verify

README

Pomerium Verify service

This example service uses the Pomerium Go SDK to parse and display the contents of the X-Pomerium-Jwt-Assertion header. This can help to validate that a Pomerium deployment is working as expected.

This service is hosted at https://verify.pomerium.com, or you can deploy an instance in your own Pomerium setup.

Configuration options

The service can be configured with the following environment variables:

• ADDR

  Listen address for the service. If neither ADDR nor PORT is set, the service will listen at :8000.

• PORT

  Listen address port for the service. If neither ADDR nor PORT is set, the service will listen at :8000.

• JWKS_ENDPOINT

  Allows setting a static URL to use for fetching the public key(s) for verifying the Pomerium JWT. If unset, keys will be fetched from the domain specified in the JWT iss claim (using the internal Pomerium endpoint at /.well-known/pomerium/jwks.json). Note: in order for this to work correctly, you must define signing_key or signing_key_file in the Pomerium configuration.

• EXPECTED_JWT_ISSUER

  When set, JWT verification will additionally validate that the issuer claim (iss) matches the given value.

• EXPECTED_JWT_AUDIENCE

  When set, JWT verification will additionally validate that the audience claim (aud) matches the given value.

• GCLOUD_PROJECT

  When set to a Firebase project ID, the service will use Cloud Firestore as a storage backend for WebAuthn-related storage. (By default, the service will store this data in memory instead.)

Documentation

Index

• Variables
• type Option
  • func WithBindAddress(bindAddress string) Option
  • func WithExpectedJWTAudience(audience string) Option
  • func WithExpectedJWTIssuer(issuer string) Option
  • func WithExtraCACerts(paths ...string) Option
  • func WithFirestoreProjectID(projectID string) Option
  • func WithJWKSEndpoint(jwksEndpoint string) Option
• type Server
  • func New(options ...Option) *Server
  • func (srv *Server) Run(ctx context.Context) error

Variables

var (
	DefaultBindAddress  = ":8000"
	DefaultJWKSEndpoint = "" // use the audience
	DefaultProjectID    = firestore.DetectProjectID
)

config defaults

Types

type Option

type Option func(cfg *config)

An Option customizes the config.

func WithBindAddress

func WithBindAddress(bindAddress string) Option

WithBindAddress sets the bind address in the config.

func WithExpectedJWTAudience

func WithExpectedJWTAudience(audience string) Option

WithExpectedJWTAudience sets the expected JWT audience claim in the config. If set to the empty string, the audience claim will not be validated.

func WithExpectedJWTIssuer

func WithExpectedJWTIssuer(issuer string) Option

WithExpectedJWTIssuer sets the expected JWT issuer claim in the config. If set to the empty string, the issuer claim will not be validated.

func WithExtraCACerts

func WithExtraCACerts(paths ...string) Option

WithExtraCACerts adds paths to custom CA certificates to the config. Certificates added with this option will be used in addition to the system default pool.

func WithFirestoreProjectID

func WithFirestoreProjectID(projectID string) Option

WithFirestoreProjectID sets the firestore project id in the config.

func WithJWKSEndpoint

func WithJWKSEndpoint(jwksEndpoint string) Option

WithJWKSEndpoint sets the jwks endpoint in the config.

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server is the verify server backend.

func New

func New(options ...Option) *Server

New creates a new Server.

func (*Server) Run

func (srv *Server) Run(ctx context.Context) error

Run runs the server.