I would really like to implement Pomerium to get rid of the old VPN, but I need to understand how can I allow developers to connect to our internal artifactory.
Their IDE fetches Java libraries via maven or gradle plugin, so NO browser involved, therefore no explicit SSO.
Installing Pomerium client locally and funnel traffic through it, is not an elegant solution ; it would be seen like a vpn client substitute and it won’t ‘sell’ between teams.
I could IP whilelist the autenticated clients for few hours with some integration, but it’s not really ‘enterprise’ .
I know I’m biased, but I don’t think the Pomerium client is an inelegant solution. A VPN client throws all traffic from a client PC into a remote network with a single authN step and no AuthZ for individual connections. The Pomerium Client creates individual tunnels for specific connections which are authorized with policies for each route.
But… I can understand that explaining that to end users might be difficult. I’ve written a few examples for configuring end user software to open TCP connections with the CLI client in the background, so the end user doesn’t need to manually open a tunnel. See our RDP page, for example.
If you don’t mind telling me what IDE / plugins are in play here, I could look to see if they can likewise be configured to run pre/post scripts to create the tunnel. If so, this may be another good example to add to our documentation!
P.S. If the plugins are already using SSH or Git (via SSH) under the hood, you can already set up this configuration as described here. The Git-specific example is still in progress, here’s the preview.
Thank you Alex for your reply!
Our company mainly uses Maven, where you define in settings.xml a profile to connect to an artifact server and the required username/password (see Maven – Settings Reference)
The developer IDE is generally intelliJ, the pre-script is definetely a good idea.
Can you please have a look if it’s feasible?
