starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Implement OIDC Group support for Google Workspace (was GSuite) issuer/provider #686

New Issue
Closed
opened 2025-12-29 02:22:03 +01:00 by adam · 7 comments
adam commented 2025-12-29 02:22:03 +01:00
Owner
Copy Link

Originally created by @SLoeuillet on GitHub (Apr 9, 2024).

Why

As Google is a bad organisation, they did provide the minimal to comply with OpenID (email, username, family, name)
But it lacks something that most other providers gives : groups in which the user is registered.

That would mean that using OIDC with Google Workspace would allow everyone on the domain to have VPN access.

Google could give the group, but not as a standard claim, but by calling some Google Cloud APIs.
Either calling Admin.Directory API, with a service account which has full delegation on the doman or by calling Cloud.Identity API, which is newer, and gives back the list of groups.

Description

In case of Google Workspace is used, and allowed_groups filtering is used in the headscale configuration, dynamically add the required priorietary scope that kindly ask for groups.
Then, once OIDC response comes, get the JWT auth token and query groups by using CloudIdentity API

Originally created by @SLoeuillet on GitHub (Apr 9, 2024). ## Why As Google is a bad organisation, they did provide the minimal to comply with OpenID (email, username, family, name) But it lacks something that most other providers gives : groups in which the user is registered. That would mean that using OIDC with Google Workspace would allow everyone on the domain to have VPN access. Google could give the group, but not as a standard claim, but by calling some Google Cloud APIs. Either calling Admin.Directory API, with a service account which has full delegation on the doman or by calling Cloud.Identity API, which is newer, and gives back the list of groups. ## Description In case of Google Workspace is used, and allowed_groups filtering is used in the headscale configuration, dynamically add the required priorietary scope that kindly ask for groups. Then, once OIDC response comes, get the JWT auth token and query groups by using CloudIdentity API
adam added the enhancementstaleOIDC labels 2025-12-29 02:22:03 +01:00
adam closed this issue 2025-12-29 02:22:03 +01:00
adam commented 2025-12-29 02:22:03 +01:00
Author
Owner
Copy Link

@SLoeuillet commented on GitHub (Apr 9, 2024):

This has been implemented in PR #1858

@SLoeuillet commented on GitHub (Apr 9, 2024): This has been implemented in PR #1858
adam commented 2025-12-29 02:22:04 +01:00
Author
Owner
Copy Link

@SLoeuillet commented on GitHub (Apr 9, 2024):

Note that there are 2 ways to get groups : direct groups & transient groups. I did choose the direct groups.

Another thing : Google Cloud Go bindings are immature, that's why I went calling the API instead of using those

@SLoeuillet commented on GitHub (Apr 9, 2024): Note that there are 2 ways to get groups : direct groups & transient groups. I did choose the direct groups. Another thing : Google Cloud Go bindings are immature, that's why I went calling the API instead of using those
adam commented 2025-12-29 02:22:04 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Jul 9, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Jul 9, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 02:22:04 +01:00
Author
Owner
Copy Link

@tomvoss commented on GitHub (Aug 1, 2024):

I can voice my desire for adding Google Workspace groups support.

@SLoeuillet , Does PR #1858 add support for Google Workspace groups where the customer is not using Google Cloud Identity?

@tomvoss commented on GitHub (Aug 1, 2024): I can voice my desire for adding Google Workspace groups support. @SLoeuillet , Does PR #1858 add support for Google Workspace groups where the customer is not using Google Cloud Identity?
adam commented 2025-12-29 02:22:04 +01:00
Author
Owner
Copy Link

@SLoeuillet commented on GitHub (Aug 1, 2024):

Hello

Nope, only Cloud Identity method is implemented.

The other method, using Admin API is "old school" and requires more privilèges (svc account with full domain délégation privileges)

@SLoeuillet commented on GitHub (Aug 1, 2024): Hello Nope, only Cloud Identity method is implemented. The other method, using Admin API is "old school" and requires more privilèges (svc account with full domain délégation privileges)
adam commented 2025-12-29 02:22:05 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Dec 26, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Dec 26, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 02:22:05 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Jan 2, 2025):

This issue was closed because it has been inactive for 14 days since being marked as stale.

@github-actions[bot] commented on GitHub (Jan 2, 2025): This issue was closed because it has been inactive for 14 days since being marked as stale.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label OIDC enhancement stale
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#686
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?