diff --git a/content/docs/capabilities/img/kubernetes/kubernetes-integration.svg b/content/docs/capabilities/img/kubernetes/kubernetes-integration.svg index 3dfad2220..d80842a95 100644 --- a/content/docs/capabilities/img/kubernetes/kubernetes-integration.svg +++ b/content/docs/capabilities/img/kubernetes/kubernetes-integration.svg @@ -1 +1,3 @@ -

user@domain.com

user@dom...
exec
exec
request with pomerium
session token
request with pomerium...
kubectl
kubectl
retrieve user
session token
retrieve user...
pomerium-cli
pomerium-cli
impersonate
user@domain.com
impersonate...
pomerium
service
account
pomerium...
API
Server
API...
user
impersonation
role
user...
user@domain.com
user@doma...
user role
user role
Viewer does not support full SVG 1.1
\ No newline at end of file + + +

user@domain.com

user@dom...
exec
exec
request with pomerium
session token
request with pomerium...
kubectl
kubectl
retrieve user
session token
retrieve user...
pomerium-cli
pomerium-cli
impersonate
user@domain.com
impersonate...
pomerium
service
account
pomerium...
API
Server
API...
user
impersonation
role
user...
user@domain.com
user@doma...
user role
user role
Viewer does not support full SVG 1.1
\ No newline at end of file diff --git a/content/docs/internals/img/architecture/pomerium-auth-flow-stateless-auth.svg b/content/docs/internals/img/architecture/pomerium-auth-flow-stateless-auth.svg index d526a4b79..dda43783e 100644 --- a/content/docs/internals/img/architecture/pomerium-auth-flow-stateless-auth.svg +++ b/content/docs/internals/img/architecture/pomerium-auth-flow-stateless-auth.svg @@ -1 +1,4 @@ -
Proxy
Proxy
Authenticate
Authenticate
Authorize
Authorize
Identity
Provider
Identity...
redirect with session token
redirect with session token
Secured Application
Secured A...
request
request
redirect to IdP sign-in
redirect to IdP sign-in
check authorization
check authoriz...
unauthorized
unauthorized
redirect for session cookie
redirect for session cookie
redirect with authorization code
redirect with authorization code
exchange code for tokens
exchange code...
return id/access tokens
return id/access tokens
session syncronized
session syncronized
set session cookie
set session cookie
check authorization
check authorization
authorized
authorized
proxied request
proxied request
Databroker
Databroker
Databroker
Databroker
store session and tokens
store session and tokens
Text is not SVG - cannot display
\ No newline at end of file + + + +
Proxy
Proxy
Authenticate
Authenticate
Authorize
Authorize
Identity
Provider
Identity...
redirect with session token
redirect with session token
Secured Application
Secured A...
request
request
redirect to IdP sign-in
redirect to IdP sign-in
check authorization
check authoriz...
unauthorized
unauthorized
redirect for session cookie
redirect for session cookie
redirect with authorization code
redirect with authorization code
exchange code for tokens
exchange code...
return id/access tokens
return id/access tokens
session syncronized
session syncronized
set session cookie
set session cookie
check authorization
check authorization
authorized
authorized
proxied request
proxied request
Databroker
Databroker
Databroker
Databroker
store session and tokens
store session and tokens
Text is not SVG - cannot display
\ No newline at end of file diff --git a/content/docs/internals/img/architecture/pomerium-auth-flow.svg b/content/docs/internals/img/architecture/pomerium-auth-flow.svg index 752669942..d49d5758e 100644 --- a/content/docs/internals/img/architecture/pomerium-auth-flow.svg +++ b/content/docs/internals/img/architecture/pomerium-auth-flow.svg @@ -1 +1,3 @@ -
Proxy
Proxy
Authenticate
Authenticate
Authorize
Authorize
Identity
Provider
Identity...
Secured Application
Secured A...
request
request
redirect to IdP sign-in
redirect to IdP sign-in
check authorization
check authoriz...
unauthorized
unauthorized
redirect for session cookie
redirect for session cookie
redirect with authorization code
redirect with authorization code
exchange code for tokens
exchange code...
return id/access tokens
return id/access tokens
store session and tokens
store session...
session syncronized
session syncronized
redirect with session token
redirect with session token
set session cookie
set session cookie
check authorization
check authorization
authorized
authorized
proxied request
proxied request
Databroker
Cache
Viewer does not support full SVG 1.1
\ No newline at end of file + + +
Proxy
Proxy
Authenticate
Authenticate
Authorize
Authorize
Identity
Provider
Identity...
Secured Application
Secured A...
request
request
redirect to IdP sign-in
redirect to IdP sign-in
check authorization
check authoriz...
unauthorized
unauthorized
redirect for session cookie
redirect for session cookie
redirect with authorization code
redirect with authorization code
exchange code for tokens
exchange code...
return id/access tokens
return id/access tokens
store session and tokens
store session...
session syncronized
session syncronized
redirect with session token
redirect with session token
set session cookie
set session cookie
check authorization
check authorization
authorized
authorized
proxied request
proxied request
Databroker
Cache
Viewer does not support full SVG 1.1
\ No newline at end of file diff --git a/content/docs/internals/img/architecture/pomerium-container-context-stateless-authn.svg b/content/docs/internals/img/architecture/pomerium-container-context-stateless-authn.svg index f3c12929e..2f8768828 100644 --- a/content/docs/internals/img/architecture/pomerium-container-context-stateless-authn.svg +++ b/content/docs/internals/img/architecture/pomerium-container-context-stateless-authn.svg @@ -1 +1,4 @@ -
