2 ms·
Interesting. Authentication via IP could definitely simplify a lot of things. But how do you handle authorization/delegation for 3rd party access?
by anderspitman 7y ago
Interesting. Authentication via IP could definitely simplify a lot of things. But how do you handle authorization/delegation for 3rd party access?
- crawshaw 7y agoTailscale networks are private. The only way to access an IP is through a WireGuard tunnel. The only way to be in the WireGuard configuration file is to have linked your public key against your identity. Every packet has an identity attached.
- anderspitman 7y agoSo it sounds like Tailscale is designed for different use cases, ie providing access to 3rd party apps is outside the scope?
- typical182 7y agoProbably a dumb question, but how do you envision connecting something like a networked printer? Front it with a cheap device?
- crawshaw 7y agoI think that's the way to do it. Possibly a smart switch could do it.
- justinsaccount 7y ago> Every packet has an identity attached. So, this part is super interesting to me, but I'm curious on how you envision that working inside applications. For example, I have a tcp server that does ln, err := net.Listen("tcp", ":8080") conn, err := ln.Accept() How do I get the identity for the connection? conn.RemoteAddr() will give me the ip address, but how do I know what the metadata associated with the identity is? Same sort of idea for inbound http requests.. if I wanted to identify if a connection was from a user or an admin? As I understand it, much of beyond corp type implementations rely on client certs or Identity Aware Proxies that include the user metadata along with the request.
- gowld 7y agoAside, why would you write 'err' instead of '_' if you aren't using the result?
- justinsaccount 7y agoBecause hacker news is not a go compiler.