4 ms·

I'm very interested in Tailscale for both personal and business use-cases, but I'm rather put off by the stark centralization of offered identity providers: Mic

I'm very interested in Tailscale for both personal and business use-cases, but I'm rather put off by the stark centralization of offered identity providers: Microsoft, Github (Microsoft), Google, okta (?). What are the chances that Tailscale would offer authentication using decentralized/self-hosted identity providers like Ory ( https://www.ory.sh/ https://www.ory.sh/ )?

mdeeks 4y ago
They offer custom SSO providers using SAML or OIDC https://tailscale.com/kb/1119/sso-saml-oidc/ https://tailscale.com/kb/1119/sso-saml-oidc/ Unfortunately they are locked behind Enterprise pricing because of the extra help and debugging needed to get them working. Maybe at some point this will be offered standard though.
- grinich 4y ago
  Small plug for my startup (hope that's ok!) - if anyone else is looking for an easy way to set up SSO, you should check out the WorkOS Admin Portal feature[0]. It's essentially an onboarding wizard that works for any identity provider. This makes the SAML/OIDC configuration self-serve, which in turn allows you to easily provide SSO to anyone who wants it. The UI can also be branded with your logo/colors and run on your own custom domain. [0] https://workos.com/admin-portal https://workos.com/admin-portal
doublepg23 4y ago
There is also the self-hostable Headscale implementation.
- sandstrom 4y ago
  In case anyone is looking for the URL: https://github.com/juanfont/headscale https://github.com/juanfont/headscale 5k stars on Github, and lots of activity. Seems very interesting!
  - jsmith45 4y ago
    While not official, Tailscale themselves are not opposed to this project. They don't much contribute to it directly, but they have gone out of their way on a few occasions to avoid breaking it or to make it easier for headscale to implement some things (like the new encryption scheme for communicating with the control server). I imagine they don't see it as much of a business model threat, since it has no commercial support, requires having somebody your organization run and administer it, it is single tenant, not multi-tenant, so not really suitable for AWS to take and use to outcompete Tailscale proper, etc. The people most likely to use this are the ones too concerned about security to use the official (Tailscale-hosted hosted) control plane, or people/orgs that simply cannot reasonably afford Tailscale's pricing model. In either case, they were not really customers in the first place.
    - notatoad 4y ago
      obvious caveat that tailscale could, at any time, change this unofficial policy.
- stormbrew 4y ago
  Note before anyone gets too excited: doesn't work on iOS, and you have to sideload an app on Android, if you want to use it from a phone. These aren't problems for everyone but I think they should be front and center when suggesting it.

mdeeks 4y ago

They offer custom SSO providers using SAML or OIDC https://tailscale.com/kb/1119/sso-saml-oidc/ https://tailscale.com/kb/1119/sso-saml-oidc/ Unfortunately they are locked behind Enterprise pricing because of the extra help and debugging needed to get them working. Maybe at some point this will be offered standard though.

grinich 4y ago
Small plug for my startup (hope that's ok!) - if anyone else is looking for an easy way to set up SSO, you should check out the WorkOS Admin Portal feature[0]. It's essentially an onboarding wizard that works for any identity provider. This makes the SAML/OIDC configuration self-serve, which in turn allows you to easily provide SSO to anyone who wants it. The UI can also be branded with your logo/colors and run on your own custom domain. [0] https://workos.com/admin-portal https://workos.com/admin-portal

doublepg23 4y ago

There is also the self-hostable Headscale implementation.

sandstrom 4y ago
In case anyone is looking for the URL: https://github.com/juanfont/headscale https://github.com/juanfont/headscale 5k stars on Github, and lots of activity. Seems very interesting!
- jsmith45 4y ago
  While not official, Tailscale themselves are not opposed to this project. They don't much contribute to it directly, but they have gone out of their way on a few occasions to avoid breaking it or to make it easier for headscale to implement some things (like the new encryption scheme for communicating with the control server). I imagine they don't see it as much of a business model threat, since it has no commercial support, requires having somebody your organization run and administer it, it is single tenant, not multi-tenant, so not really suitable for AWS to take and use to outcompete Tailscale proper, etc. The people most likely to use this are the ones too concerned about security to use the official (Tailscale-hosted hosted) control plane, or people/orgs that simply cannot reasonably afford Tailscale's pricing model. In either case, they were not really customers in the first place.
  - notatoad 4y ago
    obvious caveat that tailscale could, at any time, change this unofficial policy.
stormbrew 4y ago
Note before anyone gets too excited: doesn't work on iOS, and you have to sideload an app on Android, if you want to use it from a phone. These aren't problems for everyone but I think they should be front and center when suggesting it.