starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-12 04:10:32 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Feature] transitional page before redirecting to OIDC provider #1022

New Issue
Closed
opened 2025-12-29 02:27:39 +01:00 by adam · 3 comments
adam commented 2025-12-29 02:27:39 +01:00
Owner
Copy Link

Originally created by @hdhoang on GitHub (May 15, 2025).

Use case

With OIDC enabled, headscale /register/<code> link goes directly to the OIDC provider's stateful URL. This URL cannot be copied & continued on another device (eg high-trust device, or non-default browser with authenticated session).

Current situation hinders headscale-enabled login on eg android TV.

Commandline tailscale client has --qr to pause at the register link with a QR code to scan:


To authenticate, visit:

        https://headscale.example/register/<code>

██████████████████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████████████████████
██████████████████████████████████████████████████████████████████████████████████
████████              ██        ████  ██  ██    ██████  ████              ████████
████████  ██████████  ██  ████    ██  ██    ██████████    ██  ██████████  ████████
████████  ██      ██  ████████  ██    ████████    ██      ██  ██      ██  ████████
████████  ██      ██  ██          ████  ██              ████  ██      ██  ████████

Description

tailscale's https://login.tailscale.com/a/<code> redirects to https://login.tailscale.com/login?next_url=%2Fa%2F<code>&refresh=true, which can be continued elsewhere. Optionally, a &qr parameter allows transporting the page to a high-trust device easily.

Versions:

Contribution

  • I can write the design doc for this feature
  • I can contribute this feature

How can it be implemented?

A new intersitial template in /assets/, with QR code for itself, and a single "Continue with 'OIDC Provider Name'" or clickable url.

Replace the redirect in with that template, while still waiting for return authcode, around hscontrol/oidc.go debug message "Redirecting to %s for authentication"

We may need a field in config for the pretty name, or pick out the domain from issuer path.

Originally created by @hdhoang on GitHub (May 15, 2025). ### Use case With OIDC enabled, headscale `/register/<code>` link goes directly to the OIDC provider's stateful URL. This URL cannot be copied & continued on another device (eg high-trust device, or non-default browser with authenticated session). Current situation hinders headscale-enabled login on eg android TV. Commandline tailscale client has `--qr` to pause at the register link with a QR code to scan: ```console To authenticate, visit: https://headscale.example/register/<code> ██████████████████████████████████████████████████████████████████████████████████ ██████████████████████████████████████████████████████████████████████████████████ ██████████████████████████████████████████████████████████████████████████████████ ██████████████████████████████████████████████████████████████████████████████████ ████████ ██ ████ ██ ██ ██████ ████ ████████ ████████ ██████████ ██ ████ ██ ██ ██████████ ██ ██████████ ████████ ████████ ██ ██ ████████ ██ ████████ ██ ██ ██ ██ ████████ ████████ ██ ██ ██ ████ ██ ████ ██ ██ ████████ ``` ### Description tailscale's `https://login.tailscale.com/a/<code>` redirects to `https://login.tailscale.com/login?next_url=%2Fa%2F<code>&refresh=true`, which can be continued elsewhere. Optionally, a `&qr` parameter allows transporting the page to a high-trust device easily. Versions: - headscale 0.26 (thanks for the great beta tests) - tailscale 1.82.x (android, linux) - KB 1336 https://tailscale.com/kb/1336/device-add-qr-code ### Contribution - [x] I can write the design doc for this feature - [ ] I can contribute this feature ### How can it be implemented? A new intersitial template in `/assets/`, with QR code for itself, and a single "Continue with 'OIDC Provider Name'" or clickable url. Replace the redirect in with that template, while still waiting for return authcode, around `hscontrol/oidc.go` debug message `"Redirecting to %s for authentication"` We may need a field in config for the pretty name, or pick out the domain from `issuer` path.
adam added the enhancementstale labels 2025-12-29 02:27:39 +01:00
adam closed this issue 2025-12-29 02:27:39 +01:00
adam commented 2025-12-29 02:27:40 +01:00
Author
Owner
Copy Link

@hdhoang commented on GitHub (May 15, 2025):

More complicatedly, the page can accept an authkey as an alternative. Current mobile app design doesn't allow using both alternate server and authkey (they are exclusive items on 1 menu.

That can open up non-oidc usecases like with full clients. I'm not sure how it can fit with oidc.go anymore. Something more natural on the apps side

@hdhoang commented on GitHub (May 15, 2025): More complicatedly, the page can accept an authkey as an alternative. Current mobile app design doesn't allow using both alternate server and authkey (they are [exclusive items on 1 menu](https://github.com/tailscale/tailscale-android/blob/d3f34c579decb2a543839d90ea0759b31db1d2c0/android/src/main/java/com/tailscale/ipn/ui/view/CustomLogin.kt#L45). That can open up non-oidc usecases like with full clients. I'm not sure how it can fit with `oidc.go` anymore. Something more natural on the apps side
adam commented 2025-12-29 02:27:40 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Aug 14, 2025):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Aug 14, 2025): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 02:27:40 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Aug 22, 2025):

This issue was closed because it has been inactive for 14 days since being marked as stale.

@github-actions[bot] commented on GitHub (Aug 22, 2025): This issue was closed because it has been inactive for 14 days since being marked as stale.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement stale
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1022
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?