Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bearer-token-format: add az example, document enterprise options #1796

Merged
merged 1 commit into from
Mar 6, 2025
Merged

bearer-token-format: add az example, document enterprise options #1796

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 19 additions & 3 deletions content/docs/reference/bearer-token-format.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,11 +63,19 @@ bearer_token_format: idp_access_token
BEARER_TOKEN_FORMAT=idp_access_token
```

#### Microsoft Entra

The `az` CLI can be used to get an access-token:

```bash
curl -H "Authorization: $(az account get-access-token --query accessToken --output tsv)" https://example.localhost.pomerium.io
```

### Options

- `default`
- `idp_access_token`
- `idp_identity_token`
- `default`: Pass bearer tokens to upstream applications without interpreting them.
- `idp_access_token`: The bearer token will be interpreted as an IdP-issued access token.
- `idp_identity_token`: The bearer token will be interpreted as an IdP-issued identity token.

</TabItem>
<TabItem value="Enterprise" label="Enterprise">
Expand All @@ -76,6 +84,14 @@ Set **Bearer Token Format** under **Proxy** settings in the Console:

![Set bearer token format in the Console](./img/global-settings/bearer-token-format.png)

### Options

- _Unset_: At the route level, use the global setting. At the global level, use "Default".
- "Unknown": Same as "Default".
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like we shouldn't have this value available in the UI, but I suppose this isn't the only place we have this, so let's leave it and document it for now and discuss how we can address these Unknowns where they exist.

- "Default": Pass bearer tokens to upstream applications without interpreting them.
- "IDP Access Token": The bearer token will be interpreted as an IdP-issued access token.
- "IDP Identity Token": The bearer token will be interpreted as an IdP-issued identity token.

</TabItem>
<TabItem value="Kubernetes" label="Kubernetes">

Expand Down
Loading