}w^!-n)Q zldQloKdEbAFh|6O%T=9L_37M3wWlhPtOnmb7`?n3HX6ny{)T*RbaWJvt7}OZHlzn@ zm3MN|mWGajTq5Ql6BE6&);{zSweb?tlTY3|J! z`yWrnW&~}tH2FR;Fi2Ir-Tn>0pqC8dl!D6&lc`|Nur>c&(KSciPW3@=f{>({S)lLR(!VDHZMmum6ELV;h+4UaqZ6=%sInNwYNCcmbw z+9YKW0~Q(%N?2BuRU|2SjqR)n(38Gg4A? z2_Ral#uvUfIz1=N2RLBT3sm0kzx?AF zVJOsP;akIgjF#6?KH2lr?P6pa(c8jgS68xD)}b@=+qZ9d`YGIg-tb2;EQ9C5qN37a z=pbrcVEI@9qPl|k3omaUKq>S#-3HnFhLtR*Pa$&YUnJ{gpBGq^=8>|+6ciNXs)s;(o+1QE^dO%d#qPZl&y8EUIc9l7j zrh5t}N0z?^1qFfKZZzpL&Dsf)v9YmcI4h;QpI<}?s2te8zo#`{GCg3a<+Vxv&e9i2 zRmXo(v2d^;f9HAdUSl-l0*1s zSzmmCdljH60ms|j?FxHm*@#_EkpBT}o58oR@sqgMjb!LGS2~rvs4-t*S8jbt0NbG;kDeUN+s?U7hH-kt%=*d1ic zrTgh&ynd6CT5L;_Nmg!-5~%iLIN6{DbMy1_#|F!hWB{|q&@W%VLSeLxdGxMIz?$18 z6kvkhW@fGhMv*`2c4G(&MN%xHZM$C?0d#u34v&uiYwo}#MiY;X!}_>w7*oPeakM$w z+g^7*U;NA&b>`ZjYkkre4|n&g(So%B>+T6H$~(XUlKf;xMkV#JyazmK58x=CgcXhe zaYRc?OQBg2QCTni31AffrE+@h9335zWSlA2)d=3>e0&9iB{<@VtrpRYn(fs=ICKhK zez8-S5YQ4U46^L1Ke>Fc(v{3ZPzjW}*LouG3*eSLDMLe6;-UZ-d!JskYvUClFsW!N zP57;lR+K|%Tx{%+p1Gc08(=n9CrLadB_;bw*jIX~iVr9RPdf#Jbk&pG+k@8h2 zdue;G@z4md(Du<}Jvkvdy{%2J{4R}%O@0T+#b(CtmKI{2mY;z#H8bl4TYI7{X&D4v zs*=YiE5u4sV-7KMc#21 zE7>j9o}P>^DwK^2+F75p%l1}2^&!PZ`aEVtMT z5z*7=t&+eDxfG;?LtU?!mJ;g0wKO7DzK_S*59N2IwKM_BFkLhYEINqu90toXTlu=x zWw4?>SGT#HAKKMn&N0@Rr7@SUt9w<=*n@q(X8EfEHQ-LvR>Vn}wtB%C@e6;Mo?KoY z(TP%Z>OL=i4SwkL-BD*$k)6{rF=PA2-u&ubyH(w8h)4FLy54vJK0YVw8{JMbfZ@te zvkwgfX%To#RN^@4lwUQRub%-GoPL;|43%h)L&AR)k*{5fQ0dpGcWdr#(U%u5cP@&CdJBKp&!Fpp!gD zNF-AE!rMee9n41jlGeodMUNiSTyc4MGjARq9wx~UMyo5sNmH|L<(|k4I^j3{6v}bv zP=8%uwTnKfmd+_2rcVZ}dX`2E)AHY(t)vdrHz}ue*zU!nk}zw($B7!6v8S!7AJnId z`V%g0ObO9pJip(}M9T&M8V%PUaMjw(>`6c7*>Dhm9RNIB4Y}NrB+}lUcRm?!dSWwm zv)?`=NukWD<`yp(*Z9ig?=eDJsOO&YAKzG%dd&@00Sus@2w2V|Kj##E5gm{l3KQA`OYniesC%tnqR6KZ@Ry6=W*5?66Ah(kK^edEPBE z%2x?VQOm#qg#rM^FrME-j-Dzrm$7TRAbBR1wP3ijqy!)-SXjort}{!@(@T!0oi0HL9wAtWT^nUIZ5Xyt%y-Ez6&fpdBQHV^`P3o?h!GaR6 z<_foTpygOzhpo<03O!RSuv`gH5aHL}?L2#sMU$SidIK*PQ&xs2AS&+n1OAa_KA^>#_4gfhy4?kb!