TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-08-20 01:47:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

cmd/tsidp: update oidc-funnel-clients.json store path

Browse Source 
Update odic-funnel-clients.json to take a path, this
allows setting the location of the file and prevents
it from landing in the root directory or users home directory.

Move setting of rootPath until after tsnet has started.
Previously this was added for the lazy creation of the
oidc-key.json. It's now needed earlier in the flow.

Updates #16734
Fixes #16844

Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
This commit is contained in:
Mike O'Driscoll
2025-08-12 14:40:09 -04:00
parent 23a0398136
commit 01379d7181
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
cmd/tsidp/tsidp.go
View File

@@ -142,8 +142,6 @@ func main() {
Hostname: *flagHostname,
Dir: *flagDir,
}
rootPath = ts.GetRootPath()
log.Printf("tsidp root path: %s", rootPath)
if *flagVerbose {
ts.Logf = log.Printf
}
@@ -168,6 +166,9 @@ func main() {
log.Fatal(err)
}
lns = append(lns, ln)
rootPath = ts.GetRootPath()
log.Printf("tsidp root path: %s", rootPath)
}
srv := &idpServer{
@@ -185,14 +186,15 @@ func main() {
// Load funnel clients from disk if they exist, regardless of whether funnel is enabled
// This ensures OIDC clients persist across restarts
f, err := os.Open(funnelClientsFile)
funnelClientsFilePath := filepath.Join(rootPath, funnelClientsFile)
f, err := os.Open(funnelClientsFilePath)
if err == nil {
if err := json.NewDecoder(f).Decode(&srv.funnelClients); err != nil {
log.Fatalf("could not parse %s: %v", funnelClientsFile, err)
log.Fatalf("could not parse %s: %v", funnelClientsFilePath, err)
}
f.Close()
} else if !errors.Is(err, os.ErrNotExist) {
log.Fatalf("could not open %s: %v", funnelClientsFile, err)
log.Fatalf("could not open %s: %v", funnelClientsFilePath, err)
}
log.Printf("Running tsidp at %s ...", srv.serverURL)
@@ -1147,7 +1149,8 @@ func (s *idpServer) storeFunnelClientsLocked() error {
if err := json.NewEncoder(&buf).Encode(s.funnelClients); err != nil {
return err
}
return os.WriteFile(funnelClientsFile, buf.Bytes(), 0600)
funnelClientsFilePath := filepath.Join(s.rootPath, funnelClientsFile)
return os.WriteFile(funnelClientsFilePath, buf.Bytes(), 0600)
}
const (