mirror of
https://github.com/pomerium/pomerium.git
synced 2025-06-03 19:32:48 +02:00
DOCS: Standardize Reference image paths in Enterprise Docs (#3080)
* copy enterprise reference image to core reference img dir * standardize reference image path * link fixes
This commit is contained in:
Alex Fornuto
GitHub
parent
1342523cda
commit
d1e784efa9
21 changed files with 39 additions and 38 deletions
|
|
@ -13,7 +13,7 @@ One of the core components of the zero trust security model is **device identity
|
||||||
|
|
||||||
The history of IT security has, until recently, mostly focused on user identity verification. In this model, access to a service is granted only after verifying a user's identity and authorization to that service. This was usually sufficient in scenarios where the user's access was physically limited to trusted devices in trusted physical and network spaces; a PC sitting in an office in the company headquarters on a local network, for example.
|
The history of IT security has, until recently, mostly focused on user identity verification. In this model, access to a service is granted only after verifying a user's identity and authorization to that service. This was usually sufficient in scenarios where the user's access was physically limited to trusted devices in trusted physical and network spaces; a PC sitting in an office in the company headquarters on a local network, for example.
|
||||||
|
|
||||||
Hardware-backed device identity is becoming more widely discussed as more products begin to implement or require it across all tech industries. For example, Windows 11 generated a lot of news by [requiring TPM 2.0][win11-reqs], and Apple is taking steps to [eliminate passwords][apple-passkeys]:
|
Hardware-backed device identity is becoming more widely discussed as more products begin to implement or require it across all tech industries. For example, Windows 11 generated a lot of news by [requiring TPM 2.0][win11-reqs], and Apple is taking steps to [eliminate passwords][apple-passkeys] :
|
||||||
|
|
||||||
|  |
|
|  |
|
||||||
|:--|
|
|:--|
|
||||||
|
|
|
||||||
|
|
@ -5,22 +5,22 @@ settings:
|
||||||
doc: |
|
doc: |
|
||||||
View the traffic running through Pomerium. Filter by [Route][route-concept] name, or date range.
|
View the traffic running through Pomerium. Filter by [Route][route-concept] name, or date range.
|
||||||
|
|
||||||
|
|
||||||
- name: "Runtime"
|
- name: "Runtime"
|
||||||
doc: |
|
doc: |
|
||||||
Monitor how many system resources Pomerium is consuming. Filter by date range, service, and instance.
|
Monitor how many system resources Pomerium is consuming. Filter by date range, service, and instance.
|
||||||
|
|
||||||
|
|
||||||
- name: "Sessions"
|
- name: "Sessions"
|
||||||
doc: |
|
doc: |
|
||||||
View active Sessions. From here you can revoke sessions, filter by session or user information, or revoke one or multiple sessions. You can also export the data.
|
View active Sessions. From here you can revoke sessions, filter by session or user information, or revoke one or multiple sessions. You can also export the data.
|
||||||
|
|
||||||
|
|
||||||
- name: "Events"
|
- name: "Events"
|
||||||
doc: |
|
doc: |
|
||||||
The events page displays the log output of Envoy as it process changes from Pomerium and applies updates to the underlying services.
|
The events page displays the log output of Envoy as it process changes from Pomerium and applies updates to the underlying services.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
The most common updates are to Pomerium Proxy services, which are updated every time a Route or Policy is created or updated.
|
The most common updates are to Pomerium Proxy services, which are updated every time a Route or Policy is created or updated.
|
||||||
|
|
||||||
|
|
@ -31,7 +31,7 @@ settings:
|
||||||
|
|
||||||
The default view shows all changes made through Pomerium Enterprise. Use the **COMPARE** button next to an entry to filter to only changes that affected that resource. Select two versions of that resource, then **DIFF** to see what changed:
|
The default view shows all changes made through Pomerium Enterprise. Use the **COMPARE** button next to an entry to filter to only changes that affected that resource. Select two versions of that resource, then **DIFF** to see what changed:
|
||||||
|
|
||||||
|
|
||||||
- name: "Manage"
|
- name: "Manage"
|
||||||
settings:
|
settings:
|
||||||
- name: "Routes"
|
- name: "Routes"
|
||||||
|
|
@ -98,13 +98,13 @@ settings:
|
||||||
|
|
||||||
From the **BUILDER** tab, users can add allow or deny blocks to a policy, containing and/or/not/nor logic to allow or deny sets of users and groups.
