pomerium/pomerium

Features

• Identity-Aware Proxies - Intercepts incoming network requests to validate user identity and device context against centralized policies before forwarding traffic.
• Zero Trust Access - Provides a zero-trust access gateway that replaces traditional VPNs with identity-based authentication for internal infrastructure.
• HTTP Tunnels - Encapsulates non-HTTP traffic like TCP and UDP within secure HTTP tunnels for identity-verified access.
• Service Proxying - Routes requests from external clients to internal services while enforcing identity-based access policies.
• Group-Based Access Controls - Enforces access policies based on group membership claims retrieved from identity providers.
• Context-Aware Access Control - Evaluates requests against user identity, group membership, and device status to determine access permissions.
• External Identity Provider Integration - Delegates user authentication to an external identity provider to verify identities and manage sessions before granting access.
• User Identity Verification - Verifies user credentials against existing identity providers before granting access to protected internal services.
• Identity-Based SSH Access - Secures remote server access by authenticating users via identity providers and replacing static SSH keys with ephemeral certificates.
• Identity Provider Integrations - Standardizes communication with external authentication services to verify user credentials and synchronize directory metadata.
• Reverse Proxies - Functions as a reverse proxy that verifies user identity and device context for every request before granting access to internal services.
• OIDC Identity Integrations - Delegates user sign-in and session management to OpenID Connect compatible identity providers.
• Identity-Aware Proxy Gateways - Acts as an identity-aware gateway that integrates with OIDC and OAuth2 providers to enforce granular access policies for backend applications.
• Single Sign-On - Passes signed identity tokens to downstream applications to enable authentication without repeated login prompts.
• Policy Evaluation Engines - Evaluates incoming requests against version-controlled rules to determine access permissions based on user identity and context.
• Model Context Protocol Gateways - Governs and audits tool execution by AI agents through a secure gateway that enforces identity-based policies for every interaction.
• Session Persistence - Connects the identity and session management service to an external storage system to maintain state across service restarts.
• Request Path Rewriters - Modifies paths of incoming requests before forwarding to match internal routing structures.
• Kubernetes API Providers - Provides identity-aware access to Kubernetes API servers using external providers and centralized policies.
• Dynamic Configuration Updates - Reloads route details, authorization policies, and certificates without requiring service restarts.
• Distributed Access Clusters - Deploys and scales local proxy instances connected to a centralized control plane for unified policy distribution.
• High Availability Infrastructure - Distributes stateless service replicas across different zones to prevent single points of failure.
• Identity-Aware Ingress Controllers - Protects cluster resources and API servers by translating native ingress resources into identity-aware routing and access control policies.
• Cluster Access Control - Authenticates users to Kubernetes clusters by passing identity tokens for fine-grained access control.
• Kubernetes Ingress Route Provisioners - Creates network routes from cluster ingress resources while applying security policies via metadata annotations.
• Load Balancing Strategies - Distributes incoming requests across multiple backend endpoints using defined load balancing policies.
• TCP and UDP Encapsulation - Wraps non-HTTP traffic in secure tunnels to provide identity-verified access to databases and other raw socket services.
• Infrastructure-Agnostic Proxy Deployments - Scales and hosts access gateways across any environment to maintain control over network architecture.
• Authenticated Routings - Defines server and client routes secured with upstream authentication.
• Upstream TLS Origination - Establishes mutual TLS authentication between the proxy and upstream servers to secure backend communication.
• Automated TLS Reverse Proxies - Manages the acquisition and renewal of SSL certificates for proxied domains to ensure secure encrypted connections.
• HTTP Request Redirections - Swaps schemes, hosts, ports, or paths of incoming requests to route users to new locations.
• Traffic Routing - Matches incoming request paths using regular expressions to direct traffic to backend services.
• Direct Token Validation - Accepts and validates existing identity provider tokens to grant access without requiring browser-based login redirects.
• Tool Access Controls - Enforces granular access policies on specific tool calls to restrict sensitive function invocation.
• AI Agent Security - Enforces per-request security policies and logging for traffic generated by autonomous AI agents.
• LLM Access Delegations - Issues external bearer tokens that authorize language models to call backend servers on behalf of a user.
• Headless Agent Authentications - Issues long-lived credentials to automated pipelines for non-interactive authentication without browser logins.
• Ephemeral Certificate Issuance - Generates short-lived credentials for secure protocols like SSH to replace static keys and eliminate long-term exposure risks.
• Authorization Decision Audit Trails - Logs the reasoning behind every accepted or denied request to provide transparent compliance trails.
• TLS Certificate Management - Integrates with certificate authorities to automatically provision and renew TLS certificates for exposed services.
• SSH Access Control Lists - Validates SSH connection requests against user identity, usernames, and public key signatures.
• Custom Authorization Logic - Implements complex, specialized authorization requirements using programmable policy languages.
• Service Account Authenticators - Uses manual service account credentials to support specific authorization header formats for serverless authentication.
• Microsoft Entra ID Authentications - Verifies user identities through Microsoft Entra ID before granting access to protected services.
• Identity Propagation - Injects cryptographically signed identity assertions into request headers to enable downstream services to verify user claims.
• Google Account Authentications - Verifies user identities through Google identity services to manage access to protected internal resources.
• Kubernetes Identity Integration - Maps external user identities and group memberships to native cluster role-based access controls.
• Machine Identity Authentication - Enables secure, identity-aware authentication for automated services by issuing tokens that verify requests between internal applications.
• Upstream Token Bridging - Acquires and refreshes access tokens for third-party services and injects them into proxied requests.
• OAuth Token Management - Handles OAuth flows and token refreshes to provide internal tokens for upstream services.
• Access Policy Automation - Integrates access control management into deployment pipelines to treat security policies as version-controlled code.
• Policy Chains - Attaches multiple independent authorization rules to single routes to create layered access requirements.
• TLS Client Certificate Registrations - Validates TLS client certificates using fingerprints or public key hashes to verify device identity.
• Clientless Access - Routes traffic to internal web applications via browsers without requiring third-party client software.
• Explicit Deny Rules - Overrides allow conditions by defining specific criteria that automatically block access regardless of other permissions.
• SSH - Authenticates SSH traffic via identity providers and enforces access policies without requiring a VPN.
• Identity Forwarding - Injects cryptographically signed identity tokens into request headers for downstream verification.
• Identity Header Injections - Injects authenticated user identity information into request headers as tokens so downstream services can identify the user.
• Service Overload Protections - Degrades service quality using progressive timeouts and connection limits to stop system crashes during high load.
• Path Prefix Matching - Restricts route matching to requests that begin with specific path prefixes.
• Infrastructure Tools - Identity-aware access proxy.
• Networking And Proxies - Identity-aware reverse proxy.
• Authentication Services - Identity-aware access proxy for securing internal services.
• Identity Management - Identity-aware access proxy for secure service access.
• Identity Tools - Identity-aware access proxy for secure application access.
• Security and Compliance - Zero-trust access gateway.
• Security And Privacy - Identity-aware access proxy documentation and configuration.
• Zero Trust Networking - Enables secure, identity-aware access to internal applications.

Star history