3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-05-05 21:36:02 +02:00
Code Issues Projects Releases Packages Wiki Activity
pomerium/docs/docs
History
Bobby DeSimone c886b924e7
authenticate: use gRPC for service endpoints (#39) 
* authenticate: set cookie secure as default.
* authenticate: remove single flight provider.
* authenticate/providers: Rename “ProviderData” to “IdentityProvider”
* authenticate/providers: Fixed an issue where scopes were not being overwritten
* proxy/authenticate : http client code removed.
* proxy: standardized session variable names between services.
* docs: change basic docker-config to be an “all-in-one” example with no nginx load.
* docs:  nginx balanced docker compose example with intra-ingress settings.
* license:  attribution for adaptation of goji’s middleware pattern.
2019-02-08 10:10:38 -08:00
..
examples authenticate: use gRPC for service endpoints (#39) 2019-02-08 10:10:38 -08:00
gitlab docs: add kubernetes (#33) 2019-01-27 22:22:14 -08:00
google docs: add kubernetes (#33) 2019-01-27 22:22:14 -08:00
microsoft docs: add kubernetes (#33) 2019-01-27 22:22:14 -08:00
okta docs: add kubernetes (#33) 2019-01-27 22:22:14 -08:00
signed-headers docs: add kubernetes (#33) 2019-01-27 22:22:14 -08:00
examples.md authenticate: use gRPC for service endpoints (#39) 2019-02-08 10:10:38 -08:00
identity-providers.md authenticate: use gRPC for service endpoints (#39) 2019-02-08 10:10:38 -08:00
readme.md authenticate: remove extra login page (#34) 2019-01-29 20:28:55 -08:00
signed-headers.md docs: add kubernetes (#33) 2019-01-27 22:22:14 -08:00

readme.md

Overview

What

Pomerium is an open-source, identity-aware access proxy.

Why

Traditional perimeter securityhas some shortcomings, namely:

  • Insider threat is not well addressed and 28% of breaches are by internal actors.
  • Impenetrable fortress in theory falls in practice; multiple entry points (like VPNs), lots of firewall rules, network segmentation creep.
  • Failure to encapsulate a heterogeneous mix of cloud, on-premise, cloud, and multi-cloud environments.
  • User's don't like VPNs.

Pomerium attempts to mitigate these shortcomings by adopting the following principles.

  • Trust flows from user, device, and context.
  • Network location does not impart trust. Treat both internal and external networks as completely untrusted.
  • Act like you are already breached, because your probably are.
  • Every device, user, and application's communication should be authenticated, authorized, and encrypted.
  • Policy should be dynamic, and built from multiple sources.

Resources

Books

Papers

Posts

Videos