Identity
Provider
Identity...
Request
Req...
Session / Identity
Data Sync
Session / Identity...
Authorize
Authorize
Identify
User
Identify...
Check
Authorization
Check...
Authorized
Request
Authorized...
Proxy
Proxy
Session / Identity
Refresh
Session / Identity...
Databroker
Databroker
Establish
Identity
Establish...
Authenticate
Authenticate
Secured
Application
Secured...
Secured
Application
Secured...
Secured
Application
Secured...
Stores Session
Stores Sess...
Text is not SVG - cannot display
\ No newline at end of file + + + +
Identity
Provider
Identity...
Request
Req...
Session / Identity
Data Sync
Session / Identity...
Authorize
Authorize
Identify
User
Identify...
Check
Authorization
Check...
Authorized
Request
Authorized...
Proxy
Proxy
Session / Identity
Refresh
Session / Identity...
Databroker
Databroker
Establish
Identity
Establish...
Authenticate
Authenticate
Secured
Application
Secured...
Secured
Application
Secured...
Secured
Application
Secured...
Stores Session
Stores Sess...
Text is not SVG - cannot display
\ No newline at end of file diff --git a/content/docs/internals/img/architecture/pomerium-container-context.svg b/content/docs/internals/img/architecture/pomerium-container-context.svg index 079104690..53c8edf34 100644 --- a/content/docs/internals/img/architecture/pomerium-container-context.svg +++ b/content/docs/internals/img/architecture/pomerium-container-context.svg @@ -1 +1,3 @@ -
Identity
Provider
Identity...
Request
Req...
Session / Identity
Data Sync
Session / Identity...
Authorize
Authorize
Identify
User
Identify...
Check
Authorization
Check...
Authorized
Request
Authorized...
Proxy
Proxy
Session / Identity
Refresh
Session / Identity...
Databroker
Databroker
Establish
Identity
Establish...
Store
Session
Store...
Authenticate
Authenticate
Secured
Application
Secured...
Secured
Application
Secured...
Secured
Application
Secured...
Viewer does not support full SVG 1.1
\ No newline at end of file + + +
Identity
Provider
Identity...
Request
Req...
Session / Identity
Data Sync
Session / Identity...
Authorize
Authorize
Identify
User
Identify...
Check
Authorization
Check...
Authorized
Request
Authorized...
Proxy
Proxy
Session / Identity
Refresh
Session / Identity...
Databroker
Databroker
Establish
Identity
Establish...
Store
Session
Store...
Authenticate
Authenticate
Secured
Application
Secured...
Secured
Application
Secured...
Secured
Application
Secured...
Viewer does not support full SVG 1.1
\ No newline at end of file diff --git a/content/docs/internals/img/architecture/pomerium-request-flow.svg b/content/docs/internals/img/architecture/pomerium-request-flow.svg index ae75d315d..464e03133 100644 --- a/content/docs/internals/img/architecture/pomerium-request-flow.svg +++ b/content/docs/internals/img/architecture/pomerium-request-flow.svg @@ -1 +1,478 @@ -ProxyserviceAuthenticateserviceAuthorizationserviceDatabrokerserviceIdentity ProviderSecured ApplicationClient requestCheck Authorizationfor session cookieNo session? Redirect toAuthenticateVerify identity / getsession cookieRedirect to IdPand sign inRedirect withauthorization codeExchange code forOAuth tokensReturn OAuth/IDtokensAuthenticate serviceretrieves sessiondata from the IdP:- ID token (JWT)- Device credentials- User ID- OIDC claims, etc.Redirect session dataStore session locallyCheck AuthorizationClient request authorizedStore session andtokensQuery DB forsession dataRedirect request to secured application \ No newline at end of file + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Pr + o + xy + + service + + + + + + + + + + + + Authenticate + + service + + + + + + + + + + + + Authorization + + service + + + + + + + + + + + + Databr + ok + er + + service + Identity Pr + o + vider + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Secur + ed Application + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Client r + equest + + + + + + + + + + + Check Authorization + for session cookie + + + No session? Redir + ect to + Authenticate + + + + + + + + V + erify identity / get + session cookie + + + + + + + + + + Redir + ect to IdP + and sign in + + + Redir + ect with + authorization code + + + Ex + change code for + O + Auth tok + ens + + + Return O + Auth/ID + tok + ens + + + + + + + Authenticate service + r + etrie + ves session + data fr + om the IdP: + - ID tok + en ( + JWT) + - De + vice cr + edentials + - User ID + - OIDC claims, etc. + + + Redir + ect session data + Stor + e session locally + + + + + + + + + Check Authorization + + + + Client r + equest authorized + + + Stor + e session and + tok + ens + + + Query DB for + session data + + + + + + + + + + Redir + ect r + equest to secur + ed application + + + + + + \ No newline at end of file diff --git a/content/docs/internals/img/architecture/pomerium-system-context.svg b/content/docs/internals/img/architecture/pomerium-system-context.svg index 2302bcd5c..f8e94e16d 100644 --- a/content/docs/internals/img/architecture/pomerium-system-context.svg +++ b/content/docs/internals/img/architecture/pomerium-system-context.svg @@ -1 +1,3 @@ -
Identify User
Identify User
Identity
Provider
Identity...
On-Prem Users
On-Prem Users
Remote Users
Remote Us...
Authorized
Authorized
Secured
Application
Secured...
Secured
Application
Secured...
Secured
Application
Secured...
Viewer does not support full SVG 1.1
\ No newline at end of file + + +
Identify User
Identify User
Identity
Provider
Identity...
On-Prem Users
On-Prem Users
Remote Users
Remote Us...
Authorized
Authorized
Secured
Application
Secured...
Secured
Application
Secured...
Secured
Application
Secured...
Viewer does not support full SVG 1.1
\ No newline at end of file