Skip to main content

Navigate Pomerium's website

Pomerium Integrations

Connect Pomerium to identity, context, services, and deployment tools.

Browse integrations

Identity sources

  • Auth0

    Use Auth0 as Pomerium's OpenID Connect identity provider, then apply authenticated identity and selected claims to private application policy.

  • Azure Active Directory is now Microsoft Entra ID

    Azure Active Directory is now Microsoft Entra ID. Use the current Pomerium integration guide while keeping azure as the provider configuration key.

  • GitHub

    Use GitHub as an OAuth 2.0 identity provider for Pomerium-protected applications with a registered callback, client ID, and client secret.

  • GitLab

    Use GitLab.com or GitLab Self-Managed as the identity provider for Pomerium-protected applications through OAuth and OpenID Connect.

  • Google Workspace

    Use Google Workspace accounts as the Google identity provider for Pomerium-protected applications, with optional Enterprise directory sync for groups.

  • Okta

    Use Okta as Pomerium's OpenID Connect identity provider, apply user and group claims to route policy, and add Enterprise directory sync when needed.

  • OneLogin

    Use OneLogin as Pomerium's OpenID Connect identity provider to authenticate users and apply their identity to route policy.

  • OpenID Connect

    Connect a compatible OpenID Connect provider to Pomerium with discovery, authorization-code sign-in, identity claims, and route policy.

  • PingOne for Workforce

    Use PingOne for Workforce as Pomerium's OpenID Connect identity provider and apply Ping identity or group data to access policy.

  • Amazon Cognito

    Use an Amazon Cognito User Pool as the identity provider for Pomerium through OpenID Connect.

  • authentik

    Use authentik as the identity provider for Pomerium through OpenID Connect.

  • Dex

    Use Dex as the identity provider for Pomerium through OpenID Connect.

  • Duo Single Sign-On

    Use Duo Single Sign-On as the identity provider for Pomerium through OpenID Connect.

  • IBM Verify

    Use IBM Verify as the identity provider for Pomerium through OpenID Connect.

  • Idira IAM

    Use Idira IAM, formerly CyberArk Workforce Identity, as the identity provider for Pomerium through OpenID Connect.

  • JumpCloud

    Use JumpCloud as the identity provider for Pomerium through OpenID Connect.

  • Keycloak

    Use Keycloak as the identity provider for Pomerium through OpenID Connect.

  • Microsoft Entra ID

    Use Microsoft Entra ID as the identity provider for Pomerium through OpenID Connect.

  • Ory Hydra

    Use Ory Hydra as the identity provider for Pomerium through OpenID Connect.

  • PingAM

    Use PingAM, formerly ForgeRock Access Management, as the identity provider for Pomerium through OpenID Connect.

  • ZITADEL

    Use ZITADEL as the identity provider for Pomerium through OpenID Connect.

Context sources

  • Fleet (FleetDM)

    Use the Pomerium Enterprise FleetDM plugin to evaluate Fleet device policy and vulnerability data during access decisions.

  • TriNet HR Platform

    Use TriNet HR Platform workforce records in Pomerium Enterprise policy to check employment status and worker type before access.

  • Tor Exit Nodes

    Use Tor exit relay IP data in Pomerium Enterprise policy to identify or restrict requests from known Tor exits.

  • BambooHR

    Import selected BambooHR workforce fields into Pomerium Enterprise policy with the example external data source and user email matching.

  • CrowdStrike Falcon

    Use selected CrowdStrike Falcon data in Pomerium policy through a custom external data source.

  • IP geolocation data

    Use selected IP geolocation records in Pomerium policy with the documented GeoIP data-source pattern.

  • Iru Endpoint, formerly Kandji

    Use selected Iru Endpoint Management device data in Pomerium policy through a custom external data source.

  • Jamf Pro

    Use selected Jamf Pro device data in Pomerium policy through a custom external data source.

  • Kolide by 1Password

    Use selected Kolide inventory records in Pomerium policy through a customer-owned external data source.

  • Microsoft Intune

    Use selected Microsoft Intune device data in Pomerium policy through a custom external data source.

  • Rippling

    Use selected Rippling workforce data in Pomerium policy through a custom external data source.

  • ServiceNow CMDB

    Use selected ServiceNow CMDB records in Pomerium policy through a custom external data source.

  • Singularity Endpoint

    Use selected SentinelOne Singularity Endpoint records in Pomerium policy through a customer-owned external data source.

  • Snipe-IT

    Use selected Snipe-IT asset data in Pomerium policy through a custom external data source.

  • Tanium Platform

    Use selected Tanium Platform records in Pomerium policy through a customer-owned external data source.

  • Workday Human Capital Management

    Use selected Workday HCM workforce records in Pomerium policy through a customer-owned external data source.

Protected services

  • code-server

    Protect a self-hosted code-server browser IDE with Pomerium authentication and route policy, with WebSocket support and the correct public host.

  • Cockpit

    Put the Cockpit Linux administration interface behind Pomerium so users pass identity-aware route policy before Cockpit host login.

  • GitLab Self-Managed

    Put GitLab Self-Managed behind a Pomerium HTTPS route so users pass identity-aware policy before GitLab login.

  • Argo Workflows

    Put the Argo Workflows UI and API behind Pomerium so users pass identity-aware route policy before traffic reaches Argo Server.

  • Grafana

    Protect self-hosted Grafana dashboards with Pomerium route policy and SSO, then pass a signed identity JWT for seamless Grafana login.

  • Cloud Run

    Protect a private Google Cloud Run service with a Pomerium route, identity-aware policy, and Google-signed serverless authentication.

  • Apache Airflow

    Protect access to Apache Airflow workflows and administration as an upstream web application.

