starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[PR #126] [MERGED] Initial work on OIDC (SSO) integration #1270

New Issue
Closed
opened 2025-12-29 02:29:31 +01:00 by adam · 0 comments
adam commented 2025-12-29 02:29:31 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/126
Author: @unreality
Created: 9/26/2021
Status: ✅ Merged
Merged: 10/31/2021
Merged by: @kradalby

Base: main ← Head: main

📝 Commits (10+)

  • e7a2501 initial work on OIDC (SSO) integration
  • b22a978 fix linter errors, error out if jwt does not contain a key id
  • 8248b71 Merge branch 'main' into main
  • cc054d7 Merge branch 'main' into main
  • 0393ab5 Merge branch 'main' into main
  • c487591 use go-oidc instead of verifying and extracting tokens ourselves, rename oidc_endpoint to oidc_issuer to be more inline with spec
  • 35795c7 Handle trailing slash on uris
  • e407d42 updates from code review
  • 2997f4d Merge branch 'main' into main
  • 74e6c14 updates from code review

📊 Changes

13 files changed (+653 additions, -58 deletions)

View changed files

📝 README.md (+1 -1)
📝 api.go (+81 -47)
📝 app.go (+29 -0)
📝 cli.go (+3 -0)
📝 cli_test.go (+13 -7)
📝 cmd/headscale/cli/utils.go (+44 -0)
📝 config-example.yaml (+15 -0)
📝 go.mod (+3 -0)
📝 go.sum (+9 -0)
📝 machine.go (+42 -3)
📝 namespaces.go (+11 -0)
➕ oidc.go (+228 -0)
➕ oidc_test.go (+174 -0)

📄 Description

This pull adds initial support for SSO. If you add oidc_endpoint, oidc_client_id and oidc_client_secret to config.json, when a new machine attempts to register, the OIDC endpoint will be used for authentication. A new namespace is created using the email address of the user, and the machine is added to that namespace.

Expiry times probably need to be implemented/used so that Logging out works correctly, and i think further work needs to be done on the register endpoint to become secure.

oidc_endpoint needs to be the base url of the OIDC endpoint (ie if your well-known configuration is at http://localhost:8080/auth/realms/master/.well-known/openid-configuration your endpoint url should be http://localhost:8080/auth/realms/master/ -- it does not do proper path joining at the moment, so the training / is required

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/126 **Author:** [@unreality](https://github.com/unreality) **Created:** 9/26/2021 **Status:** ✅ Merged **Merged:** 10/31/2021 **Merged by:** [@kradalby](https://github.com/kradalby) **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (10+) - [`e7a2501`](https://github.com/juanfont/headscale/commit/e7a2501fe865dc04cb999be4d50332dc4e0f57f0) initial work on OIDC (SSO) integration - [`b22a978`](https://github.com/juanfont/headscale/commit/b22a9781a22a41834dcb87b96b8ae2f87df17d55) fix linter errors, error out if jwt does not contain a key id - [`8248b71`](https://github.com/juanfont/headscale/commit/8248b7115330a67205853786dd0c213a1784a398) Merge branch 'main' into main - [`cc054d7`](https://github.com/juanfont/headscale/commit/cc054d71fe9f1b8567f4f051890008c7ce6274df) Merge branch 'main' into main - [`0393ab5`](https://github.com/juanfont/headscale/commit/0393ab524cec5a5b095cb402461e4a87d262225b) Merge branch 'main' into main - [`c487591`](https://github.com/juanfont/headscale/commit/c487591437afb292701c8a905dc7ce9ad0477562) use go-oidc instead of verifying and extracting tokens ourselves, rename oidc_endpoint to oidc_issuer to be more inline with spec - [`35795c7`](https://github.com/juanfont/headscale/commit/35795c79c367c80590deefe51415bc364f82a024) Handle trailing slash on uris - [`e407d42`](https://github.com/juanfont/headscale/commit/e407d423d44c208d0989f9ec8e94ca29909a6f16) updates from code review - [`2997f4d`](https://github.com/juanfont/headscale/commit/2997f4d2515b3db3541098de1bc302d50a5c0e64) Merge branch 'main' into main - [`74e6c14`](https://github.com/juanfont/headscale/commit/74e6c1479e64ea13e49fbb4ca87f668dd14068ab) updates from code review ### 📊 Changes **13 files changed** (+653 additions, -58 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+1 -1) 📝 `api.go` (+81 -47) 📝 `app.go` (+29 -0) 📝 `cli.go` (+3 -0) 📝 `cli_test.go` (+13 -7) 📝 `cmd/headscale/cli/utils.go` (+44 -0) 📝 `config-example.yaml` (+15 -0) 📝 `go.mod` (+3 -0) 📝 `go.sum` (+9 -0) 📝 `machine.go` (+42 -3) 📝 `namespaces.go` (+11 -0) ➕ `oidc.go` (+228 -0) ➕ `oidc_test.go` (+174 -0) </details> ### 📄 Description This pull adds initial support for SSO. If you add `oidc_endpoint`, `oidc_client_id` and `oidc_client_secret` to config.json, when a new machine attempts to register, the OIDC endpoint will be used for authentication. A new namespace is created using the email address of the user, and the machine is added to that namespace. Expiry times probably need to be implemented/used so that Logging out works correctly, and i think further work needs to be done on the register endpoint to become secure. `oidc_endpoint` needs to be the base url of the OIDC endpoint (ie if your well-known configuration is at `http://localhost:8080/auth/realms/master/.well-known/openid-configuration` your endpoint url should be `http://localhost:8080/auth/realms/master/` -- it does not do proper path joining at the moment, so the training `/` is required --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 02:29:31 +01:00
adam closed this issue 2025-12-29 02:29:31 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1270
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?