Pomerium

Pomerium is a zero trust access proxy that sits between users and internal applications. It verifies identity and permission before allowing access to any resource. The tool works by connecting to your existing identity provider like Google, Okta, Azure, or others.

When someone tries to access an application, Pomerium checks their identity, device status, and other factors against your security rules. Only if everything matches will it grant access. This happens in real time for every request, not just once during login.

Pomerium is open source and can be self-hosted, meaning your data stays under your control. It offers both free and paid versions, with the paid options adding team features and support for larger organizations.

Getting started with Pomerium is straightforward. Here are the steps:

• Install Pomerium: Download and install Pomerium on your server or use their hosted control plane option. You can deploy it using Docker, Kubernetes, or directly on a virtual machine.

• Connect your identity provider: Link Pomerium to your existing login system such as Google Workspace, Okta, Azure Active Directory, or GitHub. This lets users sign in with their normal work credentials.

• Set up routes and policies: Define which applications Pomerium should protect and create rules about who can access them. You can base rules on email, group membership, device type, time of day, and more.

• Test access: Try accessing a protected application through your browser. Pomerium will redirect you to sign in through your identity provider, then grant or deny access based on your policies.

• Monitor and adjust: Review access logs and update policies as your security needs change.

• Zero trust architecture with continuous verification

• VPN replacement with clientless browser access

• Support for Google, Okta, Azure, GitHub, and more identity providers

• Self-hosted proxy keeps data private

• Kubernetes native integration and API security

• Context-aware policies using identity, device, and location

• Real-time access decisions for every request

• Open source with active community

• JWT-based authentication and authorization

• Single sign-on across applications