|
From the **BUILDER** tab, users can add allow or deny blocks to a policy, containing and/or/not/nor logic to allow or deny sets of users and groups.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### Pomerium Policy Language
|
### Pomerium Policy Language
|
||||||
|
|
||||||
From the **EDITOR** tab users can write policies in Pomerium Policy Language (**PPL**), a YAML-based notation.
|
From the **EDITOR** tab users can write policies in Pomerium Policy Language (**PPL**), a YAML-based notation.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
PPL documents contain one or more rules. Each rule has a corresponding action and one or more logical operators.
|
PPL documents contain one or more rules. Each rule has a corresponding action and one or more logical operators.
|
||||||
Each logical operator contains criteria and each criterion has a name and corresponding data.
|
Each logical operator contains criteria and each criterion has a name and corresponding data.
|
||||||
|
|
@ -186,13 +186,13 @@ settings:
|
||||||
Displays the currently enrolled devices for each user, along with their current approval status.
|
Displays the currently enrolled devices for each user, along with their current approval status.
|
||||||
Administrators can inspect, approve, or delete registered devices from this table.
|
Administrators can inspect, approve, or delete registered devices from this table.
|
||||||
|
|
||||||
|
|
||||||
- name: "New Enrollment"
|
- name: "New Enrollment"
|
||||||
doc: |
|
doc: |
|
||||||
The **New Enrollment** button allows administrators to create a custom link for a specific user to use to register a new device, which will automatically be approved.
|
The **New Enrollment** button allows administrators to create a custom link for a specific user to use to register a new device, which will automatically be approved.
|
||||||
This scheme is known as [Trust on First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use).
|
This scheme is known as [Trust on First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use).
|
||||||
|
|
||||||
|
|
||||||
settings:
|
settings:
|
||||||
- name: "Search Users"
|
- name: "Search Users"
|
||||||
doc: "New Enrollment URLs are only valid for the specified user."
|
doc: "New Enrollment URLs are only valid for the specified user."
|
||||||
|
|
@ -264,7 +264,7 @@ settings:
|
||||||
|
|
||||||
1. From the main menu, select **Service Accounts** under **CONFIGURE**. Click the **+ ADD SERVICE ACCOUNT** button:
|
1. From the main menu, select **Service Accounts** under **CONFIGURE**. Click the **+ ADD SERVICE ACCOUNT** button:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
1. Service accounts can be unique and exist only for Pomerium, or impersonate directory users from your IdP.
|
1. Service accounts can be unique and exist only for Pomerium, or impersonate directory users from your IdP.
|
||||||
|
|
||||||
|
|
@ -272,30 +272,30 @@ settings:
|
||||||
:::: tab Unique
|
:::: tab Unique
|
||||||
Give the user a unique ID. Consider referencing the Namespace you're creating it under, for easier reference later. Optionally set an expiration date:
|
Give the user a unique ID. Consider referencing the Namespace you're creating it under, for easier reference later. Optionally set an expiration date:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
The user ID set here corresponds to the `User` criteria when editing a policy.
|
The user ID set here corresponds to the `User` criteria when editing a policy.
|
||||||
::::
|
::::
|
||||||
:::: tab Impersonated
|
:::: tab Impersonated
|
||||||
You can find your User ID by going to the special endpoint `/.pomerium`, or selecting **Logout** under your user in the upper right hand corner (this will not immediately log you out):
|
You can find your User ID by going to the special endpoint `/.pomerium`, or selecting **Logout** under your user in the upper right hand corner (this will not immediately log you out):
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Copy the User ID and paste it into the **User ID** field in the **Add Service Account** modal. The lookahead search should show you the user name You can also optionally set an expiration date:
|
Copy the User ID and paste it into the **User ID** field in the **Add Service Account** modal. The lookahead search should show you the user name You can also optionally set an expiration date:
|
||||||
|
|
||||||
|
|
||||||
::::
|
::::
|
||||||
:::::
|
:::::
|
||||||
|
|
||||||
1. After you click **Submit**, the modal presents the JSON web token (**JWT**) for the service account. Temporarily save it somewhere secure, as you will not be able to view it again:
|
1. After you click **Submit**, the modal presents the JSON web token (**JWT**) for the service account. Temporarily save it somewhere secure, as you will not be able to view it again:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
This JWT must be added to your application configuration to enable direct communication.
