2023-05-21 16:37:59 +00:00
|
|
|
package types
|
|
|
|
|
|
|
|
import (
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 12:50:17 +00:00
|
|
|
"cmp"
|
2024-11-18 14:58:42 +00:00
|
|
|
"database/sql"
|
|
|
|
"net/mail"
|
2023-05-21 16:37:59 +00:00
|
|
|
"strconv"
|
|
|
|
|
|
|
|
v1 "github.com/juanfont/headscale/gen/go/headscale/v1"
|
|
|
|
"github.com/juanfont/headscale/hscontrol/util"
|
|
|
|
"google.golang.org/protobuf/types/known/timestamppb"
|
|
|
|
"gorm.io/gorm"
|
|
|
|
"tailscale.com/tailcfg"
|
|
|
|
)
|
|
|
|
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 12:50:17 +00:00
|
|
|
type UserID uint64
|
|
|
|
|
2023-05-21 16:37:59 +00:00
|
|
|
// User is the way Headscale implements the concept of users in Tailscale
|
|
|
|
//
|
|
|
|
// At the end of the day, users in Tailscale are some kind of 'bubbles' or users
|
|
|
|
// that contain our machines.
|
|
|
|
type User struct {
|
|
|
|
gorm.Model
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 12:50:17 +00:00
|
|
|
|
|
|
|
// Username for the user, is used if email is empty
|
|
|
|
// Should not be used, please use Username().
|
2023-05-21 16:37:59 +00:00
|
|
|
Name string `gorm:"unique"`
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 12:50:17 +00:00
|
|
|
|
|
|
|
// Typically the full name of the user
|
|
|
|
DisplayName string
|
|
|
|
|
|
|
|
// Email of the user
|
|
|
|
// Should not be used, please use Username().
|
|
|
|
Email string
|
|
|
|
|
|
|
|
// Unique identifier of the user from OIDC,
|
|
|
|
// comes from `sub` claim in the OIDC token
|
|
|
|
// and is used to lookup the user.
|
2024-11-18 14:58:42 +00:00
|
|
|
ProviderIdentifier sql.NullString `gorm:"index"`
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 12:50:17 +00:00
|
|
|
|
|
|
|
// Provider is the origin of the user account,
|
|
|
|
// same as RegistrationMethod, without authkey.
|
|
|
|
Provider string
|
|
|
|
|
|
|
|
ProfilePicURL string
|
|
|
|
}
|
|
|
|
|
|
|
|
// Username is the main way to get the username of a user,
|
|
|
|
// it will return the email if it exists, the name if it exists,
|
|
|
|
// the OIDCIdentifier if it exists, and the ID if nothing else exists.
|
|
|
|
// Email and OIDCIdentifier will be set when the user has headscale
|
|
|
|
// enabled with OIDC, which means that there is a domain involved which
|
|
|
|
// should be used throughout headscale, in information returned to the
|
|
|
|
// user and the Policy engine.
|
|
|
|
func (u *User) Username() string {
|
2024-11-18 14:58:42 +00:00
|
|
|
return cmp.Or(u.Email, u.Name, u.ProviderIdentifier.String, strconv.FormatUint(uint64(u.ID), 10))
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 12:50:17 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// DisplayNameOrUsername returns the DisplayName if it exists, otherwise
|
|
|
|
// it will return the Username.
|
|
|
|
func (u *User) DisplayNameOrUsername() string {
|
|
|
|
return cmp.Or(u.DisplayName, u.Username())
|
2023-05-21 16:37:59 +00:00
|
|
|
}
|
|
|
|
|
2024-09-21 10:05:36 +00:00
|
|
|
// TODO(kradalby): See if we can fill in Gravatar here.
