(feel free to close if you consider this feature request "out of scope")
What?
Allow aliases/sub-profiles for users
Why?
As an user of an application, I sometimes need multiple accounts/identities in a system. This might be due to different reasons, either different permission levels (restricted user & administrator) or scopes (personal/professional) or even totally different reasons ("public" identity vs. "author" identity). It would be quite a hassle to switch Tailscale logins/users on each of those content switches.
How?
When configured for a user, on the default login flow, tsidp doesn't redirect directly to a target system, but shows an alias selection screen.
In the most basic implementation, a custom "sub-account" string could be appended to the relevant fields (similar to mail sub-addressing, RFC 5233). As an example, for a "sub-account" named admin, the fields could be:
| Field |
Main account |
Sub account |
email |
user@github.tailnet.ts.net |
user+admin@github.tailnet.ts.net |
sub |
userid:1234567890 |
userid:1234567890+admin |
preferred_username |
user |
user+admin |
Additional considerations
There are some open issues around configuration/persistence I'm not that familiar with. If we go forward with this feature, I would need some guidance on how to design/implement those parts. For my personal usecase, a static configuration would be fine (inside the grant configuration?) - The administrator would configure which users have which sub-accounts. Other usecases might require dynamic configuration (users would be able to create/delete their own sub-accounts), but I would consider that out-of-scope for a first implementation.
I would be willing to spend some time implementing this feature, but my Go skills are quite basic, so it might take some time 😄
(feel free to close if you consider this feature request "out of scope")
What?
Allow aliases/sub-profiles for users
Why?
As an user of an application, I sometimes need multiple accounts/identities in a system. This might be due to different reasons, either different permission levels (restricted user & administrator) or scopes (personal/professional) or even totally different reasons ("public" identity vs. "author" identity). It would be quite a hassle to switch Tailscale logins/users on each of those content switches.
How?
When configured for a user, on the default login flow, tsidp doesn't redirect directly to a target system, but shows an alias selection screen.
In the most basic implementation, a custom "sub-account" string could be appended to the relevant fields (similar to mail sub-addressing, RFC 5233). As an example, for a "sub-account" named
admin, the fields could be:emailuser@github.tailnet.ts.netuser+admin@github.tailnet.ts.netsubuserid:1234567890userid:1234567890+adminpreferred_usernameuseruser+adminAdditional considerations
There are some open issues around configuration/persistence I'm not that familiar with. If we go forward with this feature, I would need some guidance on how to design/implement those parts. For my personal usecase, a static configuration would be fine (inside the grant configuration?) - The administrator would configure which users have which sub-accounts. Other usecases might require dynamic configuration (users would be able to create/delete their own sub-accounts), but I would consider that out-of-scope for a first implementation.
I would be willing to spend some time implementing this feature, but my Go skills are quite basic, so it might take some time 😄