Pomerium by Pomerium is an open-source context-aware reverse proxy designed to provide secure, clientless connections to internal web applications and services without the need for a corporate VPN. It operates on a zero trust model, ensuring that every action is continuously verified against identity, policy, and context. Pomerium integrates institutional context into policy for access control decisions, making it suitable for organizations that require sensitive data to remain under their control. It supports both HTTP and TCP connections, applying access policies across these connections. Pomerium's architecture consists of four logical components: Proxy service, Authentication service, Authorization service, and Databroker service. The Proxy service handles requests from clients and routes them between clients, upstream services, and other Pomerium components. The Authentication service verifies user identity with an Identity Provider (IdP) and establishes user sessions using OAuth 2.0 and OIDC protocols. The Authorization service processes policies to determine client permissions, and the Databroker service persists session and identity-related data. Pomerium ensures data confidentiality, integrity, and availability by encrypting all communication and providing mutual authentication when certificates are used. It is designed to be fault-tolerant and horizontally scalable, inheriting Envoy's availability threat model. Pomerium can be deployed at the edge, eliminating latency and bandwidth issues associated with backhauling data through intermediary servers. It provides detailed audit logs for continuous verification and context-aware access, enhancing security and compliance.
