starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[PR #1287] [CLOSED] Allow use of the preferred_username OIDC claim. #2016

New Issue
Closed
opened 2025-12-29 03:19:18 +01:00 by adam · 0 comments
adam commented 2025-12-29 03:19:18 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/1287
Author: @meson800
Created: 3/26/2023
Status: ❌ Closed

Base: main ← Head: oidc_username_claim

📝 Commits (5)

  • 0b138a7 Allow use of the preferred_username OIDC claim.
  • 64f94e8 Added OIDC claim integration tests.
  • c65587e Added new GHA workflows for OIDC grant tests
  • a642383 Updated gold compare configs and fixed lint styles
  • b561002 Merge remote-tracking branch 'upstream/main' into oidc_username_claim

📊 Changes

8 files changed (+418 additions, -13 deletions)

View changed files

➕ .github/workflows/test-integration-v2-TestOIDCEmailGrant.yaml (+57 -0)
➕ .github/workflows/test-integration-v2-TestOIDCUsernameGrant.yaml (+57 -0)
📝 cmd/headscale/cli/mockoidc.go (+30 -2)
📝 config-example.yaml (+10 -0)
📝 docs/oidc.md (+55 -0)
📝 hscontrol/config.go (+3 -0)
📝 hscontrol/oidc.go (+26 -8)
📝 integration/auth_oidc_test.go (+180 -3)

📄 Description

Previously, Headscale would only use the email OIDC claim to set the Headscale user. In certain cases
(self-hosted SSO), it may be useful to instead use the preferred_username to set the Headscale username. This also closes the existing issue #938.

This adds a config setting to use this claim instead. The OIDC docs have been updated to include this entry as well. In addition, this adds an Authelia OIDC example to the docs.

I didn't see any existing unit or integration tests for OIDC, so wasn't sure where to add such tests. If I'm wrong, I'm happy to add them!

I did test this against my SSO server, and confirm that the preferred_username grant if you set it works as expected.

  • read the CONTRIBUTING guidelines
  • raised a GitHub issue or discussed it on the projects chat beforehand (one already exists)
  • added unit tests
  • added integration tests
  • updated documentation if needed
  • updated CHANGELOG.md

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/1287 **Author:** [@meson800](https://github.com/meson800) **Created:** 3/26/2023 **Status:** ❌ Closed **Base:** `main` ← **Head:** `oidc_username_claim` --- ### 📝 Commits (5) - [`0b138a7`](https://github.com/juanfont/headscale/commit/0b138a7baeb5927e86c32d7689872a1c9b3e812d) Allow use of the preferred_username OIDC claim. - [`64f94e8`](https://github.com/juanfont/headscale/commit/64f94e8665ca1c6338831639ad657468af3fbc4c) Added OIDC claim integration tests. - [`c65587e`](https://github.com/juanfont/headscale/commit/c65587efc680498c5a62b04b748558c38e7e5832) Added new GHA workflows for OIDC grant tests - [`a642383`](https://github.com/juanfont/headscale/commit/a6423839ef36d8e91293b906eb25013ab974cdee) Updated gold compare configs and fixed lint styles - [`b561002`](https://github.com/juanfont/headscale/commit/b56100269e6093325dbe8ca3b87a279d6ac26b9a) Merge remote-tracking branch 'upstream/main' into oidc_username_claim ### 📊 Changes **8 files changed** (+418 additions, -13 deletions) <details> <summary>View changed files</summary> ➕ `.github/workflows/test-integration-v2-TestOIDCEmailGrant.yaml` (+57 -0) ➕ `.github/workflows/test-integration-v2-TestOIDCUsernameGrant.yaml` (+57 -0) 📝 `cmd/headscale/cli/mockoidc.go` (+30 -2) 📝 `config-example.yaml` (+10 -0) 📝 `docs/oidc.md` (+55 -0) 📝 `hscontrol/config.go` (+3 -0) 📝 `hscontrol/oidc.go` (+26 -8) 📝 `integration/auth_oidc_test.go` (+180 -3) </details> ### 📄 Description Previously, Headscale would only use the `email` OIDC claim to set the Headscale user. In certain cases (self-hosted SSO), it may be useful to instead use the `preferred_username` to set the Headscale username. This also closes the existing issue #938. This adds a config setting to use this claim instead. The OIDC docs have been updated to include this entry as well. In addition, this adds an Authelia OIDC example to the docs. I didn't see any existing unit or integration tests for OIDC, so wasn't sure where to add such tests. If I'm wrong, I'm happy to add them! I did test this against my SSO server, and confirm that the `preferred_username` grant if you set it works as expected. <!-- Please tick if the following things apply. You… --> - [x] read the [CONTRIBUTING guidelines](README.md#contributing) - [x] raised a GitHub issue or discussed it on the projects chat beforehand (one already exists) - [ ] added unit tests - [x] added integration tests - [x] updated documentation if needed - [ ] updated CHANGELOG.md <!-- If applicable, please reference the issue using `Fixes #XXX` and add tests to cover your new code. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 03:19:18 +01:00
adam closed this issue 2025-12-29 03:19:18 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#2016
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?