feat(headscale): pin OIDC PKCE to S256 explicitly

Make pkce.method: S256 explicit in config.yaml (alongside pkce.enabled: true)
and note the pocket-id client must have PKCE enabled too. Rebuild embedded
archive.
This commit is contained in:
2026-06-12 15:55:06 -05:00
parent 74b34550bc
commit 25f20037e9
2 changed files with 58 additions and 54 deletions
+3
View File
@@ -72,8 +72,11 @@ oidc:
- openid
- profile
- email
# PKCE protects the authorization-code exchange. Enabled with the S256
# challenge method -- make sure the pocket-id OIDC client also has PKCE on.
pkce:
enabled: true
method: S256
# Restrict who can register a node. Uncomment one or more.
# allowed_users:
# - alice@example.com
+55 -54
View File
@@ -327,57 +327,58 @@ EOF
# __ARCHIVE_BELOW__ marker is the embedded tar.gz payload (base64).
exit 0
__ARCHIVE_BELOW__
H4sIAAAAAAAAA+1a7W7jNhad334KwhmgE3Qky4njpB5k0WxidIJmZrz5QLsoFiot0TYRWVQpKh53
EGAfYp9wn2TPJSVZ8WQn+2M6bbG6CWKLH5fk5eW551KJVXQrtBepZaZy4a+XybPPLgFkOBg8C4ZB
//Cgbz+DoG/LIfuD4f6z/kH/cNgfDoOD/WdBfz8IDp6x4PNP5WMpcsM1Y88ODsMfVHInvsSYfyDZ
YQvB4zziiWCwRHTLPI9FPI7X7MX1xdUu+7rR4MU1l4n9ah2GGzlFaaSUjmXKjdK7nZ3ODrtWmUrU
fD3Cd8bqPixKpEhNzry/uBFGg8E+PdQDjI6Co8CqeKvYSVpMZY5KLUaPKMkzwW/Z6+vrSW8PU0iN
VgnLtDIqUslLliqDyjcXL6EsV4yzifqBRQueJCKdC7ZSRRKzqSYdZiGWPntdTeKrnJ1Mzlle6BmP
BMMUVgtuoKYaeSHNK2bQ1TBpWCJvBePpmino0a6r0HcyEr5dybvzs1MGa8iUVMUiEXNuRMyMYhmd
PePJmEHV88m70+/H1+dn4dm7Nyfnb312KeYyN9DJ68FprlqwmdQ55hCpbE0lZWUIRV9X33MRaYEJ
phjHF+md3+mkfAlL1sbudO5UUixFPuqwTakXc8OpxO7Q1hPMPJPzUadTrjCvq+gLY3LJ5xjClTz/
cHpydvb38Prku5G35/Ekk6m4t+1ouziedOjmZDvYGi3oOJoRK9JE5LmXG5VlIrZ1mdImdwMx5rHu
UQB/6W6e4U3kUVXJTqOsV8RZ15ZZh9knJ49lzuG+MYYyMmGn1uf/dnN+CiNqcSd0LkL40/t1qe8x
2WFZAidZqCTGPk2LOe3xTL6H1hc/epeCJ975BMuFlbFRWhXzxSe1iWVm4EkpXHZJ5xFOtsx3yRU8
kdJsWQLn0b5V0tg+ZwG/ZxcxkzhJPWGinrVro1Crum1je3v0d6ui3Ome+7SVcCKpVbqEd1VDvh6f
