How we built a lightweight identity provider using Tailscale's tools

tailscale/tsidp

A simple OIDC / OAuth Identity Provider (IdP) server for your tailnet.

Workload identity federation: better infra and CI/CD auth with Tailscale

Securely authenticate systems to Tailscale without managing long-lived API keys, auth keys, or OAuth clients.

Use grants with standard HTTP headers: Tailscale app capabilities

App capabilities help you build applications, in any language, with identity and capability awareness

Tailscale Services

Securely connect to and manage access to your internal resources using Tailscale Services.

Tailworm

The design choices of the open source tailscale and headscale software have created an environment ripe for risk, while marketing security as its design and purpose. Choices have been made to move away from security-in-depth, removing layers of authentication, and replacing daemons such as OpenSSH which employ privilege-separation with a highly-privileged process. Other findings include broader-than-advertised network security boundaries, which seems to be legitimate bugs, but the missing security and isolation is precisely what users are advertised by these tools.

Tailscale Funnel

Securely route internet traffic to local services using Tailscale Funnel.

Tailscale | Secure Connectivity for AI, IoT & Multi-Cloud

The connectivity platform for devs, IT, and security teams. Zero Trust identity-based access that deploys in minutes and scales to every resource. Start free.

The Tailscale node you mail to your parents

Securely connect to anything on the internet with Tailscale. Built on WireGuard®️, Tailscale enables you to make finely configurable connections, secured end-to-end according to zero trust principles, between any resources on any infrastructure.

Goodbye SSO Tax: How Tailscale Made SSO Free for Everyone

Tailscale eliminates the SSO tax, making all OIDC-compliant SSO identity providers free across every plan. Learn why security shouldn’t be a luxury and how this change aligns with Tailscale’s mission to build a secure internet for everyone.

Building AIP: An ATProtocol Authorization Gateway - Nick's Blog

OAuth is the first challenge developers face in the atmosphere. This post is about AIP, the authorization gateway we built at Graze Social to alleviate some of the pain.

Keycloak

Keycloak - the open source identity and access management solution. Add single-sign-on and authentication to applications and secure services with minimum effort.

Build a flexible AI stack with Aperture

Securely connect to anything on the internet with Tailscale. Built on WireGuard®️, Tailscale enables you to make finely configurable connections, secured end-to-end according to zero trust principles, between any resources on any infrastructure.

Building OAuth Authentication for Bluesky: A Complete Guide for Web and iOS Apps - Lost in Inference

How to implement secure, standards-compliant OAuth 2.1 + PKCE authentication for AT Protocol apps with separate web and mobile flows

OAuth Client Implementation | Bluesky

This is a guide to implementing atproto OAuth clients "The Hard Way." Optimistically, most developers will have an SDK available for their programming language which supports OAuth, and they can simply refer to SDK documentation. This guide is intended for early adopters, SDK maintainers, or developers with more sophisticated OAuth needs. It is agnostic to whether developers are building clients to work the the app.bsky microblogging Lexicons, or implementing novel application Lexicons.

Enterprise-Managed Authorization: Zero-touch OAuth for MCP

The Enterprise-Managed Authorization extension to the Model Context Protocol is now stable, enabling organizations to centrally provision MCP server access through their identity provider so users get connected servers on first login without per-app OAuth.