|
This JWT must be added to your application configuration to enable direct communication.
|
||||||
|
|
||||||
1. Edit or create policies to give the service account access to the internal service:
|
1. Edit or create policies to give the service account access to the internal service:
|
||||||
|
|
||||||
|
|
||||||
- name: "Namespaces"
|
- name: "Namespaces"
|
||||||
keys: ["namespace"]
|
keys: ["namespace"]
|
||||||
doc: |
|
doc: |
|
||||||
|
|
|
||||||
|
|
@ -180,7 +180,7 @@ Before you begin, confirm you are in the correct Namespace. A service account ca
|
||||||
|
|
||||||
1. From the main menu, select **Service Accounts** under **CONFIGURE**. Click the **+ ADD SERVICE ACCOUNT** button:
|
1. From the main menu, select **Service Accounts** under **CONFIGURE**. Click the **+ ADD SERVICE ACCOUNT** button:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
1. Service accounts can be unique and exist only for Pomerium, or impersonate directory users from your IdP.
|
1. Service accounts can be unique and exist only for Pomerium, or impersonate directory users from your IdP.
|
||||||
|
|
||||||
|
|
@ -188,30 +188,30 @@ Before you begin, confirm you are in the correct Namespace. A service account ca
|
||||||
:::: tab Unique
|
:::: tab Unique
|
||||||
Give the user a unique ID. Consider referencing the Namespace you're creating it under, for easier reference later. Optionally set an expiration date:
|
Give the user a unique ID. Consider referencing the Namespace you're creating it under, for easier reference later. Optionally set an expiration date:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
The user ID set here corresponds to the `User` criteria when editing a policy.
|
The user ID set here corresponds to the `User` criteria when editing a policy.
|
||||||
::::
|
::::
|
||||||
:::: tab Impersonated
|
:::: tab Impersonated
|
||||||
You can find your User ID by going to the special endpoint `/.pomerium`, or selecting **Logout** under your user in the upper right hand corner (this will not immediately log you out):
|
You can find your User ID by going to the special endpoint `/.pomerium`, or selecting **Logout** under your user in the upper right hand corner (this will not immediately log you out):
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Copy the User ID and paste it into the **User ID** field in the **Add Service Account** modal. The lookahead search should show you the user name You can also optionally set an expiration date:
|
Copy the User ID and paste it into the **User ID** field in the **Add Service Account** modal. The lookahead search should show you the user name You can also optionally set an expiration date:
|
||||||
|
|
||||||
|
|
||||||
::::
|
::::
|
||||||
:::::
|
:::::
|
||||||
|
|
||||||
1. After you click **Submit**, the modal presents the JSON web token (**JWT**) for the service account. Temporarily save it somewhere secure, as you will not be able to view it again:
|
1. After you click **Submit**, the modal presents the JSON web token (**JWT**) for the service account. Temporarily save it somewhere secure, as you will not be able to view it again:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
This JWT must be added to your application configuration to enable direct communication.
|
This JWT must be added to your application configuration to enable direct communication.
|
||||||
|
|
||||||
1. Edit or create policies to give the service account access to the internal service:
|
1. Edit or create policies to give the service account access to the internal service:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Namespaces
|
## Namespaces
|
||||||
|
|
|
||||||
|
|
@ -185,13 +185,14 @@ of the connection using `timeout` value (i.e. to 1 day).
|
||||||
|
|
||||||
#### Host Headers
|
#### Host Headers
|
||||||
|
|
||||||
The `host` header can be preserved via the `preserve_host_header` setting or customized via 3 mutually exclusive options:
|
The `host` header can be preserved via the `preserve_host_header` setting or customized via three mutually exclusive options:
|
||||||
|
|
||||||
|
1. `preserve_host_header` will, when enabled, this option will pass the host header from the incoming request to the proxied host, instead of the destination hostname. It's an optional parameter of type `bool` that defaults to `false`.
|
||||||
|
|
||||||
1. `preserve_host_header` when enabled, this option will pass the host header from the incoming request to the proxied host, instead of the destination hostname. It's an optional parameter of type `bool` that defaults to `false`.
|
|
||||||
See [ProxyPreserveHost](http://httpd.apache.org/docs/2.0/mod/mod_proxy.html#proxypreservehost).
|
See [ProxyPreserveHost](http://httpd.apache.org/docs/2.0/mod/mod_proxy.html#proxypreservehost).