`^OqZm1=YzNq40lm4={o8{A((3Q9bTVbw~w0og_5>C6bA^G zQ*&7!N?9TuwFl%HE_e4DZjEGmdv|JVtgS&5S+<}lEb#VSgQ(LAE~#g8gTuGS)@Ekz z7ZtW8&8^0bMy{-&5IE$l=));XubI9qUmKaV6&lG@(xWQ815O)mR}vD|!Mw(p8RaZ- zdAiqB1xj4f@4105F1{eJPvCG-#v9H>3NY|>q6J7tekk}gi^xj7mlxD^r8b2(o=?5! zR{hhmb+IOm?NVzJ8!HxCt3e^;q-kqY3Aol-#JD*eKJe_g(CX}9Gf9Be^3RO<@BbWU zrwxF*?CRA69S0!icV!Vsq6ng1YkU-lG~*fGcK1(T!^~-ZF%)3$wT4_zCtI@eJ!=eR z8Y`5oIfa2dbk{a16LFG6ePQwL|3WeTWHt-1bX;mGKk#%~ODpCOp2@6O1^S|_sD^qBU)s+<7#Bd`OO9${R+!E z*sJH}B)rINqNy~2+4uD63yKP%OYFdthK0GGtgElEy7ZfJzfhXY+~EU{@fZE?&l;y+ zI&$F2gQ5_T@5T6wq^C36fq0!)(Fo_66REB^kfK;*rf)oWpN09l5&f#8)1Z>DKkB_J^J{+={PUY}?>6n*8cF zo1l@QZLR|!co>QF31ZE<&Mz784$dh@+h|;W>QTQIZx2kp6+fBvd_ZNAf8!Ei$wo}| zRGan!u+ZqMVX{r>SgyIX{K_Mg5`R>QO65Z8E!N+|{&Y`<8oEx#@F&*m26x@le=0Id zS3@W%DW!1CPWHbCL+hkv9sM`1tS_ZQDeQP|Y2G6tuC;bkv^Y7I1jMrqvuZba)Nt!U zz&!_IZ+9RfA83e$lZ1P!Twt*q%|k?-^(kb30%76CdGzSqSAjzBz<1xq)6BMQY9FzQ z$r9%C3QTv5x93zW_GU4PcCn*1scA1jQs8uj63eYMQVH)yUEQle?EG`UMZFas5F5hGj zW`{4$_7us@SJAU7B|N^W7O&1UZ^A6Y;3vuY+c9H(&JFv&j*`<*gezJ%AN&_T730qZ%2(9>a!%wjW2oa;I}o3?!CbE{h`|XN$e? z6R>m#=FU)dy6Q&BbU$$MroCAwYS4HlE|h4iBD+`=PL&^^r_6~(?;bQgDC|! zdfB8D3UT5K19{(5@J@3s(tZx*2D6@D)P<;@tG(t>YRdUawLLSHo>|W$gZP;{$cNiO zp3%@%vo2%8ibQV_rT=ZxvB#t*v&Cy_9>|2jvKt5}#r>l{LC62q0i-A+*h{avD2?1$ zIbsjXjSS`J+Ljkk8QRJZuk8^k=qwIuP6)q-F+8GA$qk=;1cc~Jrb+VA!QgsieR2Po z6dHGN@7hW*X`MBg^&(=3S5%3sT-ffX5r@diJ!Of zi8$51=$BV1JAq{!d7a9BJBFUSjT|HW=&73)QpNUzX|+cK7L^e9&Mv<1KC~ZWwQ5wp z{iJm`VgJachily?besJ>jVfz8Q1MnU#`9WAXoTt5O!cI#E7y%#Qwq;UEEE7e@4ZB* zzF~6d;WY1pgD~4X-qLeoYfG8E#>q`#`k0EY0LoN5*(z68W4X@nR$cGT(C{nu(eHTV zhz!O-0{gN&RjQvvBfcxL79i86->Gg*R2MiPj29j{C}kgkU2wL|($d4OTT&qV^=zn{ zOYF&u?R;M&>U)ZuYu`=V5oY|6+}3dJ$%NM$DUWrbJTzl?{H4vWH>0nGQhpb1Khx83 zqtMwS8Zcb{!h5N`IlWz=4h=_1>7?MeNurLi&Zp$_zkP}fIac@DX}kvgwSFa)bjrwO zI9%I2WnG3|zm#p)vl>2GeGOwbd-&*d3cgTnD9a3=UzXR^iXVUTV$1y1l62l{Y7UJU ziyeNyLm-)X19nLFssy?