How to integrate Tailscale with self-hosted Zitadal
reddit / selfhosted

----------------------------------------------------------------------
Eisai_Kurosawa · 2023-12-14 11:05

By doing this, You can use the official Tailscale VPN infrastructure
and clients without creating an account on
[tailscale.com](https://tailscale.com)

​

Disclaimer: I'm not a Pro for OIDC or Oauth, this guide worked for me,
but probably has a lot of space for improvement, and you are welcome
to give suggestions.

​

First, let's assume some basic information

You have a web server running at:

example.com

Your Zitadal running at:

login.example.com

Your admin account on Zitadal:

admin@example.com

​

​

Then, Create webfinger file point to your Zitadal server, this part
may be slightly tricky

1) Go to the root directory of your web server and create following
folders

\[your\_wwwroot\]\\.well-known\\webfinger

​

2) create webfinger.jsonjrd under webfinger folder

​

3) Edit webfinger.jsonjrd, assuming you want to add an account for
yourself and an account for your friends.

    {
      "subject": "acct:admin@example.com",
      "links": [
        {
          "rel": "http://openid.net/specs/connect/1.0/issuer",
          "href": "https://login.example.com"
        }
      ],
      "subject": "acct:friend@example.com",
      "links": [
        {
          "rel": "http://openid.net/specs/connect/1.0/issuer",
          "href": "https://login.example.com"
        }
      ]
    }

(You have to put every account that will use VPN in this file)

​

4) set the default document for this folder to webfinger.jsonjrd

​

5) **IMPORTANT** Set MIME for this folder. define ".jsonjrd" as
"application/jrd+json", if you don't do this, Tailscale will reject
your webfinger file.

You can easily find guides on Google for steps 4 and 5. Here is my
web.config file for IIS

















6) Verify your webfinger with Tailscale [https://login.tailscale.com/s
tart/oidc](https://login.tailscale.com/start/oidc)

Use your Zitadal account for the test, in this post is
[admin@example.com](mailto:admin@example.com)

​

If you don't encounter any error after clicking "Get OIDC Issuer" and
Tailscale is asking for a client ID, then you are good to go.

If you got 404, then probably check steps 1, 2, 3, 4

If you got 406, then is the MIME problem, check step 5

​

​

Last, create Tailscale application in Zitadal. This is the easy part.

1) Login to your Zitadal server with admin account

2) Create a new project "TailScale"

3) Create a new app "TailScale", with the following settings:

https://preview.redd.it/32h6xy6ss86c1.png?width=1851&format=png&auto=w
ebp&s=278b5f105534380693b714476101e977afaa4964

**IMPORTANT** Authentication method has to be set to "basic"

Redirect URL:

https://login.tailscale.com/a/oauth\_responsecancel

4) Copy your clientID and secret and go back to Tailscale [https://log
in.tailscale.com/start/oidc](https://login.tailscale.com/start/oidc)

5) Put in the information accordingly, and check consent, login,
select\_account.

6) Tailscale should transfer you to your Zitadal server for login,
after login, you will back to Tailscale and your network is already
created. ready to set up your first device.

​

​

Congrats, now you are ready to go. In the future, when you log in to
Tailscale, just use your Zitadal account and Tailscale will
automatically transfer you to your Zitadal server for login.

----------------------------------------------------------------------
thekrautboy · 2023-12-14 12:50

Thanks for sharing. But this seems like a lot of effort if the only
benefit is to "avoid creating a account". And i didnt have to create a
account for Tailscale anyway, instead using my Github account for it.

----------------------------------------------------------------------
chrishas35 · 2023-12-14 14:38

The benefit is single source for authentication by setting up more
services to use Zitadel.

----------------------------------------------------------------------
mrpink57 · 2023-12-14 19:07

I think someone could just use headscale with their OIDC and use
Zitadel also.