Skip to content

Commit d24a813

Browse files
wasagawasaga
committed
Merge remote-tracking branch 'origin/main' into wasaga/terraform
2 parents f7b867b + 5e16674 commit d24a813

9 files changed

+224
-8
lines changed

‎content/docs/admonitions/_upgrade-versions.mdx

-1
This file was deleted.

‎content/docs/deploy/upgrading.mdx

+20-4
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ Below are upgrade notes for both **Pomerium Core** (the open-source edition) and
1010

1111
import Tabs from '@theme/Tabs';
1212
import TabItem from '@theme/TabItem';
13-
import UpgradeNotice from '@site/content/docs/admonitions/_upgrade-versions.mdx';
1413

1514
<Tabs>
1615

@@ -278,13 +277,30 @@ No changes required.
278277

279278
## Upgrading Pomerium Enterprise
280279

281-
Please review these deprecations and important changes for Pomerium Enterprise before upgrading.
280+
:::info
282281

283-
:::caution
282+
Your Pomerium Enterprise version should always match the same **minor version number** as your Pomerium Core version. For example:
283+
✅ Core **v0.27.0** with Enterprise **v0.27.3** is a supported configuration.
284+
❌ Core **v0.27.0** with Enterprise **v0.28.0** is not supported.
284285

285-
<UpgradeNotice />
286286
:::
287287

288+
To **upgrade** a Pomerium Enterprise deployment, we recommend that you:
289+
290+
1. Reach out to your account manager to let us know you are planning an upgrade, especially if upgrading across multiple minor versions at once.
291+
1. First review the version-specific upgrade notes on this page for **both** Pomerium Core and Pomerium Enterprise for any changes that might pertain to your deployment. (If you're not sure, please don't hesitate to reach out and ask for clarification.)
292+
1. Take a database backup of the Pomerium Enterprise database.
293+
1. Upgrade Pomerium Core to the new version. For a replicated deployment, instances can be updated one at a time to avoid downtime.
294+
1. Upgrade Pomerium Enterprise to the new version.
295+
1. Verify that your deployment continues to behave as expected.
296+
297+
In case of trouble during the upgrade process, follow these steps to **roll back** to the previous version:
298+
299+
1. Stop Pomerium Enterprise.
300+
1. Restore the Pomerium Enterprise database from a backup taken before the upgrade.
301+
1. Downgrade Pomerium Core to the previous version.
302+
1. Start the previous version of Pomerium Enterprise.
303+
288304
### v0.28.0
289305

