tailscale/cmd at b34a2bdb229f6e5aebf5022d842bc6ba3a224082 - tailscale - Codinget Gitea

webnet/tailscale

Files

T

History

b34a2bdb22 cmd/tsidp: add groups claim to tsidp (#15127 )

* cmd/tsidp: add groups claim to tsidp

This feature adds support for a `groups` claim in tsidp using the grants
syntax:

```json
{
  "grants": [
    {
      "src": ["group:admins"],
      "dst": ["*"],
      "ip":  ["*"],
      "app": {
        "tailscale.com/cap/tsidp": [
          {
            "groups": ["admin"]
          }
        ]
      }
    },
    {
      "src": ["group:reader"],
      "dst": ["*"],
      "ip":  ["*"],
      "app": {
        "tailscale.com/cap/tsidp": [
          {
            "groups": ["reader"]
          }
        ]
      }
    }
  ]
}
```

For #10263

Signed-off-by: Cedric Kienzler <github@cedric-kienzler.de>

* cmd/tsidp: refactor cap/tsidp to allow extraClaims

This commit refactors the `capRule` struct to allow specifying arbitrary
extra claims:

```json
{
  "src": ["group:reader"],
  "dst": ["*"],
  "ip":  ["*"],
  "app": {
    "tailscale.com/cap/tsidp": [
      {
        "extraClaims": {
          "groups": ["reader"],
          "entitlements": ["read-stuff"],
        },
      }
    ]
  }
}
```

Overwriting pre-existing claims cannot be modified/overwritten.

Also adding more unit-testing

Signed-off-by: Cedric Kienzler <github@cedric-kienzler.de>

* Update cmd/tsidp/tsidp.go

Signed-off-by: cedi <cedi@users.noreply.github.com>

* Update cmd/tsidp/tsidp_test.go

Co-authored-by: Patrick O'Doherty <hello@patrickod.com>
Signed-off-by: Cedric Kienzler <cedi@users.noreply.github.com>

* Update cmd/tsidp/tsidp_test.go

Co-authored-by: Patrick O'Doherty <hello@patrickod.com>
Signed-off-by: Cedric Kienzler <cedi@users.noreply.github.com>

* Fix logical error in test case

Signed-off-by: Cedric Kienzler <github@cedric-kienzler.de>

* fix error printing for failed to unmarshal capability in tsidp

Signed-off-by: Cedric Kienzler <github@cedric-kienzler.de>

* clarify doc string for withExtraClaims

Signed-off-by: Cedric Kienzler <github@cedric-kienzler.de>

---------

Signed-off-by: Cedric Kienzler <github@cedric-kienzler.de>
Signed-off-by: cedi <cedi@users.noreply.github.com>
Signed-off-by: Cedric Kienzler <cedi@users.noreply.github.com>
Co-authored-by: Patrick O'Doherty <hello@patrickod.com>

2025-04-17 17:31:40 -07:00

..

all: fix golangci-lint errors

2025-01-07 13:05:37 -08:00

build-webclient

client/web: precompress assets

2023-12-07 20:57:31 -05:00

cmd/checkmetrics: add command for checking metrics against kb

2024-12-02 10:30:46 +01:00

cmd/cloner, cmd/viewer, util/codegen: add support for aliases of cloneable types

2024-08-23 15:43:40 -05:00

cmd/connector-gen: add helper tool for wide app connector configurations

2023-12-15 09:29:42 -08:00

cmd/{containerboot,k8s-operator},kube/kubetypes: unadvertise ingress services on shutdown (#15451 )

2025-04-09 10:11:15 +01:00

net/netmon: publish events to event bus

2025-04-16 10:10:45 -07:00

tsweb: split promvarz into an optional dependency

2025-03-18 16:57:04 -07:00

cmd/dist,release/dist: sign QNAP builds with a Google Cloud hosted key

2025-04-17 08:39:31 -05:00

cmd,tsnet,internal/client: create internal shim to deprecated control plane API

2025-02-18 10:23:04 -06:00

cmd/gitops-pusher: log error details when unable to fetch ACL ETag

2025-02-18 14:29:14 -06:00

cmd/hello: display native ipv4 (#15191 )

2025-03-04 08:47:35 -07:00

cmd/k8s-nameserver: fix AAAA record query response (#12412 )

2024-06-10 17:57:22 +01:00

cmd/k8s-operator: default ingress paths to '/' if not specified by user (#15706 )

2025-04-17 16:14:34 +01:00

cmd/mkmanifest, cmd/tailscale, cmd/tailscaled: remove Windows arm32 resources from OSS

2023-03-01 15:45:12 -07:00

go.mod: upgrade nfpm to v2 (#8786 )

2023-08-03 13:00:45 -07:00

version/mkversion: open-source version generation logic

2023-02-18 05:21:05 +00:00

cmd/nardump: support symlinks, add basic test

2025-04-07 19:24:51 -07:00

cmd/natc: cleanup unused state

2025-04-14 14:06:56 -07:00

all: use Go 1.22 range-over-int

2024-04-16 15:32:38 -07:00

tailcfg,all: add and use Node.IsTagged()

2023-03-13 08:44:25 -07:00

all: use new LocalAPI client package location

2025-02-05 14:41:42 -08:00

cmd/printdep: print correct toolchain URL

2023-02-11 17:57:36 +00:00

proxy-to-grafana

cmd/proxy-to-grafana: support setting Grafana role via grants

2025-03-18 07:26:04 +00:00

net/{netx,memnet},all: add netx.DialFunc, move memnet Network impl

2025-04-08 10:07:47 -07:00

all: update copyright and license headers

2023-01-27 15:36:29 -08:00

ssh-auth-none-demo

ssh,tempfork/gliderlabs/ssh: replace github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh

2025-01-31 16:36:39 -06:00

cmd/stunc: enforce read timeout deadline (#14309 )

2024-12-06 14:27:52 -05:00

all: unify some redundant testing.TB interface copies

2025-04-08 08:19:29 -07:00

cmd/stunstamp: add protocol context to timeout logs (#13422 )

2024-09-09 18:42:13 -07:00

sync-containers

all: adjust some build tags for plan9

2023-08-24 15:42:35 -07:00

cmd/systray: add cmd/systray back as a small client/systray wrapper

2025-01-06 16:49:34 -08:00

net/netmon: publish events to event bus

2025-04-16 10:10:45 -07:00

feature/taildrop: start moving Taildrop out of LocalBackend

2025-04-16 15:57:59 -07:00

all: use Go 1.22 range-over-int

2024-04-16 15:32:38 -07:00

cmd/testwrapper: print failed tests preventing retry (#15270 )

2025-03-13 14:21:29 +00:00

all: use new LocalAPI client package location

2025-02-05 14:41:42 -08:00

all: update the tsd.System constructor name (#15372 )

2025-04-16 10:10:45 -07:00

cmd/tsidp: add groups claim to tsidp (#15127 )

2025-04-17 17:31:40 -07:00

all: update copyright and license headers

2023-01-27 15:36:29 -08:00

all: use new LocalAPI client package location

2025-02-05 14:41:42 -08:00

cmd/viewer,all: consistently use "read-only" instead of "readonly"

2025-01-14 08:26:56 -08:00

cmd/vnet: add wsproxy mode

2025-03-29 11:02:42 -07:00

tsweb: split promvarz into an optional dependency

2025-03-18 16:57:04 -07:00