Identity Providers (per route)

Summary

Identity Providers (per route) narrows which of the globally-declared identity_providers are accepted on this route. It is an allowlist of provider names.

This setting is only meaningful on a route whose effective bearer token format is jwt. When left unset, the route accepts a token from any configured provider. When set, a token whose provider is not on the list is rejected before its signature is checked.

Every name must exist in the global identity_providers map. Setting this on a route that does not use the jwt format is a configuration error, and Pomerium refuses to start.

See Machine-to-Machine Access with Bearer Tokens for an overview and examples.

How to configure

Core

YAML/JSON setting	Type	Usage
identity_providers	array of string	optional

Examples

routes:
  - from: https://api.localhost.pomerium.io
    to: http://api-backend
    bearer_token_format: jwt
    identity_providers:
      - kubernetes
    policy:
      - allow:
          and:
            - claim/sub: system:serviceaccount:default:pom-tester

Kubernetes

Annotation name	Type	Usage
identity_providers	comma-separated string	optional

ingress.pomerium.io/bearer_token_format: jwt
ingress.pomerium.io/identity_providers: kubernetes