March 2023 Summaries

Tailscale's March newsletter highlights the company's recent developments, including the introduction of custom OpenID Connect (OIDC) support, which enables users to log in using their preferred identity provider, and the beta release of Tailscale Funnel, a tool that lets users share a web server on their private tailnet with the public internet. The newsletter also discusses efforts to streamline user onboarding with invitations and admin approvals, and announces two significant in-person events in San Francisco: the RSA Conference 2023 and Tailscale Up, the first-ever Tailscale community conference. Additionally, it showcases community contributions that leverage Tailscale for various applications, such as connecting virtual machines, facilitating device communication, and enhancing Elixir node connectivity. The company emphasizes its growth and hiring opportunities while inviting feedback and contributions to its learning library, which covers topics like cloud access security brokers (CASBs), security information and event management (SIEM), and SOC 2 compliance.

Tailscale Funnel, now available in beta, allows users to share a web server on their private tailnet with the public internet by providing a DNS name tied to their node, which becomes publicly accessible when enabled. This tool securely forwards public internet requests to the user’s service via a Tailscale tunnel without Tailscale seeing decrypted packets, as all connections require TLS encryption with certificates automatically provisioned. Improvements since the alpha release include enhanced DNS handling, optimized CLI commands for better user experience, and the separation of Funnel into its own command. Users can easily enable Funnel by pointing Tailscale to their local server and using simple commands to turn it on or off. The update process for public DNS records has been streamlined, and the system now efficiently routes requests to the nearest ingress server. The beta phase welcomes user feedback and insights into how Funnel is being utilized, aligning with Tailscale's commitment to user privacy and secure connectivity.

Tailscale has introduced features to simplify the onboarding process for teams using its service by allowing new users with a company email address to automatically join the company's tailnet, streamlining deployment. To further facilitate onboarding, admins can invite new users and assign them roles before they join, ensuring they start with the appropriate permissions and responsibilities. Additionally, Tailscale offers a user approval feature that lets admins review and approve new users before they can join the tailnet, which is useful for organizations where only specific teams use Tailscale. This approval process can be managed via notifications through email or integrated services like Slack. The user approval feature is optional and can be enabled in the admin console, but is disabled by default.

Tailscale has introduced a beta feature allowing users to integrate any OpenID Connect (OIDC) compliant identity provider, expanding beyond the previously limited options like Google, Okta, GitHub, and Azure AD. This enhancement requires a WebFinger endpoint on the authentication domain for identity discovery and administrative verification. The blog humorously explores creating a non-compliant, mock identity provider to test the OIDC integration, emphasizing the complexities of implementing OAuth 2.0 and OIDC specifications. Despite the lighthearted approach, the authors caution against using a homemade IdP due to security concerns, recommending established solutions like Keycloak, Dex, or Ory for those who need to host their own IdP.