A BeyondCorp-inspired HTTPS/SSO access proxy for securing internal services during a zero-trust transition, eliminating VPN reliance.
Beyond is an open-source access proxy inspired by Google's BeyondCorp research. It acts as a gateway that secures internal web services by enforcing authentication and authorization before allowing access, enabling organizations to move away from traditional VPNs. It solves the problem of securely exposing internal applications during a transition to a zero-trust security model.
System administrators, DevOps engineers, and security teams in organizations looking to implement zero-trust network access (ZTNA) and reduce dependency on VPNs for internal application access.
Developers choose Beyond for its straightforward deployment via Docker, its support for multiple modern authentication protocols (OIDC, SAML, OAuth2), and its specific features for integrating with developer tools like GitHub Enterprise and Docker registries within a zero-trust framework.
BeyondCorp-inspired HTTPS/SSO Access Proxy. Secure internal services outside your VPN/perimeter network during a zero-trust transition.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports OpenID Connect, OAuth2 tokens, and SAMLv2, providing flexibility to integrate with various identity providers like Google or enterprise IdPs, as shown in the example configurations.
Includes built-in support for GitHub Enterprise and private Docker Registry APIs (v2), catering specifically to developer toolchains within a zero-trust framework.
Allows hostname rewriting, mapping, and secure allowlists via CSV or JSON, enabling legacy system migrations and fine-grained access control, as detailed in the host management section.
Can be quickly deployed using Docker with straightforward command-line examples, reducing setup complexity for containerized environments.
Relies on numerous command-line flags and external JSON files for settings like allowlists and host mappings, which can be error-prone and require careful management in production.
In development mode, it auto-generates cookie keys that don't persist across restarts, requiring manual key management for production, as warned in the cookie key section.
Primarily focuses on HTTP/HTTPS and WebSockets; lacks built-in support for other common enterprise protocols like LDAP or database connections, limiting its use for broader zero-trust transitions.