starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Preauth keys for different users #465

New Issue
Closed
opened 2025-12-29 01:29:48 +01:00 by adam · 15 comments
adam commented 2025-12-29 01:29:48 +01:00
Owner
Copy Link

Originally created by @QZAiXH on GitHub (Apr 3, 2023).

Bug description
I have two preauth keys A and B, and a new client. I first use A to join headscale and this client successfully joins user A. After that I use B on the client and the client does not switch to user B, it is still on A. Is this correct?

Originally created by @QZAiXH on GitHub (Apr 3, 2023). <!-- Headscale is a multinational community across the globe. Our common language is English. Please consider raising the bug report in this language. --> **Bug description** I have two preauth keys A and B, and a new client. I first use A to join headscale and this client successfully joins user A. After that I use B on the client and the client does not switch to user B, it is still on A. Is this correct?
adam added the bugno-stale-bot labels 2025-12-29 01:29:48 +01:00
adam closed this issue 2025-12-29 01:29:48 +01:00
adam commented 2025-12-29 01:29:49 +01:00
Author
Owner
Copy Link

@ItsShadowCone commented on GitHub (Apr 8, 2023):

Furthermore fast account switching with multiple users on the same headscale instance is currently not working (afaict).

I suspect the same reason under the hood, headscale might be using the machine id/key for a more unique identifier than it should be.

I tested:

  • joining via preauth key, subsequent login via preauth key for second user -> no user switch, no second account, just a renegotiation of node key
  • joining via preauth key, subsequent login via OIDC -> oidc fails, in the log i see could not register machine error="machine was previously registered with a different user"
  • joining via OIDC, subsequent login via preauth key -> same as #1. preauth key changes nothing, except for the node key.
@ItsShadowCone commented on GitHub (Apr 8, 2023): Furthermore fast account switching with multiple users on the same headscale instance is currently not working (afaict). I suspect the same reason under the hood, headscale might be using the machine id/key for a more unique identifier than it should be. I tested: - joining via preauth key, subsequent `login` via preauth key for second user -> no user switch, no second account, just a renegotiation of node key - joining via preauth key, subsequent `login` via OIDC -> oidc fails, in the log i see `could not register machine error="machine was previously registered with a different user"` - joining via OIDC, subsequent `login` via preauth key -> same as #1. preauth key changes nothing, except for the node key.
adam commented 2025-12-29 01:29:50 +01:00
Author
Owner
Copy Link

@pallabpain commented on GitHub (Apr 16, 2023):

You should be able to fast-switch users seamlessly if you do the following after logging in with preauth key A.

tailscale logout
tailscale down

tailscale up --auth-key preauthkey-B ...

I've written an implementation that does exactly this in one of the projects that I am working on.

@pallabpain commented on GitHub (Apr 16, 2023): You should be able to fast-switch users seamlessly if you do the following after logging in with preauth key A. ``` tailscale logout tailscale down tailscale up --auth-key preauthkey-B ... ``` I've written an implementation that does exactly this in one of the projects that I am working on.
adam commented 2025-12-29 01:29:50 +01:00
Author
Owner
Copy Link

@ItsShadowCone commented on GitHub (Apr 17, 2023):

I tried it today on headscale 0.21.0 and it does not work. tailscale switch --list only shows a single user.

@ItsShadowCone commented on GitHub (Apr 17, 2023): I tried it today on headscale 0.21.0 and it does not work. `tailscale switch --list` only shows a single user.
adam commented 2025-12-29 01:29:50 +01:00
Author
Owner
Copy Link

@Carseason commented on GitHub (Apr 28, 2023):

me to

@Carseason commented on GitHub (Apr 28, 2023): me to
adam commented 2025-12-29 01:29:51 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Oct 26, 2023):

This issue is stale because it has been open for 180 days with no activity.