290306
No breaking changes in v0.28.

‎content/docs/reference/bearer-token-format.mdx

+89
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
id: bearer-token-format
3+
title: Bearer Token Format
4+
description: |
5+
Bearer token format controls how HTTP bearer token authentication is handled.
6+
keywords:
7+
- reference
8+
- Bearer Token Format
9+
pagination_prev: null
10+
pagination_next: null
11+
toc_max_heading_level: 2
12+
---
13+
14+
import Tabs from '@theme/Tabs';
15+
import TabItem from '@theme/TabItem';
16+
17+
# Bearer Token Format
18+
19+
## Summary
20+
21+
**Bearer Token Format** controls how HTTP bearer token authentication is handled. There are 3 possible options: `default`, `idp_access_token` and `idp_identity_token`.
22+
23+
HTTP bearer tokens are tokens stored in the `Authorization` header prefixed by `Bearer `:
24+
25+
```text
26+
GET / HTTP/1.1
27+
Authorization: Bearer Token
28+
```
29+
30+
Pomerium's `default` behavior is to pass bearer tokens to upstream applications without interpreting them. Pomerium also supports creating sessions from tokens issued by an identity provider without needing to initiate an interactive login. If the `idp_access_token` option is used, then the bearer token will be interpreted as an IdP-issued access token. If the `idp_identity_token` option is used, then the bearer token will be interpreted as an IdP-issued identity token.
31+
32+
Currently only [Microsoft Entra](../integrations/user-identity/azure) is supported with this option.
33+
34+
This option can also be configured at the route-level.
35+
36+
## Additional Headers
37+
38+
Pomerium also always supports passing IdP access and identity tokens via the following headers (replacing `<TOKEN>` with the issued token):
39+
40+
- `X-Pomerium-IDP-Access-Token: <TOKEN>`
41+
- `Authorization: Pomerium-IDP-Access-Token <TOKEN>`
42+
- `Authorization: Bearer Pomerium-IDP-Access-Token-<TOKEN>`
43+
- `X-Pomerium-IDP-Identity-Token: <TOKEN>`
44+
- `Authorization: Pomerium-IDP-Identity-Token <TOKEN>`
45+
- `Authorization: Bearer Pomerium-IDP-Identity-Token-<TOKEN>`
46+
47+
## How to Configure
48+
49+
<Tabs>
50+
<TabItem value="Core" label="Core">
51+
52+
| **Config file keys** | **Environment variables** | **Type** | **Default** |
53+
| :-------------------- | :------------------------ | :------- | :---------- |
54+
| `bearer_token_format` | `BEARER_TOKEN_FORMAT` | `string` | `default` |
55+
56+
### Examples
57+
58+
```yaml
59+
bearer_token_format: idp_access_token
60+
```
61+
62+
```bash
63+
BEARER_TOKEN_FORMAT=idp_access_token
64+
```
65+
66+
### Options
67+
68+
- `default`
69+
- `idp_access_token`
70+
- `idp_identity_token`
71+
72+
</TabItem>
73+
<TabItem value="Enterprise" label="Enterprise">
74+
75+
Set **Bearer Token Format** under **Proxy** settings in the Console:
76+
77+
![Set bearer token format in the Console](./img/global-settings/bearer-token-format.png)
78+
79+
</TabItem>
80+
<TabItem value="Kubernetes" label="Kubernetes">
81+
82+
```yaml
83+
bearerTokenFormat: idp_access_token
84+
```
85+
86+
See [Kubernetes - Global Configuration](/docs/deploy/k8s/configure) for more information.
87+
88+
</TabItem>
89+
</Tabs>

‎content/docs/reference/idp-access-token-allowed-audiences.mdx

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
id: idp-access-token-allowed-audiences
3+
title: IdP Access Token Allowed Audiences
4+
description: |
5+
IdP access token allowed audiences controls how the audience claim of an incoming IdP-issued access token is validated.
6+
keywords:
7+
- reference
8+
- IdP Access Token Allowed Audiences
9+
pagination_prev: null
10+
pagination_next: null
11+
toc_max_heading_level: 2
12+
---
13+
14+
import Tabs from '@theme/Tabs';
15+
import TabItem from '@theme/TabItem';
16+
17+
# IdP Access Token Allowed Audiences
18+
19+
## Summary
20+
21+
**IdP Access Token Allowed Audiences** controls how the audience claim of an incoming IdP-issued access token is validated.
22+
23+
For [Microsoft Entra](../integrations/user-identity/azure) an access-token is a JWT with an audience claim. When the IdP Access Token Allowed Audiences option is set, the `aud` claim of the access token JWT must match one of the entries.
24+
25+
This option can also be configured at the route-level.
26+
27+
## How to Configure
28+
29+
<Tabs>
30+
<TabItem value="Core" label="Core">
31+
32+
| **Config file keys** | **Environment variables** | **Type** |
33+
| :-- | :-- | :-- |
34+
| `idp_access_token_allowed_audiences` | `IDP_ACCESS_TOKEN_ALLOWED_AUDIENCES` | Array of strings |
35+
36+
### Examples
37+
38+
```yaml
39+
idp_access_token_allowed_audiences:
40+
- https://sts.windows.net/f42bce3b-671c-4162-b24c-00ecc7641897/
41+
- https://login.microsoftonline.com/f42bce3b-671c-4162-b24c-00ecc7641897/
42+
```
43+
44+
</TabItem>
45+
<TabItem value="Enterprise" label="Enterprise">
46+
47+
Set **IdP Access Token Allowed Audiences** under **Authenticate** settings in the Console:
48+
49+
![Set **IdP Access Token Allowed Audiences** in the Console](./img/global-settings/idp-access-token-allowed-audiences.png)
50+
51+
</TabItem>
52+
<TabItem value="Kubernetes" label="Kubernetes">
53+
54+
```yaml
55+
idpAccessTokenAllowedAudiences:
56+
- https://sts.windows.net/f42bce3b-671c-4162-b24c-00ecc7641897/
57+
- https://login.microsoftonline.com/f42bce3b-671c-4162-b24c-00ecc7641897/
58+
```
59+
60+
See [Kubernetes - Global Configuration](/docs/deploy/k8s/configure) for more information.
61+
62+
</TabItem>
63+
</Tabs>

