starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Using OpenID Connect should prevent CLI creation of users #837

New Issue
Closed
opened 2025-12-29 02:24:40 +01:00 by adam · 3 comments
adam commented 2025-12-29 02:24:40 +01:00
Owner
Copy Link

Originally created by @kradalby on GitHub (Oct 18, 2024).

Use case

When running headscale with OIDC, users should not be able to created with the CLI.

Description

We should only support one user source at the time.

Contribution

  • I can write the design doc for this feature
  • I can contribute this feature

How can it be implemented?

No response

Originally created by @kradalby on GitHub (Oct 18, 2024). ### Use case When running headscale with OIDC, users should not be able to created with the CLI. ### Description We should only support one user source at the time. ### Contribution - [ ] I can write the design doc for this feature - [ ] I can contribute this feature ### How can it be implemented? _No response_
adam added the enhancementno-stale-botOIDC labels 2025-12-29 02:24:40 +01:00
adam closed this issue 2025-12-29 02:24:40 +01:00
adam commented 2025-12-29 02:24:40 +01:00
Author
Owner
Copy Link

@dmeremyanin commented on GitHub (Nov 22, 2024):

Here's my two cents:

The ability to create the initial admin user and a pre-auth key through the CLI, and then set up the subnet router using that pre-auth key, allows for a fully automated, Infrastructure-as-Code (IaC) approach to provisioning Headscale. Once the initial setup is complete, normal users can authenticate via OIDC.

If user creation through the CLI were disabled while OIDC is enabled, it would no longer be possible to fully automate the setup of Headscale with a Tailscale router using tools like Terraform / Ansible.

@dmeremyanin commented on GitHub (Nov 22, 2024): Here's my two cents: The ability to create the initial admin user and a pre-auth key through the CLI, and then set up the subnet router using that pre-auth key, allows for a fully automated, Infrastructure-as-Code (IaC) approach to provisioning Headscale. Once the initial setup is complete, normal users can authenticate via OIDC. If user creation through the CLI were disabled while OIDC is enabled, it would no longer be possible to fully automate the setup of Headscale with a Tailscale router using tools like Terraform / Ansible.
adam commented 2025-12-29 02:24:40 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Nov 23, 2024):

It is a good point, I do like that, I think that some of the new constraints I'm adding to the db to prevent various duplicate scenarios will allow us to not really need to lock this down. So we might be able to drop this.

@kradalby commented on GitHub (Nov 23, 2024): It is a good point, I do like that, I think that some of the new constraints I'm adding to the db to prevent various duplicate scenarios will allow us to not really need to lock this down. So we might be able to drop this.
adam commented 2025-12-29 02:24:40 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Dec 5, 2024):

Closing this as we might aswell allow both and the constraints should handle collisions

@kradalby commented on GitHub (Dec 5, 2024): Closing this as we might aswell allow both and the constraints should handle collisions
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label OIDC enhancement no-stale-bot
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#837
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?