starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[PR #2337] [MERGED] use dedicated registration ID for auth flow #2613

New Issue
Closed
opened 2025-12-29 03:22:02 +01:00 by adam · 0 comments
adam commented 2025-12-29 03:22:02 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/2337
Author: @kradalby
Created: 1/10/2025
Status: ✅ Merged
Merged: 1/26/2025
Merged by: @kradalby

Base: main ← Head: kradalby/relogin-oidc

📝 Commits (10+)

  • ece8a7c move auth_noise into noise
  • 2ef6f3d more debug logging for logout
  • 81fa351 general version of waitForBackendState
  • 000b709 scenario func to create a single node
  • 4a70e13 util: correctly truncate randomurl string
  • f59c5e0 DRY up do login URL
  • 6440c1e Add registrationID type
  • 902cf60 use registration ID in reg flow, support followup
  • f6be407 add GetNodeByNodeKey lookup
  • 7f271e1 move refresh logic to db layer

📊 Changes

26 files changed (+583 additions, -583 deletions)

View changed files

📝 cmd/headscale/cli/debug.go (+4 -5)
📝 cmd/headscale/cli/nodes.go (+2 -2)
📝 hscontrol/app.go (+3 -3)
📝 hscontrol/auth.go (+89 -46)
➖ hscontrol/auth_noise.go (+0 -56)
📝 hscontrol/db/db.go (+2 -2)
📝 hscontrol/db/db_test.go (+2 -2)
📝 hscontrol/db/node.go (+89 -42)
📝 hscontrol/grpcv1.go (+19 -20)
📝 hscontrol/handlers.go (+12 -58)
📝 hscontrol/noise.go (+64 -21)
📝 hscontrol/oidc.go (+63 -104)
📝 hscontrol/templates/register_web.go (+3 -2)
📝 hscontrol/types/common.go (+39 -0)
📝 hscontrol/util/string.go (+2 -1)
📝 integration/auth_oidc_test.go (+46 -60)
📝 integration/auth_web_flow_test.go (+8 -37)
📝 integration/cli_test.go (+54 -57)
📝 integration/derp_verify_endpoint_test.go (+0 -1)
📝 integration/dns_test.go (+0 -1)

...and 6 more files

📄 Description

This PR moves the authentication flow away from using MachineKeys (previously also NodeKey). These are not suitable as the machine might be registered multiple times (multiple users, same machine).

We probably should have done this from the beginning, all register IDs are now short live, and only used for the registration purpose.

This also implements the missing followup part of registration which holds the connection open until a node has been registered.

This is step 1 to fix #2327 where user login does not work as expected, potentially logging in the wrong user.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/2337 **Author:** [@kradalby](https://github.com/kradalby) **Created:** 1/10/2025 **Status:** ✅ Merged **Merged:** 1/26/2025 **Merged by:** [@kradalby](https://github.com/kradalby) **Base:** `main` ← **Head:** `kradalby/relogin-oidc` --- ### 📝 Commits (10+) - [`ece8a7c`](https://github.com/juanfont/headscale/commit/ece8a7cdcb288372b837b3c9a4cf51a5ea87ed65) move auth_noise into noise - [`2ef6f3d`](https://github.com/juanfont/headscale/commit/2ef6f3d66a48f4a20ed32b3214e9ed99741042e7) more debug logging for logout - [`81fa351`](https://github.com/juanfont/headscale/commit/81fa35185050f11bf5cdc601b388d1a52518d8fa) general version of waitForBackendState - [`000b709`](https://github.com/juanfont/headscale/commit/000b7090164aee2847744d226e9fc3caad7f3dc5) scenario func to create a single node - [`4a70e13`](https://github.com/juanfont/headscale/commit/4a70e13ef9de1f73a38593f139e1196f2d14b25e) util: correctly truncate randomurl string - [`f59c5e0`](https://github.com/juanfont/headscale/commit/f59c5e037944b681f6adfa16d70e860e3631ff12) DRY up do login URL - [`6440c1e`](https://github.com/juanfont/headscale/commit/6440c1e345d91c7dd8d1e2f41100618994b5dc26) Add registrationID type - [`902cf60`](https://github.com/juanfont/headscale/commit/902cf60cae8106b13aa4311a4c639cbdd7809499) use registration ID in reg flow, support followup - [`f6be407`](https://github.com/juanfont/headscale/commit/f6be407ad7ef96b44e72bde0a1f49bd3bb0f75a1) add GetNodeByNodeKey lookup - [`7f271e1`](https://github.com/juanfont/headscale/commit/7f271e10bed152c67bc9d4ce55d7801dd2cd4e3e) move refresh logic to db layer ### 📊 Changes **26 files changed** (+583 additions, -583 deletions) <details> <summary>View changed files</summary> 📝 `cmd/headscale/cli/debug.go` (+4 -5) 📝 `cmd/headscale/cli/nodes.go` (+2 -2) 📝 `hscontrol/app.go` (+3 -3) 📝 `hscontrol/auth.go` (+89 -46) ➖ `hscontrol/auth_noise.go` (+0 -56) 📝 `hscontrol/db/db.go` (+2 -2) 📝 `hscontrol/db/db_test.go` (+2 -2) 📝 `hscontrol/db/node.go` (+89 -42) 📝 `hscontrol/grpcv1.go` (+19 -20) 📝 `hscontrol/handlers.go` (+12 -58) 📝 `hscontrol/noise.go` (+64 -21) 📝 `hscontrol/oidc.go` (+63 -104) 📝 `hscontrol/templates/register_web.go` (+3 -2) 📝 `hscontrol/types/common.go` (+39 -0) 📝 `hscontrol/util/string.go` (+2 -1) 📝 `integration/auth_oidc_test.go` (+46 -60) 📝 `integration/auth_web_flow_test.go` (+8 -37) 📝 `integration/cli_test.go` (+54 -57) 📝 `integration/derp_verify_endpoint_test.go` (+0 -1) 📝 `integration/dns_test.go` (+0 -1) _...and 6 more files_ </details> ### 📄 Description This PR moves the authentication flow away from using MachineKeys (previously also NodeKey). These are not suitable as the machine might be registered multiple times (multiple users, same machine). We probably should have done this from the beginning, all register IDs are now short live, and only used for the registration purpose. This also implements the missing followup part of registration which holds the connection open until a node has been registered. This is step 1 to fix #2327 where user login does not work as expected, potentially logging in the wrong user. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 03:22:02 +01:00
adam closed this issue 2025-12-29 03:22:02 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#2613
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?