nF2dnlyMS58dse7zD9uF99WGnJy+GYdjFF3YdpvHskUsMpHGeajSSv8GGGqrYUKxNBJtqmMWolVi
Fm6b3PdoIaLbqo+BS43YT93TN2fdl6y7mgtDn94v7zz6XBiTjXq9/t6hH+CnP9oL+t+U6+51/1Eq
wTnCaDwZsf0grxTLpVAFdB9UJThxWmJH2H5ZYJ05zISWKh6xPrp2PlpVeWjq0t6mvmlMe4wCf+/I
Dx4/RJuD/dRBgj8ueRo7C1bNeQzDJ+sRkK1wZWaZzRre1bvjuqeLtPdwoEe80BnPX/Nl4vxws7Zm
VcMbt+DHDpXI6dZQT29u3b58QPPPv4W/d8j+rFKDw284xhP8rz/sH2z432EA/tfvgwa2/O8LyA6r
PYDNlN5mg47DnBRGeTLPC4Qxzi6EAUcap5FeZ4ZFQhvb8/k28IMVxVUk9SiS4lxBGQjJosG1KCCD
RIHoAMoo9FkS6D/C+LT4pZBgP2YhSY94zyPDFio3hH9MYRyr7ApU54OLWEvoYB+eNyJN5x6VH830
npUd0kjFgv2am5jNf5VZp8TGBhnYIqtlxypYAYyLjG0i/weKLj5NHDiFz6Uywqcp39fddtiFSude
Iu9AGlIlc9FbYZXzguu45rUlE3gFQ80sCUSwnPEiMQ01MiZ6IJfgpCC8aLNmsUq/MgwBD0bXKR5X
qV/3mCVFvggrVGRev64xmqc5sS1G028ssY4UJW4y4OHyQe1KSyPq6matW/F9p0JyIkwbzVdA3ch4
19XI3pWICuhas+6Sv/cQIY/3gQlDwMUrIHmUFLG4KqZnCluc5t1az4/eKUwGd/Gu15nw3mVEFXKq
6aYqT+Vstml7KWZCayS/E5XIaN1YRTd301Fagrd7q4VIvUgrhFFXstGBeSKE6ubawPUbC4MZMlgC
HoVvG9srvQTnx/bmqgxu5Jq/w/lvBOTfbIwn8H9wsD8A/u8h6x/uHRzuEf4P8NHi/xeQZv7f8AVK
kBzZtAFg0shyjLoVOFIvbiaT8WV49fbk+zGOPSd2iZMJkCkoTylStM0jBR66y7gWlIYX09xIU1D2
C+cH3U/U2lIwNl2Xj36+YDOtlhbjAEsUcaDUZrDszMJZLigZp6Td3g0gj9MiMsm6ZLpsrYqvUAym
msp03lgeDmAuY1HCpx08j7TMjO8SWgJvDXpIoJcjJQjD7TgRhh0XqULETD1igU0ZAndtsSTmGOXh
oy2+Cb4JOpj2/HJyylwc8CpwP5mcY21VNmpNYbH9VR35itzNGq6axogLUPRzva6f2enFOYxUr61O
DKjQoJnPblLi/HSB8DXiJt30MTkjS0HTiqPYTYnxeCkRIjBPnUWPr+QgQD5dteBJolaIITmhNXKQ
GU9y0enYMEYUPdPyDglreCvWYcbNYsQ+pvY92zosm/po2ulkWlAWbbOKuwHR7sAfDmj8Xj+gsiHG
ig/5CEQxGvG+CEaj3uAINTSjiFcJIuIuknuekOnPxpeTkTVlTS1APzJ4q4xsJVvyzGfj5VTEMTbC
Fjm/IMOvc6ZmM4RWMpkoQ2sq3E2OQubKbs4mvf3B4VGpM1n7HZyBjNbg1IxKkmE3ujIWY3C6Mn3y
at8rfSNLeCp8U83Xxy72SCdm2tswALIsMpafKNPhoGrgIDFZvR6pTOnK4pnlI2mEXG9vsOh0KOWa
crdhBlEThvslQRinedsvbnL/df/iqV93qBgAp+oQobCRT654EtL0bAKXKTAPu7E4F9QOTRIQLZw/
