mirrors
/
tailscale
mirror of https://github.com/tailscale/tailscale.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ipnlocal: support setting authkey at login using syspolicy (#13061) 

Updates tailscale/corp#22120

Adds the ability to start the backend by reading an authkey stored in the syspolicy database (MDM). This is useful for devices that are provisioned in an unattended fashion.

Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
This commit is contained in:
Andrea Gottardo 2024-08-19 23:49:33 -07:00 committed by GitHub
parent 16bb541adb
commit 9d2b1820f1
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ipn/ipnlocal/local.go
View File

@ -1868,6 +1868,14 @@ func (b *LocalBackend) Start(opts ipn.Options) error {
opts.AuthKey = v opts.AuthKey = v
} }
if b.state != ipn.Running && b.conf == nil && opts.AuthKey == "" {
sysak, _ := syspolicy.GetString(syspolicy.AuthKey, "")
if sysak != "" {
b.logf("Start: setting opts.AuthKey by syspolicy, len=%v", len(sysak))
opts.AuthKey = strings.TrimSpace(sysak)
}
}
hostinfo := hostinfo.New() hostinfo := hostinfo.New()
applyConfigToHostinfo(hostinfo, b.conf) applyConfigToHostinfo(hostinfo, b.conf)
hostinfo.BackendLogID = b.backendLogID.String() hostinfo.BackendLogID = b.backendLogID.String()

4
util/syspolicy/policy_keys.go
View File

@ -94,6 +94,10 @@ const (
// organization. A button in the client UI provides easy access to this URL. // organization. A button in the client UI provides easy access to this URL.
ManagedByURL Key = "ManagedByURL" ManagedByURL Key = "ManagedByURL"
// AuthKey is an auth key that will be used to login whenever the backend starts. This can be used to
// automatically authenticate managed devices, without requiring user interaction.
AuthKey Key = "AuthKey"
// Keys with a string array value. // Keys with a string array value.
// AllowedSuggestedExitNodes's string array value is a list of exit node IDs that restricts which exit nodes are considered when generating suggestions for exit nodes. // AllowedSuggestedExitNodes's string array value is a list of exit node IDs that restricts which exit nodes are considered when generating suggestions for exit nodes.
AllowedSuggestedExitNodes Key = "AllowedSuggestedExitNodes" AllowedSuggestedExitNodes Key = "AllowedSuggestedExitNodes"