|
1 | 1 | ---
|
| 2 | +# cSpell:ignore localdomain |
| 3 | + |
2 | 4 | title: Glossary
|
3 | 5 | lang: en-US
|
4 | 6 | keywords:
|
@@ -60,11 +62,27 @@ The term "Perimeter" in the context of Pomerium and general networking usually r
|
60 | 62 |
|
61 | 63 | ### Policy
|
62 | 64 |
|
63 |
| -Pomerium allows administrators to define authorization policies dictating what combination of users, groups, devices, etc, have access to protected services. Open-source Pomerium defines a unique policy to every [route], while Pomerium Enterprise can define reusable policies at the global and [namespace] level. |
| 65 | +A Policy defines what services behind Pomerium a user is authorized to access based on policy criteria, such as user identity and device identity, and the associated request context. |
| 66 | + |
| 67 | +Policies can be applied to [Routes](/docs/capabilities/routing) directly, or enforced within a [Namespace](/docs/capabilities/namespacing). Policies allow operators to add authorization and access control to a single route or collection of routes. |
64 | 68 |
|
65 | 69 | ### Route
|
66 | 70 |
|
67 |
| -Specific to Pomerium, a route is a defined path from outside the network (via a public domain) to an internal service. Routes can be defined in the [configuration](/docs/reference/routes) for open-source Pomerium or the [Pomerium Enterprise Console][pom-routes]. |
| 71 | +Specific to Pomerium, a route is a defined path from outside the network (through a public domain) to an internal service. At a very basic level, a route sends traffic from `external-address.company.com` to `internalService-address.localdomain`; a route is restricted by its associated policies and encrypted by your TLS certificates. |
| 72 | + |
| 73 | +Routes can be defined in the [configuration](/docs/reference/routes) for open-source Pomerium or the [Pomerium Enterprise Console][/docs/deploy/enterprise]. |
| 74 | + |
| 75 | +More advanced configurations allow identity header pass-through, path and prefix rewrites, request and response header modification, load balancer services, and other full featured ingress capabilities. |
| 76 | + |
| 77 | +For more information, see the [Routing Capabilities])(/docs/capabilities/routing) page. |
| 78 | + |
| 79 | +### Service Account |
| 80 | + |
| 81 | +A service account provides bearer token based authentication for machine-to-machine communication through Pomerium to your protected endpoints. A service account can provide authentication for monitoring services, create API integrations, and other non-human driven scripts or services. |
| 82 | + |
| 83 | +A service account identity can either be based on a user entry in your IdP Directory, or exist as a custom identity managed in a Pomerium Console [Namespace](/docs/capabilities/namespacing). |
| 84 | + |
| 85 | +See the [Service Accounts](/docs/capabilities/service-accounts) capabilities page for more information on how to use service accounts in Pomerium. |
68 | 86 |
|
69 | 87 | ### Single Sign-On
|
70 | 88 |
|
@@ -145,7 +163,6 @@ Zero trust is a philosophy and/or framework for security models that includes se
|
145 | 163 | [policies]: #policy
|
146 | 164 | [pomerium enterprise]: /docs/deploy/enterprise/install
|
147 | 165 | [pom-namespace]: /docs/internals/glossary
|
148 |
| -[pom-routes]: /docs/concepts/routes |
149 | 166 | [route]: #route
|
150 | 167 | [routes]: #route
|
151 | 168 | [secure enclave]: #secure-enclave
|
|
0 commit comments