_aNH?BJtfZWB;I3BAg{$or89WRj$v4dv1!eZ` zO#|$Y*mT~RkQ{Y7%c76wDIqhLalzP}MqMiSEWkY2Z(~KQuP*w&5~80)Gj^YI=)Lkq z5iCvij@6>qxX!8FrujL$xaOA_O55d+_4eNSXw4$k!}^#!S1kErnM`n=E)yvjUZ>g8 zCHB45k&nyOeBsRl+L?$`*4^sWvMNl!0uZjj)?5oSFfr>O)9XhI7k$j>W$~>X6=lue zKDBxe%n#&#ZW^|R`%p&n*%6Z9t#n~Fo0ci7S*O*D^8H_G6lft{`cwU zw1wxm!1u}n;zYk(<=n~*vcpSQsijmWyg7)R7Y|+Sh5J}c`o*so6kcxJD991>4@XBH z)8&3wTG?x;V?%GKu$0C8vHIamLIKx~HO9ux-s7sx@^5#_*BnmC4?42xm(S&k<23@) zd!Gu*jxe%`rn51jviP3a-8Tgu>-WkQ0q7Hhx@rI@cPZ<4c}Vg)S!4#5e*H;udOrZM zfx^f0p5+MM0o2Sw4U>>(aDJl}H{kcsd|0N?tQ^1w(~uvF7FI2jZQI6tJ3Lp!Fw2fI zE$P@d$s`qnKTMQ8N?22*Sdw=F0xjW zt5T7Y6FV9jl{v}o+94v;#Vlgyu!Y+2iSvi zmE1Q8&Gk3%d1_^nwyJB^A;hZSsU`h)1&<@lTqWfndY<5{cW@|LuWg+vzup3<(7xFqx||KFpS=!98ouau{)}d=1YLfl1`ZHCh%C+$dvegz9|vyQea#)K{B-V z6>|C%uY1~5aQzb-Y3bsMNtXKdbVGFfdBjAj|F(D?coAL3(kB&hi_@F!boFL0_(=DZ z;7l+oiG!UUliaaN*s>x&J{&n`^8C~hUu@HgHY+{Pem~}C1<$hHup$r9HilJ_<+{|S zr{n}+*?we$fy~7Pa@z3qnsuC*0yPlBPBn}URBmz;M;O#Ieg&BV^VQU!wto01oqD7EZJtp=n`4Mv zMu};m3j-g+EaaZv=WvX84u=Q9UZdbINQd7bEE)Wa=lpi!%yNm@=8lgn0*-cI&IPVF zji6IL5icZ+R`_`?1zCikBMSru3T~sP4yuI6J?Jq`iJ0Ob`$w} z(t7QoK`>1tf6G=>5<1gC)U|3$Xm!4yvf~KL*C>ee)H+J_>DjKWExTEd7X*IUI(weQ z0vEzF*BI3-YPx+iXxnA@w3=^FqgeW3(DGeeBW{(kqh*MayyF${@o&mjH@w?@*TCTG zCpLdyF~BcF@Da{1{%#hL)3xRNMbQLIdm+FUWz8A$GIfRqUAsg;N#;~Ij~oK+yyNJI z;ktg3D{B2J0i2@=-7zR#uw~IpG<<7OrX;xx=zPKCr)icx@E?p=@XTpf4@G|KXOCTT zb&p0r52u&AD0Kky8qR0rP!EdV;T%CT4^yvUlzJ9Ew{RN1vG}meGN5&Es>)7#jOJjN zadXO_CY`akvGn=7OQCNfYg#3~Xq?5{`N=!!JHKP_dAj_^n!7lgHy2yau$XbQ)GbQb z9Z^G{NeQTpKE}eosj0bxT01J0Xv12mqdb;{LKE}DuMhR7&?UeCUn)2QpPl4vZoa>f zsr#tDxfQ(Vk?1H~ArEpx&1hko7r{ZP7GbuHES^Vy6i$yXdshb8aR$+HKnq`$e!A6e+p6xoc}{;5;E+$wNe5 zUj6{&`c>K2PEI}h3LVYjit>hLW@eCFMZ3W$i#=ajFh?N^yfP%~L5J;mAmq9sfcpK{ z88AyO{!@$nLk#|Zru6=|qVa#J&lI2iZO#u>_Af>HkJ9q5g602>FJ8PzNNCCecN0Rhb5`QT5YL}anwXd<{W*wrT|xmo z*1;OlT;=gVr=urdx6Dn&W8#Rt6S(?tsp@&8TF#2q?@@)UOAlwDP^hqQFxz3sg6z1+ znKM~^B=&G^OyYf@E9VGy#D?>1!Ga4cK}&bz*W2}7>TcY8jIvsK zuLul1At5>0Z=&twem%O1HEbUw{@I7Dfb(Z{o