mc4oM3QxEv3Fe0P794bPaaPeXlm2SY5OdkmF8RnNPowtF2BTUV234LwUM7iRbZ+C2JEToDvRReCX
8Oc+S3iGxNgPkV6fX7wdX9cHfRebl9ptWdK4IT1US2kMN2Ifd0ULIqMa5zEkZ0xc52q77fDWH8pd
nydqirS0Tob7vv1pPNuLifp5bxgMR4PDIHB/cAb6n6hEoLWVeYYtGrEP99YduY4W5RIqz4GZNQ+B
pUrHrqy8vRzVt5bkXQs6Ue6EkeeTmTf3mA5WCWi2ri9TsXI3oeU9JjZq02slzQII5ICc3Vyeu4vj
T+FwT8mY7reSZIospUNPZEC6wQhdxi5nIZWGMg/5HRyFjkK9gzaX0U2o37p9tbtYX6vSLtPsQyDt
+O11iGaNenfVut3manx6CaegdgiDmahOOEGFjMsHpBSUeZVPNl+h83wbiS2sKOe9A6s6bspWC8Ui
nsJulZmtjzexXqUIepotEYR929nCtYhDgKBzvh07LgdaiW+RTy0zhzEPGs+1KrJG6xqNPBst8geN
K5eqW29rfa1WYMiIy266JbI2/IpCoMCJRQTHCCinK9Uy9UMku0byRyXcaosL7TyRJgQa94Ku/TkB
+a5PUB8i2Em9DolShJa41Eczp8t763kY2iqz/mkbIS4gVWKuMyP6bzfAt6eEygBcRwFt4qNjVGf9
9+Z2/4tYZlVu0m81xlPv/4LB5v3fXnBI/P9gOGz5/5eQHXZq3yK5t0T2ygaIlACgfXAcejfMynfD
LJPRbe6aFZklGojPkjAYTAeI/e9//dP9sokjVdXdTL6p+iP/Ygl/RaayuVICmgBYkGiIXQIBqqqT
iRUZaUogxdEibtxXNd4UgsWlFNJs3+YF1XZAO17kfhMpoWNsL6+Iujy8b3N4X8Jer8Io4J6clWE5
9zubG69jC9Lfbim3XMojMrRFkfJmIlHzq7HrPbJ4SS94HzCeY2rXnP5LQDAZkZFvAM+7jmV1ndGQ
EdI5g8tBU8m/tjX47M3N1TXZN5azGayHaGbTwm3D+Z0n5vLQMS3Ev6iZx+6fxjFfP+aTyqZw+lH+
9ZJCE/JsR4Rp3dDiaA+MC9BDkDSRDX5lMYjXRfOVdAx/NcjMEGsp4e75K5Ek3m2KyNhzJKZ8S1jG
YL+zxaGOKXpv78Vlg658ghPC4a3jspvzp+jhI28ct9ghHJZCeMYxsMuQoc0lhu7/C/zOQ3Z33PmY
yR0/9KRzemuHEzL/k4DbI1714N3icXnbU7+zP65e2f8paEwrrbTSSiuttNJKK6200korrbTSSiut
tNJKK6200korrbTSSiuttNJKK6200korrbTSSiut/F/IfwAcHflnAFAAAA==
H4sIAAAAAAAAA+1a627bRhbObz7FwA7QGA0pyhc5ZeBFvbbQGHUSre2gXRQLdkSOpIEpDjscWlGD
APsQ+4T7JPudGZKiFW/yJ01agCeBJc7lzMy5fmeoVCW3QvuJWhaqFMF6mT367BSCRoeHj8JRODw+
GtrPMBzadtDB4ejg0fBoeDwajkbh0cGjcHgQhkePWPj5t/IhVaXhmrFHR8fxTyq7E19izT8R7bKF
4GmZ8EwwSCK5Zb7PEp6ma/bk5vJ6j33bGfDkhsvMfrUGw42cojVRSqcy50bpPW/X22U3qlCZmq8j
fGesncOSTIrclMz/m1shOjw8oId2gehZ+Cy0LF4pdppXU1miU4voASZlIfgte3FzMxnsYwu50Spj
hVZGJSp7ynJl0Pny8imYlYpxNlE/sWTBs0zkc8FWqspSNtXEwyzEMmAvmk18U7LTyQUrKz3jiWDY
