You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat: add OAuth client secret authentication support
- Add OAuth client secret authentication as alternative to traditional auth keys
- Update documentation with OAuth configuration and minor cleanup
- Upgrade to Golang 1.25.1 (required for upgraded tailscale dep for oauth support)
Signed-off-by: Arun Philip <[email protected]>
Copy file name to clipboardExpand all lines: README.md
+37-4Lines changed: 37 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -44,6 +44,7 @@ docker run -d \
44
44
-e TAILSCALE_USE_WIP_CODE=1 \
45
45
-e TS_STATE_DIR=/data \
46
46
-e TS_HOSTNAME=idp \
47
+
-e TS_AUTHKEY=YOUR_TAILSCALE_AUTHKEY \
47
48
-e TSIDP_ENABLE_STS=1 \
48
49
ghcr.io/tailscale/tsidp:latest
49
50
```
@@ -53,6 +54,32 @@ Visit `https://idp.yourtailnet.ts.net` to confirm the service is running.
53
54
> [!NOTE]
54
55
> If you're running tsidp for the first time it may take a few minutes for the TLS certificate to generate. You may not be able to access the service until the certificate is ready.
55
56
57
+
#### Using OAuth Client Secrets
58
+
59
+
As an alternative to traditional auth keys, you can use OAuth client secrets for authentication by passing them through `TS_AUTHKEY`:
60
+
61
+
```bash
62
+
# Run tsidp with OAuth client secret
63
+
docker run -d \
64
+
--name tsidp \
65
+
-p 443:443 \
66
+
-v tsidp-data:/data \
67
+
-e TAILSCALE_USE_WIP_CODE=1 \
68
+
-e TS_STATE_DIR=/data \
69
+
-e TS_HOSTNAME=idp \
70
+
-e TSIDP_ENABLE_STS=1 \
71
+
-e TS_AUTHKEY=tskey-client-xxxxxxxxxxxx \
72
+
-e TS_ADVERTISE_TAGS=tag:tsidp,tag:server \
73
+
ghcr.io/tailscale/tsidp:latest
74
+
```
75
+
76
+
> [!IMPORTANT]
77
+
> When using OAuth client secrets:
78
+
> - Pass the OAuth client secret through `TS_AUTHKEY` (same as regular auth keys)
79
+
> - Specify advertise tags using `TS_ADVERTISE_TAGS`
80
+
> - The OAuth client secret must start with `tskey-client-`
81
+
> - The tags must be properly configured in your Tailscale ACL policy
|`-dir <path>`| Directory path to save tsnet and tsidp state. Recommend to be set. |`""`|
123
150
|`-hostname <hostname>`| hostname on tailnet. Will become `<hostname>.your-tailnet.ts.net`|`idp`|
124
151
|`-port <port>`| Port to listen on |`443`|
@@ -142,7 +169,11 @@ The `tsidp-server` binary is configured through the CLI flags above. However, th
142
169
143
170
These environment variables are used when tsidp does not have any state information set in `-dir <path>`.
144
171
145
-
-`TS_AUTHKEY=<key>`: Key for registering a tsidp as a new node on your tailnet. If omitted a link will be printed to manually register.
172
+
> [!WARNING]
173
+
> **Serverless/Stateless Deployment**: tsidp requires persistent state storage to function properly in production. Without a persistent `-dir`, the service will re-register with Tailscale on every restart, lose dynamic OIDC client registrations, and invalidate user sessions. Serverless environments without persistent storage are not recommended for production use.
174
+
175
+
-`TS_AUTHKEY=<key>`: Key for registering a tsidp as a new node on your tailnet. Can be a traditional auth key or OAuth client secret (tskey-client-xxx). If omitted, a link will be printed to manually register.
176
+
-`TS_ADVERTISE_TAGS=<tags>`: Comma-separated advertise tags (e.g., "tag:tsidp,tag:server"). Optional, but recommended when using OAuth client secrets.
146
177
-`TSNET_FORCE_LOGIN=1`: Force re-login of the node. Useful during development.
147
178
148
179
### Docker Environment Variables
@@ -162,13 +193,15 @@ The Docker image exposes the CLI flags through environment variables. If omitted
tsidp can be used as IdP server for any application that supports custom OIDC providers.
169
202
170
203
> [!IMPORTANT]
171
-
> Note: If you'd like to use tsidp to login to a SaaS application outside of your tailnet rather than a self-hosted app inside of your tailnet, you'll need to run tsidp with `--funnel` enabled.
204
+
> Note: If you'd like to use tsidp to login to a SaaS application outside of your tailnet rather than a self-hosted app inside of your tailnet, you'll need to run tsidp with `-funnel` enabled.
Copy file name to clipboardExpand all lines: tsidp-server.go
+14Lines changed: 14 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -58,6 +58,7 @@ var (
58
58
funcmain() {
59
59
flag.Parse()
60
60
ctx:=context.Background()
61
+
61
62
if!envknob.UseWIPCode() {
62
63
slog.Error("cmd/tsidp is a work in progress and has not been security reviewed;\nits use requires TAILSCALE_USE_WIP_CODE=1 be set in the environment for now.")
0 commit comments