‎content/docs/reference/img/global-settings/bearer-token-format.png

261 KB
Loading

‎content/docs/reference/img/global-settings/idp-access-token-allowed-audiences.png

197 KB
Loading

‎content/docs/reference/reference.json

+18
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,15 @@
114114
"type": "string",
115115
"short_description": ""
116116
},
117+
"bearer-token-format": {
118+
"id": "bearer-token-format",
119+
"title": "Bearer Token Format",
120+
"path": "/bearer-token-format",
121+
"services": ["authorize", "proxy"],
122+
"type": "string",
123+
"description": "Bearer Token Format controls how HTTP bearer token authentication is handled.",
124+
"short_description": "Bearer Token Format controls how HTTP bearer token authentication is handled."
125+
},
117126
"branding-settings": {
118127
"id": "branding",
119128
"title": "Branding Settings",
@@ -404,6 +413,15 @@
404413
"services": [],
405414
"type": ""
406415
},
416+
"idp-access-token-allowed-audiences": {
417+
"id": "idp-access-token-allowed-audiences",
418+
"title": "IDP Access Token Allowed Audiences",
419+
"path": "/idp-access-token-allowed-audiences",
420+
"description": "IdP Access Token Allowed Audiences controls how the audience claim of an incoming IdP-issued access token is validated.",
421+
"short_description": "IdP Access Token Allowed Audiences controls how the audience claim of an incoming IdP-issued access token is validated.",
422+
"services": ["authenticate"],
423+
"type": "string[]"
424+
},
407425
"grpc-settings": {
408426
"id": "grpc-settings",
409427
"title": "gRPC Settings",