wmrBDdg0Ky+kec4MphomDcvkrWA8XzMFPtpNFfpOJiKwJ3l9cX7GIA2ZE6tUZGLOjUiZUawg3zO+
TBlYPZ68PvtxfHNxHp+/fnl68SpgV2IuSwOevF2c9qoFm0ldYg+JKtbUUnfGYPRt870UiRbYYI51
ApHfBZ6X8yUk2Qrb8+5UVi1FGXls0+qn3HBqsRraeoKYZ3IeeV59wrLtoi+MySWfYwnX8vjd2en5
+T/jm9MfIn/f51khc/HejiN1cTzp2O3JTrA9WpA7mohVeSbK0i+NKgqR2r5CaVO6hRjz2c6zEPay
s3mGNZFFNS27nbZBlRY7ts0azAEZeSpLDvNNsZSRGTuzNv+PNxdnEKIWd0KXIoY9vV3X/B6iXVZk
MJKFylLoaVrNSccz+RZcn/zsXwme+RcTHBdShqK0quaLj3ITy8LAknKY7JL8EUa2LPfIFHyR025Z
BuPRgWXSUZ+TQDCwh5hJeNJAmGRg5dpp1Kod21HvgP5uddSaHrhP2wkjklrlS1hXs+SL8en59dnp
5bi22YjtPH633fi+Ucjp2ctxPEbTpR23eaxHpKIQeVrGKm/4bwJDKzVsKJVGYkzjZjFGZWbh1OS+
JwuR3DZzDEwqYr/snL0833nKdlZzYejT/+21T58LY4poMBjuHwch/g2j/XD4XX3uwc6/aibwI6zG
s4gdhGXDWC6FqsD7qGmBx2kJjbCDusEac1wILVUasSGmeh+cqnaatnWw6e8K07pRGOw/C8KHnWjj
2J9yJNjjkuepk2AznKcQfLaOENkq12aWxaxjXYM7rge6ygf3F3rACp3wgjVfZs4ON2frdnWscSv8
2KUyOd1a6tPKbcfXDxj++VX4tVP2Z6U2OPyBa3wC/w1Hw6MN/jsOgf+GQ8DAHv99AdplrQWwmdLb
aNBhmNPKKF+WZYU0xtmlMMBI4zzR68KwRGhjZz7eDvxARWmTSX3KpPArMAMgWXSwFiVkgCgAHYQy
Sn0WBAYPID4tfqsk0I9ZSOIj3vLEsIUqDcU/prCOZXYNqPPOZawleLB3jzuZxnuPzg92+p7VE/JE
pYL9XpqUzX+XhVfHxg4Y2AKr9cQmWSEYVwXbZP53lF0C2jjiFD6XyoiAtvy+nbbLLlU+9zN5B9CQ
K1mKwQqnnFdcpy2urZHAcwhqZkEgkuWMV5npsJEpwQO5BCYF4MWYNUtV/o1hSHgQus7xuMqDdsYs
q8pF3ERF5g/bHqN5XhLaYrT9zhHbTFHHTYZ4uLzXu9LSiLa72+tO/N5rIjkBpg3na0TdxPg3zcr+
tUgq8FqznSV/6yNDnhwgJowQLp4jkidZlYrranquoOK83Gn5/OyfQWQwF/9mXQj/dUFQoaSenVyV
uZzNNmOvxExojeJ3ojKZrDun2CnddpSWwO3+aiFyP9EKadS1bHhgn0ihuns2YP3OwSCGApKAReHb
RvZKL4H5od5S1cmNTPMr+H8nIf9ha3wi/h+F4SHi/z6q/uPweLhP8f/waNTH/y9B3fq/YwtUIDmw
aRPApFPlGHUr4FJP3kwm46v4+tXpj2O4PSd0Cc9EkKmoTqlyjC0TBRy6x7gWVIZX09JIU1H1C+MH
3M/U2kIwNl3Xj0G5YDOtljbGISxRxgFTW8GycxvOSkHFOBXt9m4AdZwWicnWNdJla1V9g2Yg1Vzm
887x4IClTEUdPu3iZaJlYQJX0FLw1oCHFPRKlARxvJ0n4thzmSpGztQRC23JELpriyUhx6SMHxzx