@github-actions[bot] commented on GitHub (Oct 26, 2023): This issue is stale because it has been open for 180 days with no activity.
adam commented 2025-12-29 01:29:51 +01:00
Author
Owner
Copy Link

@ItsShadowCone commented on GitHub (Oct 29, 2023):

i believe it is still relevant however

@ItsShadowCone commented on GitHub (Oct 29, 2023): i believe it is still relevant however
adam commented 2025-12-29 01:29:51 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Jan 28, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Jan 28, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 01:29:51 +01:00
Author
Owner
Copy Link

@ItsShadowCone commented on GitHub (Feb 1, 2024):

Did anyone test this for v0.23.0?

@ItsShadowCone commented on GitHub (Feb 1, 2024): Did anyone test this for v0.23.0?
adam commented 2025-12-29 01:29:52 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (May 2, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (May 2, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 01:29:52 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (May 5, 2024):

Furthermore fast account switching with multiple users on the same headscale instance is currently not working (afaict).

I suspect the same reason under the hood, headscale might be using the machine id/key for a more unique identifier than it should be.

Are you trying to login to the same headscale with the same node twice?

So [node a, login 1] and [node a, login 2] is both in your fast user switching menu and as two nodes in headscale?

Does Tailscale SaaS support this?

@kradalby commented on GitHub (May 5, 2024): > Furthermore fast account switching with multiple users on the same headscale instance is currently not working (afaict). > > I suspect the same reason under the hood, headscale might be using the machine id/key for a more unique identifier than it should be. Are you trying to login to the same headscale with the same node twice? So [node a, login 1] and [node a, login 2] is both in your fast user switching menu and as two nodes in headscale? Does Tailscale SaaS support this?
adam commented 2025-12-29 01:29:53 +01:00
Author
Owner
Copy Link

@ItsShadowCone commented on GitHub (May 5, 2024):

See my response in #1920

I think the whole point in fast user switching @ tailscale SaaS is same node multiple logins.

@ItsShadowCone commented on GitHub (May 5, 2024): See my response in #1920 I think the whole point in fast user switching @ tailscale SaaS is same node multiple logins.
adam commented 2025-12-29 01:29:53 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Aug 4, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Aug 4, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 01:29:53 +01:00
Author
Owner
Copy Link

@ItsShadowCone commented on GitHub (Aug 6, 2024):

Can we confirm that this bug is either still existing or fixed in the latest beta?

@ItsShadowCone commented on GitHub (Aug 6, 2024): Can we confirm that this bug is either still existing or fixed in the latest beta?
adam commented 2025-12-29 01:29:54 +01:00
Author
Owner
Copy Link

@stormshield-gt commented on GitHub (Nov 14, 2024):

I can confirm that the bug is still present is the latest published image 2 months ago: sha256:392237fecf911ff101f56d92dbb2529eb8a1f065bdbdcd73744565c6e0744bad
When login with a new user it creates a new profile in tailscaled.state but also set the old one to null

@stormshield-gt commented on GitHub (Nov 14, 2024): I can confirm that the bug is still present is the latest published image 2 months ago: sha256:392237fecf911ff101f56d92dbb2529eb8a1f065bdbdcd73744565c6e0744bad When login with a new user it creates a new profile in `tailscaled.state` but also set the old one to `null`
adam commented 2025-12-29 01:29:54 +01:00
Author
Owner
Copy Link

@stormshield-gt commented on GitHub (Nov 14, 2024):

I can also confirm that switching between users of the same tailnet is officially supported by tailscale SaaS.
From the docs:

You aren't prevented from switching between accounts in the same tailnet. If you don't want to switch between accounts in the same tailnet, re-authenticate the device instead of switching between accounts.

@stormshield-gt commented on GitHub (Nov 14, 2024): I can also confirm that switching between users of the same `tailnet` is officially supported by tailscale SaaS. From the [docs](https://tailscale.com/kb/1225/fast-user-switching#limitations): > You aren't prevented from switching between accounts in the same tailnet. If you don't want to switch between accounts in the same tailnet, re-authenticate the device instead of switching between accounts.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug no-stale-bot
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#465
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?