‎static/_redirects

+31
Original file line numberDiff line numberDiff line change
@@ -160,14 +160,24 @@ https://docs.pomerium.io/* https://docs.pomerium.com/:splat 301!
160160
/docs/capabilities/rego /docs/internals/ppl#rego
161161
/docs/capabilities/self-hosted-authenticate-service /docs/capabilities/authentication#self-hosted-authenticate-service
162162
/docs/capabilities/single-sign-out /docs/capabilities/authentication#single-sign-out-sso
163+
/docs/capabilities/tcp /docs/capabilities/non-http/tcp
163164
/docs/capabilities/tcp/client /docs/capabilities/non-http/client
164165
/docs/capabilities/tcp/examples/git /docs/capabilities/non-http/examples/git
165166
/docs/capabilities/tcp/examples/mysql /docs/capabilities/non-http/examples/mysql
167+
/docs/capabilities/tcp/examples/rdp /docs/capabilities/non-http/examples/rdp
166168
/docs/capabilities/tcp/examples/ssh /docs/capabilities/non-http/examples/ssh
169+
/docs/capabilities/tcp/reference /docs/deploy/clients#connecting-via-pomerium-cli
167170
/docs/clients/pomerium-desktop /docs/deploy/clients
171+
/docs/community /docs#community
172+
/docs/community/ /docs#community
168173
/docs/community/security /docs/internals/security
174+
/docs/concepts/clusters /docs/internals/clusters
175+
/docs/concepts/device-identity /docs/integrations/device-context/device-identity
176+
/docs/concepts/mutual-auth /docs/internals/mutual-auth
177+
/docs/concepts/mutual-auth.html /docs/internals/mutual-auth
169178
/docs/concepts/policies /docs/capabilities/authorization
170179
/docs/concepts/zero-trust /docs/internals/zero-trust
180+
/docs/core/binary /docs/deploy/core#pre-built-binaries
171181
/docs/core/from-source /docs/deploy/core
172182
/docs/core/upgrading /docs/deploy/upgrading
173183
/docs/courses/fundamentals/jwt-verification /docs/get-started/fundamentals/core/jwt-verification
@@ -181,6 +191,7 @@ https://docs.pomerium.io/* https://docs.pomerium.com/:splat 301!
181191
/docs/enterprise/configure /docs/deploy/enterprise/configure
182192
/docs/enterprise/external-data/geoip /docs/integrations/request-context/geoip
183193
/docs/enterprise/external-data/ip-ranges /docs/integrations/request-context/ip-ranges
194+
/docs/enterprise/quickstart /docs/deploy/enterprise/quickstart
184195
/docs/get-started/fundamentals/advanced-policies /docs/get-started/fundamentals/core/advanced-policies
185196
/docs/get-started/fundamentals/advanced-policies.html /docs/get-started/fundamentals/core/advanced-policies
186197
/docs/get-started/fundamentals/advanced-routes /docs/get-started/fundamentals/core/advanced-routes
@@ -215,18 +226,23 @@ https://docs.pomerium.io/* https://docs.pomerium.com/:splat 301!
215226
/docs/get-started/fundamentals/zero-single-sign-on.html /docs/get-started/fundamentals/zero/zero-single-sign-on
216227
/docs/get-started/fundamentals/zero-tcp-routes /docs/get-started/fundamentals/zero/zero-tcp-routes
217228
/docs/get-started/fundamentals/zero-tcp-routes.html /docs/get-started/fundamentals/zero/zero-tcp-routes
229+
/docs/guides/cors /docs/internals/troubleshooting#cross-origin-configuration
218230
/docs/guides/jwt-verification-with-envoy /docs/capabilities/getting-users-identity
219231
/docs/guides/kubernetes.html /docs/deploy/k8s/quickstart
220232
/docs/guides/nginx https://0-20-0.docs.pomerium.com/docs/guides/nginx 301!
221233
/docs/guides/nginx.html https://0-20-0.docs.pomerium.com/docs/guides/nginx 301!
234+
/docs/guides/securing-tcp /docs/capabilities/non-http/tcp
222235
/docs/guides/upstream-mtls.html /docs/capabilities/mtls-services
223236
/docs/identity-providers /docs/integrations/user-identity/identity-providers
224237
/docs/identity-providers/apple /docs/integrations/user-identity/apple
225238
/docs/identity-providers/auth0 /docs/integrations/user-identity/auth0
226239
/docs/identity-providers/azure /docs/integrations/user-identity/azure
240+
/docs/identity-providers/github /docs/integrations/user-identity/github
227241
/docs/identity-providers/gitlab /docs/integrations/user-identity/gitlab
228242
/docs/identity-providers/gitlab.html /docs/integrations/user-identity/gitlab
229243
/docs/identity-providers/google /docs/integrations/user-identity/google
244+
/docs/identity-providers/okta /docs/integrations/user-identity/okta
245+
/docs/identity-providers/ping /docs/integrations/user-identity/ping
