README
¶
Pomerium Verify service
This example service uses the Pomerium
Go SDK to parse and display the contents
of the X-Pomerium-Jwt-Assertion header. This can help to validate that a
Pomerium deployment is working as expected.
This service is hosted at https://verify.pomerium.com, or you can deploy an instance in your own Pomerium setup.
Configuration options
The service can be configured with the following environment variables:
-
ADDRListen address for the service. If neither
ADDRnorPORTis set, the service will listen at:8000. -
PORTListen address port for the service. If neither
ADDRnorPORTis set, the service will listen at:8000. -
JWKS_ENDPOINTAllows setting a static URL to use for fetching the public key(s) for verifying the Pomerium JWT. If unset, keys will be fetched from the domain specified in the JWT
audclaim (using the internal Pomerium endpoint at/.well-known/pomerium/jwks.json). Note: in order for this to work correctly, you must definesigning_keyorsigning_key_filein the Pomerium configuration. -
EXPECTED_JWT_ISSUERWhen set, JWT verification will additionally validate that the issuer claim (
iss) matches the given value. -
EXPECTED_JWT_AUDIENCEWhen set, JWT verification will additionally validate that the audience claim (
aud) matches the given value. -
GCLOUD_PROJECTWhen set to a Firebase project ID, the service will use Cloud Firestore as a storage backend for WebAuthn-related storage. (By default, the service will store this data in memory instead.)
Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( DefaultBindAddress = ":8000" DefaultJWKSEndpoint = "" // use the audience DefaultProjectID = firestore.DetectProjectID )
config defaults
Functions ¶
This section is empty.
Types ¶
type Option ¶
type Option func(cfg *config)
An Option customizes the config.
func WithBindAddress ¶
WithBindAddress sets the bind address in the config.
func WithExpectedJWTAudience ¶
WithExpectedJWTAudience sets the expected JWT audience claim in the config. If set to the empty string, the audience claim will not be validated.
func WithExpectedJWTIssuer ¶
WithExpectedJWTIssuer sets the expected JWT issuer claim in the config. If set to the empty string, the issuer claim will not be validated.
func WithFirestoreProjectID ¶
WithFirestoreProjectID sets the firestore project id in the config.
func WithJWKSEndpoint ¶
WithJWKSEndpoint sets the jwks endpoint in the config.
Source Files
Directories