  • Apache Superset

    Protect access to Apache Superset dashboards and data exploration as an upstream web application.

  • Backstage

    Protect access to Backstage developer portals and software catalogs as an upstream web application.

  • CircleCI Server

    Protect access to self-hosted CircleCI Server web and API services.

  • ClickHouse

    Protect ClickHouse HTTP endpoints and native database connections with separate Pomerium routes.

  • Confluence Data Center

    Protect access to self-managed Confluence Data Center workspaces as an upstream web application.

  • Elasticsearch

    Protect the Elasticsearch HTTP API while keeping cluster transport traffic on the private network.

  • Gitea

    Protect the Gitea web application and Git Smart HTTP traffic, with a separate route for Git over SSH when required.

  • GitHub Enterprise Server

    Protect GitHub Enterprise Server web and API access, with a separate route for Git over SSH when required.

  • Grafana Loki

    Protect access to Grafana Loki HTTP endpoints as upstream web applications.

  • HashiCorp Consul

    Protect the HashiCorp Consul user interface and HTTP API, with separate DNS routes when required.

  • HashiCorp Nomad

    Protect access to the HashiCorp Nomad user interface and HTTP API as upstream applications.

  • HashiCorp Vault

    Protect access to the HashiCorp Vault user interface and HTTP API as upstream applications.

  • Internal admin panels

    Protect access to internal administration panels as upstream web applications.

  • Internal APIs

    Protect access to internal HTTP APIs with identity-aware Pomerium routes.

  • Jenkins

    Protect the Jenkins web application and API, with separate WebSocket or TCP access for build agents when required.

  • Jira Data Center

    Protect access to self-managed Jira Data Center workspaces as an upstream web application.

  • JupyterHub

    Protect access to JupyterHub notebook environments as an upstream web application.

  • Kibana

    Protect access to Kibana dashboards and administration as an upstream web application.

  • Kubernetes Dashboard (archived)

    Review the retired Kubernetes Dashboard access pattern and the project recommendation to use Headlamp.

  • Mattermost

    Protect access to self-hosted Mattermost workspaces as an upstream web application.

  • Metabase

    Protect access to Metabase analytics and administration as an upstream web application.

  • MinIO AIStor Console

    Protect access to the current MinIO AIStor Console as an upstream web application.

  • MongoDB

    Protect access to MongoDB services through Pomerium TCP routes.

  • MySQL

    Protect access to MySQL services through Pomerium TCP routes.

  • NocoDB

    Protect access to self-hosted NocoDB workspaces as an upstream web application.

  • OpenSearch Dashboards

    Protect access to OpenSearch Dashboards as an upstream web application.

  • pgAdmin 4

    Protect access to pgAdmin 4 when it runs in server mode as an upstream web application.

  • Portainer

    Protect access to Portainer container administration as an upstream web application.

  • PostgreSQL

    Protect access to PostgreSQL services through Pomerium TCP routes.

  • Prometheus

    Protect access to Prometheus metrics and administration as an upstream web application.

  • Proxmox VE

    Protect access to the Proxmox VE management interface as an upstream web application.

  • RabbitMQ

    Protect the RabbitMQ management interface and message protocols with separate HTTP and TCP routes.

  • Redis

    Protect access to Redis services through Pomerium TCP routes.

  • Rundeck

    Protect access to Rundeck operations and automation as an upstream web application.

  • Self-Hosted Sentry

    Protect the interactive Self-Hosted Sentry application without blocking SDK or Relay ingestion.

  • SonarQube Server

    Protect access to SonarQube Server while keeping scanners, webhooks, and automation on compatible noninteractive paths.

  • Spinnaker

    Protect access to Spinnaker deployment services as upstream web applications.

  • SUSE Rancher Manager

    Protect access to SUSE Rancher Manager cluster administration as an upstream web application.

  • Temporal Web UI

    Protect access to Temporal Web UI as an upstream web application without claiming to proxy worker and SDK gRPC traffic.

  • Traefik Proxy API and Dashboard

    Protect the Traefik Proxy API and dashboard internal service as an upstream web application.

  • VMware vCenter Server

    Protect the VMware vCenter Server web interface and API without claiming to cover every vSphere service.

Access patterns

  • DBeaver

    Connect DBeaver to protected database services through Pomerium TCP routes.

  • Domain Name System (DNS)

    Protect access to private DNS services through separate Pomerium UDP and TCP routes.

  • Remote Desktop Protocol (RDP)

    Protect Remote Desktop access through separate Pomerium TCP and UDP routes when both transports are required.

  • Secure Shell

    Protect SSH access with Pomerium native SSH or TCP routes.

  • TCP services

    Protect access to private TCP services through Pomerium routes.

  • UDP services

    Protect access to private UDP services through Pomerium CONNECT-UDP routes.

Deployment integrations

  • cert-manager

    Use cert-manager to issue and renew TLS certificates for services exposed through the Pomerium Kubernetes Ingress Controller.

  • Amazon EKS

    Run the Pomerium Kubernetes Ingress Controller on Amazon EKS and keep application Services private behind explicit Pomerium Ingress resources.

  • Docker

    Use Docker Compose to connect the official Pomerium container to protected application containers on a private network without publishing each upstream port.

  • Google Kubernetes Engine

    Run the Pomerium Kubernetes Ingress Controller on GKE and keep application Services private behind explicit Pomerium Ingress resources.

  • Kubernetes

    Use the official Pomerium Ingress Controller to convert selected Kubernetes Ingress resources into TLS routes with identity-aware policy.

Need another integration guide?

Tell us which integration, service, or deployment path you need. We will use the request to prioritize the next researched guide.

Suggest a guide

Get a Personalized Demo

Schedule a Call with a Pomerium Engineer

Get a Demo