You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat: add OAuth client secret authentication support
- Add OAuth client secret authentication as alternative to traditional auth keys
- Update documentation with OAuth configuration and minor cleanup
- Upgrade to Golang 1.25.1 (required for upgraded tailscale dep for oauth support)
Signed-off-by: Arun Philip <[email protected]>
Copy file name to clipboardExpand all lines: README.md
+43-4Lines changed: 43 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -44,6 +44,7 @@ docker run -d \
44
44
-e TAILSCALE_USE_WIP_CODE=1 \
45
45
-e TS_STATE_DIR=/data \
46
46
-e TS_HOSTNAME=idp \
47
+
-e TS_AUTHKEY=YOUR_TAILSCALE_AUTHKEY \
47
48
-e TSIDP_ENABLE_STS=1 \
48
49
ghcr.io/tailscale/tsidp:latest
49
50
```
@@ -53,6 +54,31 @@ Visit `https://idp.yourtailnet.ts.net` to confirm the service is running.
53
54
> [!NOTE]
54
55
> If you're running tsidp for the first time it may take a few minutes for the TLS certificate to generate. You may not be able to access the service until the certificate is ready.
55
56
57
+
#### Using OAuth Client Secrets
58
+
59
+
As an alternative to traditional auth keys, you can use OAuth client secrets for authentication:
|`-dir <path>`| Directory path to save tsnet and tsidp state. Recommend to be set. |`""`|
123
149
|`-hostname <hostname>`| hostname on tailnet. Will become `<hostname>.your-tailnet.ts.net`|`idp`|
124
150
|`-port <port>`| Port to listen on |`443`|
@@ -142,9 +168,19 @@ The `tsidp-server` binary is configured through the CLI flags above. However, th
142
168
143
169
These environment variables are used when tsidp does not have any state information set in `-dir <path>`.
144
170
145
-
-`TS_AUTHKEY=<key>`: Key for registering a tsidp as a new node on your tailnet. If omitted a link will be printed to manually register.
171
+
> [!WARNING]
172
+
> **Serverless/Stateless Deployment**: tsidp requires persistent state storage to function properly in production. Without a persistent `-dir`, the service will re-register with Tailscale on every restart, lose dynamic OIDC client registrations, and invalidate user sessions. Serverless environments without persistent storage are not recommended for production use.
173
+
174
+
-`TS_AUTHKEY=<key>`: Key for registering a tsidp as a new node on your tailnet. If omitted (and no OAuth client secret is provided) a link will be printed to manually register.
146
175
-`TSNET_FORCE_LOGIN=1`: Force re-login of the node. Useful during development.
147
176
177
+
#### OAuth Configuration
178
+
179
+
For using OAuth client secrets instead of traditional auth keys (environment variables only, no CLI flags):
180
+
181
+
-`TS_OAUTH_CLIENT_SECRET=<secret>`: OAuth client secret (tskey-client-xxx) for authentication. Requires advertise tags.
182
+
-`TS_ADVERTISE_TAGS=<tags>`: Comma-separated advertise tags (e.g., "tag:tsidp,tag:server"). Required when using OAuth client secrets.
183
+
148
184
### Docker Environment Variables
149
185
150
186
The Docker image exposes the CLI flags through environment variables. If omitted the default values for the CLI flags will be used.
@@ -162,13 +198,16 @@ The Docker image exposes the CLI flags through environment variables. If omitted
|`TS_OAUTH_CLIENT_SECRET=<secret>`|_(env var only)_|
203
+
|`TS_ADVERTISE_TAGS=<tags>`|_(env var only)_|
165
204
166
205
## Application Configuration Guides (WIP)
167
206
168
207
tsidp can be used as IdP server for any application that supports custom OIDC providers.
169
208
170
209
> [!IMPORTANT]
171
-
> Note: If you'd like to use tsidp to login to a SaaS application outside of your tailnet rather than a self-hosted app inside of your tailnet, you'll need to run tsidp with `--funnel` enabled.
210
+
> Note: If you'd like to use tsidp to login to a SaaS application outside of your tailnet rather than a self-hosted app inside of your tailnet, you'll need to run tsidp with `-funnel` enabled.
slog.Error("cmd/tsidp is a work in progress and has not been security reviewed;\nits use requires TAILSCALE_USE_WIP_CODE=1 be set in the environment for now.")
63
67
os.Exit(1)
@@ -131,6 +135,25 @@ func main() {
131
135
Hostname: *flagHostname,
132
136
Dir: *flagDir,
133
137
}
138
+
139
+
// Configure OAuth client secret and advertise tags if provided via environment variables
140
+
ifoauthClientSecret!="" {
141
+
ifadvertiseTags=="" {
142
+
slog.Error("TS_ADVERTISE_TAGS must be specified when using TS_OAUTH_CLIENT_SECRET")
0 commit comments