CodeCow/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2026-07-20 21:23:07 +08:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity
bb4f458207
tailscale/cmd/tsidp
History
Brad Fitzpatrick bb4f458207 feature/captiveportal: move captive portal code out of ipnlocal, netcheck 
Captive portal detection was half-migrated: it had a build tag and
buildfeatures constant, but its code still lived in build-tag-gated
files in ipn/ipnlocal and net/netcheck, with its per-backend state
(context, cancel func, signaling channel) as fields on LocalBackend.

Move it under feature/captiveportal. The health-driven detection loop
becomes an ipnext.Extension holding its own state: it starts and
stops the loop from the BackendStateChange hook and subscribes to
health.Change events on the eventbus itself, removing the captive
portal hooks and special cases from LocalBackend entirely. The DERP
map now comes from a new ipnext.NodeBackend.DERPMap method, and the
preferred DERP region from magicsock's last netcheck report (the
same underlying source as the previously used Hostinfo.NetInfo).

The netcheck probe hook is now exported with a signature free of
netcheck internals, and its implementation moves to the small
feature/captiveportal/netcheckhook package, which installs the hook
as an import side effect. That package stays free of tsd/wgengine
dependencies so the tailscale CLI can keep probing for captive
portals in "tailscale netcheck" without linking the daemon-side
extension. The net/captivedetection library itself is unchanged and
stays put; after this change it is only linked when something pulls
in netcheckhook or the feature extension.

tailscaled links the feature by default via condregister as before,
but tsnet no longer does (shrinking tsnet, k8s-operator, and tsidp);
tsnet users who want it can blank-import the feature package, and
tsnet's dep test now locks that in.

Updates #12614

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: I3f1d09f9dc03e18f9a648ab5e42d16fa540b3fa9
2026-07-14 20:22:23 -04:00
..
depaware.txt feature/captiveportal: move captive portal code out of ipnlocal, netcheck 2026-07-14 20:22:23 -04:00
README.md cmd/tsidp: update README with new repo location warning 2025-09-17 14:05:22 -05:00
tsidp_test.go cmd/vet: add subtestnames analyzer; fix all existing violations 2026-04-05 15:52:51 -07:00
tsidp.go all: don't repeat the the word "the" unnecessarily 2026-06-18 16:32:08 +01:00
ui-edit.html cmd/tsidp: add web UI for managing OIDC clients (#16068) 2025-05-24 18:16:29 -04:00
ui-header.html cmd/tsidp: add web UI for managing OIDC clients (#16068) 2025-05-24 18:16:29 -04:00
ui-list.html cmd/tsidp: add web UI for managing OIDC clients (#16068) 2025-05-24 18:16:29 -04:00
ui-style.css cmd/tsidp: add web UI for managing OIDC clients (#16068) 2025-05-24 18:16:29 -04:00
ui.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00

README.md

Caution

Development of tsidp has been moved to https://github.com/tailscale/tsidp and it is no longer maintained here. Please visit the new repository to see the latest updates, file an issue, or contribute.

tsidp - Tailscale OpenID Connect (OIDC) Identity Provider

status: community project

tsidp is an OIDC Identity Provider (IdP) server that integrates with your Tailscale network. It allows you to use Tailscale identities for authentication in applications that support OpenID Connect, enabling single sign-on (SSO) capabilities within your tailnet.

Prerequisites

  • A Tailscale network (tailnet) with magicDNS and HTTPS enabled
  • A Tailscale authentication key from your tailnet
  • Docker installed on your system

Installation using Docker

Pre-built image

A pre-built tsidp image exists at tailscale/tsidp:unstable.

Building from Source

# Clone the Tailscale repository
git clone https://github.com/tailscale/tailscale.git
cd tailscale

# Build and publish to your own registry
make publishdevtsidp REPO=ghcr.io/yourusername/tsidp TAGS=v0.0.1 PUSH=true

Running the Container

Replace YOUR_TAILSCALE_AUTHKEY with your Tailscale authentication key:

docker run -d \
  --name tsidp \
  -p 443:443 \
  -e TS_AUTHKEY=YOUR_TAILSCALE_AUTHKEY \
  -e TAILSCALE_USE_WIP_CODE=1 \
  -v tsidp-data:/var/lib/tsidp \
  ghcr.io/yourusername/tsidp:v0.0.1 \
  tsidp --hostname=idp --dir=/var/lib/tsidp

Verify Installation

docker logs tsidp

Visit https://idp.tailnet.ts.net to confirm the service is running.

Usage Example: Proxmox Integration

Here's how to configure Proxmox to use tsidp for authentication:

  1. In Proxmox, navigate to Datacenter > Realms > Add OpenID Connect Server

  2. Configure the following settings:

    • Issuer URL: https://idp.velociraptor.ts.net
    • Realm: tailscale (or your preferred name)
    • Client ID: unused
    • Client Key: unused
    • Default: true
    • Autocreate users: true
    • Username claim: email

  3. Set up user permissions:

    • Go to Datacenter > Permissions > Groups
    • Create a new group (e.g., "tsadmins")
    • Click Permissions in the sidebar
    • Add Group Permission
    • Set Path to / for full admin access or scope as needed
    • Set the group and role
    • Add Tailscale-authenticated users to the group

Configuration Options

The tsidp server supports several command-line flags:

  • --verbose: Enable verbose logging
  • --port: Port to listen on (default: 443)
  • --local-port: Allow requests from localhost
  • --use-local-tailscaled: Use local tailscaled instead of tsnet
  • --hostname: tsnet hostname
  • --dir: tsnet state directory

Environment Variables

  • TS_AUTHKEY: Your Tailscale authentication key (required)
  • TS_HOSTNAME: Hostname for the tsidp server (default: "idp", Docker only)
  • TS_STATE_DIR: State directory (default: "/var/lib/tsidp", Docker only)
  • TAILSCALE_USE_WIP_CODE: Enable work-in-progress code (default: "1")

Support

This is an experimental, work in progress, community project. For issues or questions, file issues on the GitHub repository.

License

BSD-3-Clause License. See LICENSE for details.