|
2024-07-19 07:03:18 +00:00
|
|
|
func (u *User) profilePicURL() string {
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 12:50:17 +00:00
|
|
|
return u.ProfilePicURL
|
2024-07-19 07:03:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (u *User) TailscaleUser() *tailcfg.User {
|
2023-05-21 16:37:59 +00:00
|
|
|
user := tailcfg.User{
|
2024-07-19 07:03:18 +00:00
|
|
|
ID: tailcfg.UserID(u.ID),
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 12:50:17 +00:00
|
|
|
LoginName: u.Username(),
|
|
|
|
DisplayName: u.DisplayNameOrUsername(),
|
2024-07-19 07:03:18 +00:00
|
|
|
ProfilePicURL: u.profilePicURL(),
|
2023-05-21 16:37:59 +00:00
|
|
|
Logins: []tailcfg.LoginID{},
|
2024-07-19 07:03:18 +00:00
|
|
|
Created: u.CreatedAt,
|
2023-05-21 16:37:59 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return &user
|
|
|
|
}
|
|
|
|
|
2024-07-19 07:03:18 +00:00
|
|
|
func (u *User) TailscaleLogin() *tailcfg.Login {
|
2023-05-21 16:37:59 +00:00
|
|
|
login := tailcfg.Login{
|
2024-07-19 07:03:18 +00:00
|
|
|
ID: tailcfg.LoginID(u.ID),
|
|
|
|
// TODO(kradalby): this should reflect registration method.
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 12:50:17 +00:00
|
|
|
Provider: u.Provider,
|
|
|
|
LoginName: u.Username(),
|
|
|
|
DisplayName: u.DisplayNameOrUsername(),
|
2024-07-19 07:03:18 +00:00
|
|
|
ProfilePicURL: u.profilePicURL(),
|
2023-05-21 16:37:59 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return &login
|
|
|
|
}
|
|
|
|
|
2024-07-19 07:03:18 +00:00
|
|
|
func (u *User) TailscaleUserProfile() tailcfg.UserProfile {
|
|
|
|
return tailcfg.UserProfile{
|
|
|
|
ID: tailcfg.UserID(u.ID),
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 12:50:17 +00:00
|
|
|
LoginName: u.Username(),
|
|
|
|
DisplayName: u.DisplayNameOrUsername(),
|
2024-07-19 07:03:18 +00:00
|
|
|
ProfilePicURL: u.profilePicURL(),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-10-18 14:20:03 +00:00
|
|
|
func (u *User) Proto() *v1.User {
|
2023-05-21 16:37:59 +00:00
|
|
|
return &v1.User{
|
2024-10-18 14:20:03 +00:00
|
|
|
Id: strconv.FormatUint(uint64(u.ID), util.Base10),
|
|
|
|
Name: u.Name,
|
|
|
|
CreatedAt: timestamppb.New(u.CreatedAt),
|
|
|
|
DisplayName: u.DisplayName,
|
|
|
|
Email: u.Email,
|
2024-11-18 14:58:42 +00:00
|
|
|
ProviderId: u.ProviderIdentifier.String,
|
2024-10-18 14:20:03 +00:00
|
|
|
Provider: u.Provider,
|
|
|
|
ProfilePicUrl: u.ProfilePicURL,
|
2023-05-21 16:37:59 +00:00
|
|
|
}
|
|
|
|
}
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 12:50:17 +00:00
|
|
|
|
|
|
|
type OIDCClaims struct {
|
|
|
|
// Sub is the user's unique identifier at the provider.
|
|
|
|
Sub string `json:"sub"`
|
|
|
|
|
|
|
|
// Name is the user's full name.
|
|
|
|
Name string `json:"name,omitempty"`
|
|
|
|
Groups []string `json:"groups,omitempty"`
|
|
|
|
Email string `json:"email,omitempty"`
|
|
|
|
EmailVerified bool `json:"email_verified,omitempty"`
|
|
|
|
ProfilePictureURL string `json:"picture,omitempty"`
|
|
|
|
Username string `json:"preferred_username,omitempty"`
|
|
|
|
}
|
|
|
|
|
|
|
|
// FromClaim overrides a User from OIDC claims.
|
|
|
|
// All fields will be updated, except for the ID.
|
|
|
|
func (u *User) FromClaim(claims *OIDCClaims) {
|
2024-11-18 14:58:42 +00:00
|
|
|
err := util.CheckForFQDNRules(claims.Username)
|
|
|
|
if err == nil {
|
|
|
|
u.Name = claims.Username
|
|
|
|
}
|
|
|
|
|
|
|
|
if claims.EmailVerified {
|
|
|
|
_, err = mail.ParseAddress(claims.Email)
|
|
|
|
if err == nil {
|
|
|
|
u.Email = claims.Email
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
u.ProviderIdentifier.String = claims.Sub
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 12:50:17 +00:00
|
|
|
u.DisplayName = claims.Name
|
|
|
|
u.ProfilePicURL = claims.ProfilePictureURL
|
|
|
|
u.Provider = util.RegisterMethodOIDC
|
|
|
|
}
|