webnet/tailscale
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cmd/containerboot: allow for automatic ID token generation

Browse Source 
Allow for optionally specifying an audience for containerboot. This is
passed to tailscale up to allow for containerboot to use automatic ID
token generation for authentication.

Updates https://github.com/tailscale/corp/issues/34430

Signed-off-by: Mario Minardi <mario@tailscale.com>
This commit is contained in:
Mario Minardi
2026-01-13 17:30:57 -07:00
committed by Mario Minardi
parent 02af7c963c
commit e9d82767e5
4 changed files with 79 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/containerboot/settings_test.go
+34 -1
View File
@@ -117,6 +117,7 @@ func TestValidateAuthMethods(t *testing.T) {
clientID string
clientSecret string
idToken string
audience string
errContains string
}{
{
@@ -144,11 +145,21 @@ func TestValidateAuthMethods(t *testing.T) {
clientID: "client-id",
idToken: "id-token",
},
{
name: "wif_client_id_and_audience",
clientID: "client-id",
audience: "audience",
},
{
name: "id_token_without_client_id",
idToken: "id-token",
errContains: "TS_ID_TOKEN is set but TS_CLIENT_ID is not set",
},
{
name: "audience_without_client_id",
audience: "audience",
errContains: "TS_AUDIENCE is set but TS_CLIENT_ID is not set",
},
{
name: "authkey_with_client_secret",
authKey: "tskey-auth-xxx",
@@ -156,12 +167,19 @@ func TestValidateAuthMethods(t *testing.T) {
errContains: "TS_AUTHKEY cannot be used with",
},
{
name: "authkey_with_wif",
name: "authkey_with_id_token",
authKey: "tskey-auth-xxx",
clientID: "client-id",
idToken: "id-token",
errContains: "TS_AUTHKEY cannot be used with",
},
{
name: "authkey_with_audience",
authKey: "tskey-auth-xxx",
clientID: "client-id",
audience: "audience",
errContains: "TS_AUTHKEY cannot be used with",
},
{
name: "id_token_with_client_secret",
clientID: "client-id",
@@ -169,6 +187,20 @@ func TestValidateAuthMethods(t *testing.T) {
idToken: "id-token",
errContains: "TS_ID_TOKEN and TS_CLIENT_SECRET cannot both be set",
},
{
name: "id_token_with_audience",
clientID: "client-id",
idToken: "id-token",
audience: "audience",
errContains: "TS_ID_TOKEN and TS_AUDIENCE cannot both be set",
},
{
name: "audience_with_client_secret",
clientID: "client-id",
clientSecret: "tskey-client-xxx",
audience: "audience",
errContains: "TS_AUDIENCE and TS_CLIENT_SECRET cannot both be set",
},
}
for _, tt := range tests {
@@ -178,6 +210,7 @@ func TestValidateAuthMethods(t *testing.T) {
ClientID: tt.clientID,
ClientSecret: tt.clientSecret,
IDToken: tt.idToken,
Audience: tt.audience,
}
err := s.validate()
if tt.errContains != "" {