`tsidp` - Tailscale OpenID Connect (OIDC) Identity Provider

tsidp is an OIDC Identity Provider (IdP) server that integrates with your Tailscale network. It allows you to use Tailscale identities for authentication in applications that support OpenID Connect, enabling single sign-on (SSO) capabilities within your tailnet.

Prerequisites

A Tailscale network (tailnet) with magicDNS and HTTPS enabled
A Tailscale authentication key from your tailnet
Docker installed on your system

Installation using Docker

Build the Docker Image

The Dockerfile uses a multi-stage build process to:

Build the tsidp binary from source
Create a minimal Alpine-based image with just the necessary components

# Clone the Tailscale repository
git clone https://github.com/tailscale/tailscale.git
cd tailscale

# Build the Docker image
docker build -t tsidp:latest -f cmd/tsidp/Dockerfile .

Run the Container

Replace YOUR_TAILSCALE_AUTHKEY with your Tailscale authentication key.

docker run -d \
  --name `tsidp` \
  -p 443:443 \
  -e TS_AUTHKEY=YOUR_TAILSCALE_AUTHKEY \
  -e TS_HOSTNAME=tsidp \
  -v tsidp-data:/var/lib/tsidp \
  tsidp:latest

Verify Installation
```
docker logs tsidp
```
Visit https://tsidp.tailnet.ts.net to confirm the service is running.

Usage Example: Proxmox Integration

Here's how to configure Proxmox to use tsidp for authentication:

In Proxmox, navigate to Datacenter > Realms > Add OpenID Connect Server
Configure the following settings:
- Issuer URL: https://idp.velociraptor.ts.net
- Realm: tailscale (or your preferred name)
- Client ID: unused
- Client Key: unused
- Default: true
- Autocreate users: true
- Username claim: email
Set up user permissions:
- Go to Datacenter > Permissions > Groups
- Create a new group (e.g., "tsadmins")
- Click Permissions in the sidebar
- Add Group Permission
- Set Path to / for full admin access or scope as needed
- Set the group and role
- Add Tailscale-authenticated users to the group

Configuration Options

The tsidp server supports several command-line flags:

--verbose: Enable verbose logging
--port: Port to listen on (default: 443)
--local-port: Allow requests from localhost
--use-local-tailscaled: Use local tailscaled instead of tsnet
--dir: tsnet state directory

Environment Variables

TS_AUTHKEY: Your Tailscale authentication key (required)
TS_HOSTNAME: Hostname for the tsidp server (default: "idp")
TS_STATE_DIR: State directory (default: "/var/lib/tsidp")
TAILSCALE_USE_WIP_CODE: Enable work-in-progress code (default: "1")

Support

This is an experimental, work in progress feature. For issues or questions, file issues on the GitHub repository

License

BSD-3-Clause License. See LICENSE for details.

README.md

tsidp - Tailscale OpenID Connect (OIDC) Identity Provider