mirror of
https://github.com/pomerium/pomerium.git
synced 2025-08-03 08:50:42 +02:00
c13459bb88
* authorize: authorization module adds support for per-route access policy. In this release we support the most common forms of identity based access policy: `allowed_users`, `allowed_groups`, and `allowed_domains`. In future versions, the authorization module will also support context and device based authorization policy and decisions. See website documentation for more details. * docs: updated `env.example` to include a `POLICY` setting example. * docs: added `IDP_SERVICE_ACCOUNT` to `env.example` . * docs: removed `PROXY_ROOT_DOMAIN` settings which has been replaced by `POLICY`. * all: removed `ALLOWED_DOMAINS` settings which has been replaced by `POLICY`. Authorization is now handled by the authorization service and is defined in the policy configuration files. * proxy: `ROUTES` settings which has been replaced by `POLICY`. * internal/log: `http.Server` and `httputil.NewSingleHostReverseProxy` now uses pomerium's logging package instead of the standard library's built in one. Closes #54 Closes #41 Closes #61 Closes #58
67 lines
3 KiB
Bash
67 lines
3 KiB
Bash
#!/bin/bash
|
|
|
|
# Main configuration flags
|
|
# export ADDRESS=":8443" # optional, default is 443
|
|
# export POMERIUM_DEBUG=true # optional, default is false
|
|
# export SERVICE="all" # optional, default is all.
|
|
|
|
# Certificates can be loaded as files or base64 encoded bytes. If neither is set, a
|
|
# pomerium will attempt to locate a pair in the root directory
|
|
export CERTIFICATE_FILE="./cert.pem" # optional, defaults to `./cert.pem`
|
|
export CERTIFICATE_KEY_FILE="./privkey.pem" # optional, defaults to `./certprivkey.pem`
|
|
# export CERTIFICATE="xxxxxx" # base64 encoded cert, eg. `base64 -i cert.pem`
|
|
# export CERTIFICATE_KEY="xxxx" # base64 encoded key, eg. `base64 -i privkey.pem`
|
|
|
|
# The URL that the identity provider will call back after authenticating the user
|
|
export REDIRECT_URL="https://sso-auth.corp.example.com/oauth2/callback"
|
|
# Allow users with emails from the following domain post-fix (e.g. example.com)
|
|
export ALLOWED_DOMAINS=*
|
|
# Generate 256 bit random keys e.g. `head -c32 /dev/urandom | base64`
|
|
export SHARED_SECRET=9wiTZq4qvmS/plYQyvzGKWPlH/UBy0DMYMA2x/zngrM=
|
|
export COOKIE_SECRET=uPGHo1ujND/k3B9V6yr52Gweq3RRYfFho98jxDG5Br8=
|
|
# If set, a JWT based signature is appended to each request header `x-pomerium-jwt-assertion`
|
|
# export SIGNING_KEY="Replace with base64'd private key from ./scripts/self-signed-sign-key.sh"
|
|
|
|
# Identity Provider Settings
|
|
|
|
# Azure
|
|
# export IDP_PROVIDER="azure"
|
|
# export IDP_PROVIDER_URL="https://login.microsoftonline.com/REPLACEME/v2.0"
|
|
# export IDP_CLIENT_ID="REPLACEME
|
|
# export IDP_CLIENT_SECRET="REPLACEME"
|
|
|
|
# Gitlab
|
|
# export IDP_PROVIDER="gitlab"
|
|
# export IDP_PROVIDER_URL="https://gitlab.onprem.example.com" # optional, defaults to `https://gitlab.com`
|
|
# export IDP_CLIENT_ID="REPLACEME
|
|
# export IDP_CLIENT_SECRET="REPLACEME"
|
|
|
|
## GOOGLE
|
|
export IDP_PROVIDER="google"
|
|
export IDP_PROVIDER_URL="https://accounts.google.com" # optional for google
|
|
export IDP_CLIENT_ID="REPLACE-ME.googleusercontent.com"
|
|
export IDP_CLIENT_SECRET="REPLACEME"
|
|
|
|
# IF GSUITE and you want to get user groups you will need to set a service account
|
|
# see identity provider docs for gooogle for more info :
|
|
# GSUITE_JSON_SERVICE_ACCOUNT='{"impersonate_user": "bdd@pomerium.io"}'
|
|
# export IDP_SERVICE_ACCOUNT=$(echo $GSUITE_JSON_SERVICE_ACCOUNT | base64)
|
|
|
|
# OKTA
|
|
# export IDP_PROVIDER="okta"
|
|
# export IDP_CLIENT_ID="REPLACEME"
|
|
# export IDP_CLIENT_SECRET="REPLACEME"
|
|
# export IDP_PROVIDER_URL="https://REPLACEME.oktapreview.com/oauth2/default"
|
|
|
|
# OneLogin
|
|
# export IDP_PROVIDER="onelogin"
|
|
# export IDP_CLIENT_ID="REPLACEME"
|
|
# export IDP_CLIENT_SECRET="REPLACEME"
|
|
# export IDP_PROVIDER_URL="https://openid-connect.onelogin.com/oidc" #optional, defaults to `https://openid-connect.onelogin.com/oidc`
|
|
|
|
# export SCOPE="openid email" # generally, you want the default OIDC scopes
|
|
|
|
# Proxied routes and per-route policies are defined in a policy provided either
|
|
# directly as a base64 encoded yaml/json file, or as a path pointing to a
|
|
# policy file (`POLICY_FILE`)
|
|
export POLICY_FILE="./policy.example.yml"
|