public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-10-23 23:06:49 +09:00
Code Issues Packages Projects Releases Wiki Activity
4,041 Commits 84 Branches 175 Tags
461a0e2bea8ce5caab91dca3c4d64d604aecf7a7
Commit Graph
2 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Fredrik Ekre 5d8a2c25ea OIDC: Query userinfo endpoint before verifying user
Build / build-nix (push) Has been cancelled
Build / build-cross (GOARCH=amd64 GOOS=darwin) (push) Has been cancelled
Build / build-cross (GOARCH=amd64 GOOS=linux) (push) Has been cancelled
Build / build-cross (GOARCH=arm64 GOOS=darwin) (push) Has been cancelled
Build / build-cross (GOARCH=arm64 GOOS=linux) (push) Has been cancelled
Check Generated Files / check-generated (push) Has been cancelled
Tests / test (push) Has been cancelled
Close inactive issues / close-issues (push) Has been cancelled 
This patch includes some changes to the OIDC integration in particular:
 - Make sure that userinfo claims are queried *before* comparing the
   user with the configured allowed groups, email and email domain.
 - Update user with group claim from the userinfo endpoint which is
   required for allowed groups to work correctly. This is essentially a
   continuation of #2545.
 - Let userinfo claims take precedence over id token claims.

With these changes I have verified that Headscale works as expected
together with Authelia without the documented escape hatch [0], i.e.
everything works even if the id token only contain the iss and sub
claims.

[0]: https://www.authelia.com/integration/openid-connect/headscale/#configuration-escape-hatch
 2025-08-11 17:51:16 +02:00
Fredrik Ekre 3f72ee9de8 Clarify SIGHUP log message (#2661) 2025-07-04 09:30:51 +02:00