starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] If an unknown user is added to the policy, SSH policies become empty #1137

New Issue
Closed
opened 2025-12-29 02:28:30 +01:00 by adam · 1 comment
adam commented 2025-12-29 02:28:30 +01:00
Owner
Copy Link

Originally created by @OdyX on GitHub (Nov 5, 2025).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

With a simple OIDC setup, I'm trying to preemptively add users to a group (before they exist from the headscale point of view).

This is a working policy file:

{
  "groups": {
   "group:example-infra": [
      "odyx@example.com",
    ],
  },
  "tagOwners": {
    "tag:vps": [
      "odyx@example.com"
    ],
  },
  "acls": [
    // Allow infra to hit all ports on all tailnet machines (autogroup:tagged)
    {
      "action": "accept",
      "src": [
        "group:example-infra",
      ],
      "dst": [
        "autogroup:tagged:*"
      ]
    },
  ],
  "ssh": [
    // Allow infra to ssh to tag:example-infra server as debian
    {
      "action": "accept",
      "src": [
        "group:poto-infra"
      ],
      "dst": [
        "tag:example-infra",
      ],
      "users": [
        "debian",
      ],
    },
  ],
}

With this, I get something along these lines on …/debug/ssh (where id:15 is not tagged, id:16 is)

{
  "id:15 hostname:exo-ts-004 givenname:exo-ts-004": {
    "rules": null
  },
  "id:16 hostname:ik-ts-004 givenname:ik-ts-004": {
    "rules": [
      {
        "principals": [
          {
            "nodeIP": "100.95.204.138"
          },
          {
            "nodeIP": "100.96.46.136"
          },
          {
            "nodeIP": "fd7a:115c:a1e0:706f:3577:8580:42e5:d751"
          },
          {
            "nodeIP": "fd7a:115c:a1e0:706f:ec80:d63:1688:af87"
          }
        ],
        "sshUsers": {
          "debian": "debian"
        },
        "action": {
          "accept": true,
          "allowAgentForwarding": true,
          "allowLocalPortForwarding": true,
          "allowRemotePortForwarding": true
        }
      }
    ]
  }
}

If I push this patch on the policy (with "otheruser@example.com" existing on the IdP, but who has not logged yet)

diff --git i/policy.hujson w/policy.hujson
index ccd3a64..8505c75 100644
--- i/policy.hujson
+++ w/policy.hujson
@@ -2,6 +2,7 @@
   "groups": {
    "group:example-infra": [
       "odyx@example.com",
+      "otheruser@example.com",
     ],
   },
   "tagOwners": {

… then the SSH rules become:

{
  "id:15 hostname:exo-ts-004 givenname:exo-ts-004": {
    "rules": null
  },
  "id:16 hostname:ik-ts-004 givenname:ik-ts-004": {
    "rules": null
  }
}

… de-facto breaking each and every SSH login.

Expected Behavior

I'd expect unrecognized/unknown users to be just ignored in the policy processing (ideally with a warning in the logs), not silently break the whole SSH policy.

Steps To Reproduce

  1. start from a working state with a valid SSH policy and existing users
  2. add an unknown user to a group in a src SSH policy

Environment

- OS: Debian 'trixie' 13.1
- Headscale version: 0.27.0
- Tailscale version: 1.90.6

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Debug information

(None apply)

Originally created by @OdyX on GitHub (Nov 5, 2025). ### Is this a support request? - [x] This is not a support request ### Is there an existing issue for this? - [x] I have searched the existing issues ### Current Behavior With a simple OIDC setup, I'm trying to preemptively add users to a group (before they exist from the headscale point of view). This is a working policy file: ```jsonc { "groups": { "group:example-infra": [ "odyx@example.com", ], }, "tagOwners": { "tag:vps": [ "odyx@example.com" ], }, "acls": [ // Allow infra to hit all ports on all tailnet machines (autogroup:tagged) { "action": "accept", "src": [ "group:example-infra", ], "dst": [ "autogroup:tagged:*" ] }, ], "ssh": [ // Allow infra to ssh to tag:example-infra server as debian { "action": "accept", "src": [ "group:poto-infra" ], "dst": [ "tag:example-infra", ], "users": [ "debian", ], }, ], } ``` With this, I get something along these lines on `…/debug/ssh` (where id:15 is not tagged, id:16 is) ```json { "id:15 hostname:exo-ts-004 givenname:exo-ts-004": { "rules": null }, "id:16 hostname:ik-ts-004 givenname:ik-ts-004": { "rules": [ { "principals": [ { "nodeIP": "100.95.204.138" }, { "nodeIP": "100.96.46.136" }, { "nodeIP": "fd7a:115c:a1e0:706f:3577:8580:42e5:d751" }, { "nodeIP": "fd7a:115c:a1e0:706f:ec80:d63:1688:af87" } ], "sshUsers": { "debian": "debian" }, "action": { "accept": true, "allowAgentForwarding": true, "allowLocalPortForwarding": true, "allowRemotePortForwarding": true } } ] } } ``` If I push this patch on the policy (with "otheruser@example.com" existing on the IdP, but who has not logged yet) ```patch diff --git i/policy.hujson w/policy.hujson index ccd3a64..8505c75 100644 --- i/policy.hujson +++ w/policy.hujson @@ -2,6 +2,7 @@ "groups": { "group:example-infra": [ "odyx@example.com", + "otheruser@example.com", ], }, "tagOwners": { ``` … then the SSH rules become: ```json { "id:15 hostname:exo-ts-004 givenname:exo-ts-004": { "rules": null }, "id:16 hostname:ik-ts-004 givenname:ik-ts-004": { "rules": null } } ``` … de-facto breaking each and every SSH login. ### Expected Behavior I'd expect unrecognized/unknown users to be just ignored in the policy processing (ideally with a warning in the logs), not silently break the whole SSH policy. ### Steps To Reproduce 1. start from a working state with a valid SSH policy and existing users 2. add an unknown user to a group in a `src` SSH policy ### Environment ```markdown - OS: Debian 'trixie' 13.1 - Headscale version: 0.27.0 - Tailscale version: 1.90.6 ``` ### Runtime environment - [ ] Headscale is behind a (reverse) proxy - [ ] Headscale runs in a container ### Debug information (None apply)
adam added the bugwell described ❤️regression labels 2025-12-29 02:28:30 +01:00
adam closed this issue 2025-12-29 02:28:30 +01:00
adam commented 2025-12-29 02:28:30 +01:00
Author
Owner
Copy Link

@nblock commented on GitHub (Nov 5, 2025):

Reproduced on 0.27.0, but not on 0.26.1.

@nblock commented on GitHub (Nov 5, 2025): Reproduced on 0.27.0, but not on 0.26.1.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug regression well described ❤️
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1137
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?