search

tailscale / tailscale

The easiest, most secure way to use WireGuard and 2FA.
https://tailscale.com
BSD 3-Clause "New" or "Revised" License
17.23k stars 1.31k forks source link

FR: SSH: ACL to support user as self even when on shared domain #12078

Open sloane-ts opened 1 month ago

sloane-ts commented 1 month ago

What are you trying to do?

User would like to be able to allow a specific group of users on the tailnet SSH access. The users are defined as under a specific domain, however, they have a GitHub org tailnet and are unable to use localpart:*@<domain> because it is a shared domain.

Example:

{
"action": "accept",
"src": ["group:platform"],
"dst": ["tag:prod"],
"users": ["localpart:*@xyz.org.github"]
}

Error: [ssh] symphonyfs.org.github is a shared domain and cannot be used in user:*@<domain> expressions

How should we solve this?

Something like autogroup:self, or a representation of self as the user.

What is the impact of not solving this?

The option left is to use autogroup:nonroot. This allows users to login to any machine as any user, and doesn't specify access based on the user's domain/username.

Anything else?

No response