mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-29 10:26:29 +02:00
66b4c2d3cd
proxy: Add user dashboard. [GH-123] proxy/authenticate: Add manual refresh of their session. [GH-73] authorize: Add administrator (super user) account support. [GH-110] internal/policy: Allow administrators to impersonate other users. [GH-110]
66 lines
2.9 KiB
Bash
66 lines
2.9 KiB
Bash
#!/bin/bash
|
|
|
|
# Main configuration flags
|
|
# export ADDRESS=":8443" # optional, default is 443
|
|
# export POMERIUM_DEBUG=true # optional, default is false
|
|
# export SERVICE="all" # optional, default is all
|
|
# export LOG_LEVEL="info" # optional, default is debug
|
|
|
|
export AUTHENTICATE_SERVICE_URL=https://authenticate.corp.beyondperimeter.com
|
|
export AUTHORIZE_SERVICE_URL=https://authorize.corp.beyondperimeter.com
|
|
|
|
# Certificates can be loaded as files or base64 encoded bytes. If neither is set, a
|
|
# pomerium will attempt to locate a pair in the root directory
|
|
export CERTIFICATE_FILE="./cert.pem" # optional, defaults to `./cert.pem`
|
|
export CERTIFICATE_KEY_FILE="./privkey.pem" # optional, defaults to `./certprivkey.pem`
|
|
# export CERTIFICATE="xxxxxx" # base64 encoded cert, eg. `base64 -i cert.pem`
|
|
# export CERTIFICATE_KEY="xxxx" # base64 encoded key, eg. `base64 -i privkey.pem`
|
|
|
|
# Generate 256 bit random keys e.g. `head -c32 /dev/urandom | base64`
|
|
export SHARED_SECRET=9wiTZq4qvmS/plYQyvzGKWPlH/UBy0DMYMA2x/zngrM=
|
|
export COOKIE_SECRET=uPGHo1ujND/k3B9V6yr52Gweq3RRYfFho98jxDG5Br8=
|
|
# If set, a JWT based signature is appended to each request header `x-pomerium-jwt-assertion`
|
|
# export SIGNING_KEY="Replace with base64'd private key from ./scripts/self-signed-sign-key.sh"
|
|
|
|
# Identity Provider Settings
|
|
|
|
# Azure
|
|
# export IDP_PROVIDER="azure"
|
|
# export IDP_PROVIDER_URL="https://login.microsoftonline.com/REPLACEME/v2.0"
|
|
# export IDP_CLIENT_ID="REPLACEME
|
|
# export IDP_CLIENT_SECRET="REPLACEME"
|
|
|
|
# Gitlab
|
|
# export IDP_PROVIDER="gitlab"
|
|
# export IDP_PROVIDER_URL="https://gitlab.onprem.example.com" # optional, defaults to `https://gitlab.com`
|
|
# export IDP_CLIENT_ID="REPLACEME
|
|
# export IDP_CLIENT_SECRET="REPLACEME"
|
|
|
|
## GOOGLE
|
|
export IDP_PROVIDER="google"
|
|
export IDP_PROVIDER_URL="https://accounts.google.com" # optional for google
|
|
export IDP_CLIENT_ID="REPLACE-ME.googleusercontent.com"
|
|
export IDP_CLIENT_SECRET="REPLACEME"
|
|
|
|
# IF GSUITE and you want to get user groups you will need to set a service account
|
|
# see identity provider docs for gooogle for more info :
|
|
# export IDP_SERVICE_ACCOUNT=$(echo '{"impersonate_user": "bdd@pomerium.io"}' | base64)
|
|
|
|
# OKTA
|
|
# export IDP_PROVIDER="okta"
|
|
# export IDP_CLIENT_ID="REPLACEME"
|
|
# export IDP_CLIENT_SECRET="REPLACEME"
|
|
# export IDP_PROVIDER_URL="https://REPLACEME.oktapreview.com/oauth2/default"
|
|
|
|
# OneLogin
|
|
# export IDP_PROVIDER="onelogin"
|
|
# export IDP_CLIENT_ID="REPLACEME"
|
|
# export IDP_CLIENT_SECRET="REPLACEME"
|
|
# export IDP_PROVIDER_URL="https://openid-connect.onelogin.com/oidc" #optional, defaults to `https://openid-connect.onelogin.com/oidc`
|
|
|
|
# export SCOPE="openid email" # generally, you want the default OIDC scopes
|
|
|
|
# Proxied routes and per-route policies are defined in a policy provided either
|
|
# directly as a base64 encoded yaml/json file, or as the policy key in the configuration
|
|
# file
|
|
export POLICY="$(base64 ./policy.yaml)"
|