|
||||||
2. `host_rewrite` which will rewrite the host to a new literal value.
|
2. `host_rewrite`, which will rewrite the host to a new literal value.
|
||||||
3. `host_rewrite_header` which will rewrite the host to match an incoming header value.
|
3. `host_rewrite_header`, which will rewrite the host to match an incoming header value.
|
||||||
4. `host_path_regex_rewrite_pattern`, `host_path_regex_rewrite_substitution` which will rewrite the host according to a regex matching the path. For example with the following config:
|
4. `host_path_regex_rewrite_pattern` & `host_path_regex_rewrite_substitution`, which will rewrite the host according to a regex matching the path. For example with the following config:
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
host_path_regex_rewrite_pattern: "^/(.+)/.+$"
|
host_path_regex_rewrite_pattern: "^/(.+)/.+$"
|
||||||
|
|
@ -200,7 +201,7 @@ The `host` header can be preserved via the `preserve_host_header` setting or cus
|
||||||
|
|
||||||
Would rewrite the host header to `example.com` given the path `/example.com/some/path`.
|
Would rewrite the host header to `example.com` given the path `/example.com/some/path`.
|
||||||
|
|
||||||
The 2nd, 3rd and 4th options correspond to the envoy route action host related options, which can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto.html#config-route-v3-routeaction).
|
The 2nd, 3rd and 4th options correspond to the Envoy route action host related options, which can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto.html#config-route-v3-routeaction).
|
||||||
|
|
||||||
#### Set Request Headers
|
#### Set Request Headers
|
||||||
|
|
||||||
|
|
@ -289,13 +290,13 @@ Policies can be constructed three ways:
|
||||||
|
|
||||||
From the **BUILDER** tab, users can add allow or deny blocks to a policy, containing and/or/not/nor logic to allow or deny sets of users and groups.
|
From the **BUILDER** tab, users can add allow or deny blocks to a policy, containing and/or/not/nor logic to allow or deny sets of users and groups.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### Pomerium Policy Language
|
### Pomerium Policy Language
|
||||||
|
|
||||||
From the **EDITOR** tab users can write policies in Pomerium Policy Language (**PPL**), a YAML-based notation.
|
From the **EDITOR** tab users can write policies in Pomerium Policy Language (**PPL**), a YAML-based notation.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
PPL documents contain one or more rules. Each rule has a corresponding action and one or more logical operators.
|
PPL documents contain one or more rules. Each rule has a corresponding action and one or more logical operators.
|
||||||
Each logical operator contains criteria and each criterion has a name and corresponding data.
|
Each logical operator contains criteria and each criterion has a name and corresponding data.
|
||||||
|
|
@ -407,7 +408,7 @@ Device enrollment let's you create [policies](/docs/topics/ppl.md#device-matcher
|
||||||
Displays the currently enrolled devices for each user, along with their current approval status.
|
Displays the currently enrolled devices for each user, along with their current approval status.
|
||||||
Administrators can inspect, approve, or delete registered devices from this table.
|
Administrators can inspect, approve, or delete registered devices from this table.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### New Enrollment
|
### New Enrollment
|
||||||
|
|
@ -415,7 +416,7 @@ Administrators can inspect, approve, or delete registered devices from this tabl
|
||||||
The **New Enrollment** button allows administrators to create a custom link for a specific user to use to register a new device, which will automatically be approved.
|
The **New Enrollment** button allows administrators to create a custom link for a specific user to use to register a new device, which will automatically be approved.
|
||||||
This scheme is known as [Trust on First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use).
|
This scheme is known as [Trust on First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use).
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### Search Users
|
#### Search Users
|
||||||
|
|
|
||||||
|
|
@ -13,28 +13,28 @@ meta:
|
||||||
|
|
||||||
View the traffic running through Pomerium. Filter by [Route][route-concept] name, or date range.
|
View the traffic running through Pomerium. Filter by [Route][route-concept] name, or date range.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Runtime
|
## Runtime
|
||||||
|
|
||||||
Monitor how many system resources Pomerium is consuming. Filter by date range, service, and instance.
|
Monitor how many system resources Pomerium is consuming. Filter by date range, service, and instance.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Sessions
|
## Sessions
|
||||||
|
|
||||||
View active Sessions. From here you can revoke sessions, filter by session or user information, or revoke one or multiple sessions. You can also export the data.
