{"id":122,"date":"2023-12-14T21:19:39","date_gmt":"2023-12-15T04:19:39","guid":{"rendered":"https:\/\/eisaichen.com\/?p=122"},"modified":"2024-05-01T22:48:36","modified_gmt":"2024-05-02T05:48:36","slug":"how-to-integrate-tailscale-with-self-hosted-zitadal","status":"publish","type":"post","link":"https:\/\/eisaichen.com\/?p=122","title":{"rendered":"How to integrate Tailscale with self-hosted Zitadal"},"content":{"rendered":"\n

By doing this, You can use the official Tailscale VPN infrastructure and clients without creating an account on tailscale.com<\/a>
<\/p>\n\n\n\n


First, let’s assume some basic information<\/h2>\n\n\n\n

You have a web server running at:
example.com<\/kbd>
Your Zitadal running at:
login.example.com<\/kbd>
Your admin account on Zitadal:
admin@example.com<\/kbd><\/p>\n\n\n\n

<\/p>\n\n\n\n


Then, Create webfinger file point to your Zitadal server, this part may be slightly tricky.<\/h2>\n\n\n\n

1\uff09Go to the root directory of your web server and create the following folders
[your_wwwroot]\\.well-known\\webfinger<\/p>\n\n\n\n

2) Create “webfinger.jsonjrd” under “webfinger” folder<\/p>\n\n\n\n

3) Edit “webfinger.jsonjrd”, assuming you want to add an account for yourself and an account for your friends.<\/p>\n\n\n\n

{\n  \"subject\": \"acct:admin@example.com\",\n  \"links\": [\n    {\n      \"rel\": \"http:\/\/openid.net\/specs\/connect\/1.0\/issuer\",\n      \"href\": \"https:\/\/login.example.com\"\n    }\n  ],\n  \"subject\": \"acct:friend@example.com\",\n  \"links\": [\n    {\n      \"rel\": \"http:\/\/openid.net\/specs\/connect\/1.0\/issuer\",\n      \"href\": \"https:\/\/login.example.com\"\n    }\n  ]\n}<\/code><\/pre>\n\n\n\n
(You have to put every account that will use VPN in this file)<\/p>\n\n\n\n
4) Set the default document for this folder to “webfinger.jsonjrd”<\/p>\n\n\n\n
5) IMPORTANT<\/strong> Set MIME for this folder.
Define .jsonjrd<\/kbd> as application\/jrd+json<\/kbd>
If you don’t do this, Tailscale will reject your webfinger file.
(“application\/json” won’t work)<\/p>\n\n\n\n
You can easily find guides on Google for steps 4 and 5.
Here is my web.config file for IIS<\/p>\n\n\n\n
<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<configuration>\n    <system.webServer>\n        <defaultDocument enabled=\"true\">\n            <files>\n                <remove value=\"index.html\" \/>\n                <remove value=\"index.php\" \/>\n                <add value=\"webfinger.jsonjrd\" \/>\n            <\/files>\n        <\/defaultDocument>\n        <staticContent>\n            <mimeMap fileExtension=\".jsonjrd\" mimeType=\"application\/jrd+json\" \/>\n        <\/staticContent>\n    <\/system.webServer>\n<\/configuration><\/code><\/pre>\n\n\n\n
6) Verify your webfinger with Tailscale
https:\/\/login.tailscale.com\/start\/oidc<\/a>
Use your Zitadal account for the test, in this post is admin@example.com<\/p>\n\n\n\n