3 ms·
I almost launched a zerotier alternative for business SSO only. I'm very excited by this. Quick question. Our use case is simple as are many businesses. We ha
by onphonenow 4y ago
I almost launched a zerotier alternative for business SSO only. I'm very excited by this. Quick question.
Our use case is simple as are many businesses.
We have users that authenticate using Google lets say. We want to give them remote desktop access from their home. They ARE NOT techies.
Ideally we could give them an SSO login (it sounds like this will make that possible). And then authorize them to connect to nodes Y and Q. We don't need "networks" at this level, just user A authorized to connect to node Y or node group 5 etc.
if we have users and user groups and nodes and node groups you can then basically do whatever a business is used to doing (this breakout is common in many smaller businesses using Active Directory, Google etc).
This seems boring but the competition is pretty poor. Sonicwall and friends with VPN setups are time consuming and pretty complex to manage and deploy. Anydesk and friends have just horrible business practices (try cancelling).
Cloudflare is getting there sort of with WARP, but it's also awkward and they keep moving their product positioning around.
Note - we happen to use some mikrotik for fun as well as sonicwall supported by our third party MSP - we've started to see zerotier show up on mikrotik which has been fun.
- anderiv 4y agoFWIW, Tailscale's ACL functionality[0] enables exactly this. [0] https://tailscale.com/kb/1018/acls/ https://tailscale.com/kb/1018/acls/
- simonjgreen 4y agoThe deficit in Tailscale ACLs (as I found while evaluating) is they can't make use of groups from your SSO supplier so you have to explicitly list users in there. I landed on Perimeter 81 as a useful alternative that does what we needed
- api 4y agoInteresting... this is also a defect in ZeroTier but thanks for the idea. :)
- onphonenow 4y agoHey thanks, this might be exactly what we are looking for. Somehow they never hit my radar when I was looking! User identity focused etc.
- lacrosse_tannin 4y agozerotier rules engine can do node x can connect to node y, or nodes in group x can all talk to node y, but not each other, etc...
- onphonenow 4y agoThe gui for this is not there. Biz users are used to clicking nodes, adding users to nodes (in traditional form these are lan subnets or computers). Even CLI oriented used to things like Node Group A ALLOW FROM User 1, 2, 3 I might not have spent enough time playing with it. EDIT: Edited to add another look at rules engine I see absolute ZERO mentions of users. How are folks doing my use case in rules? User logs into let's say two machines and phone. They should have access to Node X inside our firewall for RDP. Permissions are tied to user identity. I wasted enough time chasing folks saying this is easy before, please CONFIRM it is easy before telling me it is.