|
View active Sessions. From here you can revoke sessions, filter by session or user information, or revoke one or multiple sessions. You can also export the data.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Events
|
## Events
|
||||||
|
|
||||||
The events page displays the log output of Envoy as it process changes from Pomerium and applies updates to the underlying services.
|
The events page displays the log output of Envoy as it process changes from Pomerium and applies updates to the underlying services.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
The most common updates are to Pomerium Proxy services, which are updated every time a Route or Policy is created or updated.
|
The most common updates are to Pomerium Proxy services, which are updated every time a Route or Policy is created or updated.
|
||||||
|
|
||||||
|
|
@ -47,7 +47,7 @@ From the **Deployment History** page administrators can review changes made to t
|
||||||
|
|
||||||
The default view shows all changes made through Pomerium Enterprise. Use the **COMPARE** button next to an entry to filter to only changes that affected that resource. Select two versions of that resource, then **DIFF** to see what changed:
|
The default view shows all changes made through Pomerium Enterprise. Use the **COMPARE** button next to an entry to filter to only changes that affected that resource. Select two versions of that resource, then **DIFF** to see what changed:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
[route-concept]: /enterprise/concepts.md#routes
|
[route-concept]: /enterprise/concepts.md#routes
|
||||||
|
|
|
||||||
|
|
@ -14,7 +14,7 @@ description: >-
|
||||||
|
|
||||||
If a Pomerium route is configured to [require device authentication](/docs/topics/ppl.md#device-matcher), then the user must register a [trusted execution environment](/docs/topics/device-identity.md#authenticated-device-types) (**TEE**) device before accessing the route. Registration is easy, but different depending on the device being used to provide ID.
|
If a Pomerium route is configured to [require device authentication](/docs/topics/ppl.md#device-matcher), then the user must register a [trusted execution environment](/docs/topics/device-identity.md#authenticated-device-types) (**TEE**) device before accessing the route. Registration is easy, but different depending on the device being used to provide ID.
|
||||||
|
|
||||||
This guide covers enrollment of a device by a user. This is available for both open-source Pomerium and [Pomerium Enterprise](/enterprise) installations. However, Enterprise users may also receive registration links [generated by their administrators](/guides/admin-enroll-device.md), which will mark the newly enrolled device as approved in the Pomerium Enterprise Console.
|
This guide covers enrollment of a device by a user. This is available for both open-source Pomerium and [Pomerium Enterprise](/enterprise/readme.md) installations. However, Enterprise users may also receive registration links [generated by their administrators](/guides/admin-enroll-device.md), which will mark the newly enrolled device as approved in the Pomerium Enterprise Console.
|
||||||
|
|
||||||
1. Users are prompted to register a new device when accessing a route that requires device authentication:
|
1. Users are prompted to register a new device when accessing a route that requires device authentication:
|
||||||
|
|
||||||
|
|
|
||||||
|
Before Width: | Height: | Size: 44 KiB After Width: | Height: | Size: 44 KiB |
|
Before Width: | Height: | Size: 34 KiB After Width: | Height: | Size: 34 KiB |
|
Before Width: | Height: | Size: 16 KiB After Width: | Height: | Size: 16 KiB |
|
Before Width: | Height: | Size: 15 KiB After Width: | Height: | Size: 15 KiB |
|
Before Width: | Height: | Size: 35 KiB After Width: | Height: | Size: 35 KiB |
|
Before Width: | Height: | Size: 46 KiB After Width: | Height: | Size: 46 KiB |
|
Before Width: | Height: | Size: 14 KiB After Width: | Height: | Size: 14 KiB |
|
Before Width: | Height: | Size: 44 KiB After Width: | Height: | Size: 44 KiB |
BIN
docs/reference/img/new-enrollment.png
Normal file
BIN
docs/reference/img/new-enrollment.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
|
Before Width: | Height: | Size: 32 KiB After Width: | Height: | Size: 32 KiB |
|
Before Width: | Height: | Size: 41 KiB After Width: | Height: | Size: 41 KiB |
|
Before Width: | Height: | Size: 60 KiB After Width: | Height: | Size: 60 KiB |
|
Before Width: | Height: | Size: 14 KiB After Width: | Height: | Size: 14 KiB |
|
Before Width: | Height: | Size: 81 KiB After Width: | Height: | Size: 81 KiB |
|
Before Width: | Height: | Size: 17 KiB After Width: | Height: | Size: 17 KiB |
Loading…
Add table
Add a link
Reference in a new issue