230246
/docs/integrations/apple /docs/integrations/user-identity/apple
231247
/docs/integrations/apple.html /docs/integrations/user-identity/apple
232248
/docs/integrations/auth0 /docs/integrations/user-identity/auth0
@@ -265,9 +281,13 @@ https://docs.pomerium.io/* https://docs.pomerium.com/:splat 301!
265281
/docs/integrations/vpn-providers.html /docs/integrations/request-context/vpn-providers
266282
/docs/integrations/zenefits /docs/integrations/user-standing/zenefits
267283
/docs/integrations/zenefits.html /docs/integrations/user-standing/zenefits
284+
/docs/internals/cryptography /docs/internals/security#cryptography
285+
/docs/k8s/configure /docs/deploy/k8s/configure
268286
/docs/k8s/helm.html /docs/deploy/k8s/install
269287
/docs/k8s/ingress.html /docs/deploy/k8s/ingress
288+
/docs/k8s/install /docs/deploy/k8s/install
270289
/docs/k8s/quickstart /docs/deploy/k8s/quickstart
290+
/docs/k8s/reference /docs/deploy/k8s/reference
271291
/docs/manage/clusters /docs/internals/clusters
272292
/docs/manage/clusters.html /docs/internals/clusters
273293
/docs/manage/custom-domains /docs/capabilities/custom-domains
@@ -276,20 +296,31 @@ https://docs.pomerium.io/* https://docs.pomerium.com/:splat 301!
276296
/docs/manage/mutual-auth.html /docs/internals/mutual-auth
277297
/docs/manage/troubleshooting /docs/internals/troubleshooting
278298
/docs/manage/troubleshooting.html /docs/internals/troubleshooting
299+
/docs/overview/upgrading /docs/deploy/upgrading
279300
/docs/reference/authenticate-internal-service-url /docs/reference/service-urls
301+
/docs/reference/authenticate-service-url /docs/reference/service-urls#authenticate-service-url
302+
/docs/reference/authorize-internal-service-url /docs/reference/service-urls#authenticate-internal-service-url
280303
/docs/reference/autocert/autocert-must-staple /docs/reference/autocert#autocert-must-staple
281304
/docs/reference/branding/logo-url /docs/reference/branding#logo-url
282305
/docs/reference/cookie-secure /docs/reference/cookies#cookie-secure
306+
/docs/reference/downstream-mtls /docs/reference/downstream-mtls-settings
283307
/docs/reference/forward-auth https://0-20-0.docs.pomerium.com/docs/reference/forward-auth 301!
308+
/docs/reference/grpc-address /docs/reference/grpc#grpc-address
309+
/docs/reference/grpc-insecure /docs/reference/grpc#grpc-insecure
284310
/docs/reference/metrics-basic-authentication /docs/deploy/enterprise/configure-metrics
285311
/docs/reference/reference.html /docs/reference
312+
/docs/reference/routes/kubernetes-service-account-token-file /docs/reference/routes/kubernetes-service-account-token
286313
/docs/releases/pomerium-cli /docs/deploy/clients
287314
/docs/topics/device-identity.html /docs/integrations/device-context/device-identity
315+
/docs/topics/kubernetes-auth.html /docs/capabilities/kubernetes-access
316+
/docs/topics/mutual-auth /docs/internals/mutual-auth
288317
/docs/topics/mutual-auth.html /docs/internals/mutual-auth
289318
/docs/topics/original-request-context /docs/capabilities/original-request-context
290319
/docs/topics/ppl /docs/internals/ppl
291320
/docs/topics/production-deployment.html /docs/deploy/upgrading
292321
/docs/topics/programmatic-access.html /docs/internals/programmatic-access
293322
/docs/zero/billing /docs/deploy/cloud/billing
323+
/docs/zero/billing /docs/deploy/cloud/billing
324+
/docs/zero/import /docs/deploy/cloud/import
294325
/docs/zero/import /docs/deploy/cloud/import
295326
/recipes/ad-guard /docs/guides/ad-guard

‎yarn.lock

+3-3
Original file line numberDiff line numberDiff line change
@@ -5242,9 +5242,9 @@ domhandler@^5.0.2, domhandler@^5.0.3:
52425242
domelementtype "^2.3.0"
52435243

52445244
dompurify@^3.0.6, dompurify@^3.2.1:
5245-
version "3.2.3"
5246-
resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.2.3.tgz#05dd2175225324daabfca6603055a09b2382a4cd"
5247-
integrity sha512-U1U5Hzc2MO0oW3DF+G9qYN0aT7atAou4AgI0XjWz061nyBPbdxkfdhfy5uMgGn6+oLFCfn44ZGbdDqCzVmlOWA==
5245+
version "3.2.4"
5246+
resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.2.4.tgz#af5a5a11407524431456cf18836c55d13441cd8e"
5247+
integrity sha512-ysFSFEDVduQpyhzAob/kkuJjf5zWkZD8/A9ywSp1byueyuCfHamrCBa14/Oc2iiB0e51B+NpxSl5gmzn+Ms/mg==
52485248
optionalDependencies:
52495249
"@types/trusted-types" "^2.0.7"
52505250

0 commit comments

Comments
 (0)