Xfhd6GHb86vJGXN5wG+C++nkAmdrqlErChvbn7eZryrdrmGqeYq8AEa/tuf6lZ1dXkBI7dnawoAa
DYYF7E1OmJ8uEL5F3qSbPiZnJClwWnE0uy0xni4lUgT2qYvk4ZMchainmxE8y9QKOaSkaI0aZMaz
UnieTWME0Qst71CwxrdiHRfcLCL2IbQf2NFxPTTAUM8rtKAq2lYVd4cEu8NgdEjrD4YhtY2wVnrM
IwDFJOJDEUbR4PAZemhHCW8KRORdFPc8I9Gfj68mkRVlCy0APwpYq0xsJ1vyImDj5VSkKRRhm5xd
kODXJVOzGVIriUzUqTUX7iZHoXJlb84ng4PD42c1z2wdePCBgs7g2EQ1yLCKboTFGIyuLp/81vZq
2ygynovANPsNoMUB8cROBxsEQJJFxfILVTocUA0YJCWptyvVJV3dPLN4JE9Q6+0fLjyPSq4pdwoz
yJoQ3G8Z0jjt235xm/u/+kunQTuhQQCcumOkwk49ueJZTNuzBVyhgDysYuEXNA5DMgAt+J/MZ1QZ
uhyJ+eKtIf295HNS1KtrizbJ0EkuuTABo93HqcUCbCqa6xb4SzWDGdnxOYAdGQGmE1xE/BLBPGAZ
L1AYBzHK64vLV+Ob1tH3oLzcqmVJ68b00Byls1zEPpyKEQRGNfwxJmPM3ORG3XZ5aw+11ueZmqIs
bYvhYWD/dZ7txUT7vD8KR9HhcRi6P/CB4Uc6kWhtZ1lARRF7996aI9fJoj5CYzkQs+YxYqnSqWur
by+j9taSrGtBHuU8jCyfxLy5x3RhlQLN1vVlLlbuJrS+x4SiNrNW0iwQgVwgZ2+uLtzF8cfi8EDJ
lO63smyKKsWjJxIg3WDErmKXs5haY1nG/A6GQq7QatDWMrob6rduX60W22tV0jLtPkakHb+6iTGs
0++uWrfHXI/PrmAUNA5psBCNh1OokGn9gJKCKq/6ydYrHmH5yY9nY3uZDYE4UybJA3z+bgXv2zJF
vE0WPJ8LxCzn6E6QNPp6/2hkGW1uvJGeFiqlvL7kt+QaWmwpr6sf2CrKNF66nShbNhS3idgKYa1v
O+7RZuEr4TA0Wy0US3gO/TbmYH2xm5NUjuSs2RJgIbCTbVoRaYxg7Zxk18qHI6qK71H3LQsXC+8N
nmtVFZ3RbdT0bVYr7w1uTL8dvc31hVoByQM/uO3WGaBj/5SqBSILkAZWQDtd/dYlKjLuDYpUauGW
W1pp5zG0IcDNJ/R6glPC2QsoJcVIylKvY4I+sQVYbQgp6SVDo1jLzOrJDkL+QknH3GRGZYrVSGC9
mdoQYJ+FZGwPrtHEpK+NQXv6emSRdW38f9Qan3r/Gx5u3v/uh8dU/x2N+vrvi9AuO7NvEd1bQntl
h4yUIUEHwLj02wBW/zaAFTK5Ld2wqrBAE/hMUg4G0kXG/u9//u3+s4kD1c3dXLnp+jP/xxH+jkp1
c6WIKI2AjUJT7FFwpa62mFyRkKYU/DlGpJ37ys6bYqD4nCCNndu9oNwGNCeLMuhmIPAY28tLgq73
71tdHq3TyaCJ/cgnclbDsjLwNjeeJzb5fb/F3GJpn8DwFkQuu4Vki6/HbnZk8xC94L+HeE9oXHf7
T5HaSIiMbAN5cseh7B0nNC1K8jOYHDjV+HubQ8Bevrm+IfmmcjaD9IAS7LXAtuAC7xN7uW+YNnU+
aSHP3l/GMF88ZJPKlvD6Qfz9lFJ+yrhDj3RucHGwF8JF0AP4MIlDi64ZwPuy+5OEFPZqUJkDw9CF
yyBYiSzzb3MgjoEDsfVb4hrbBN4Whj4hVLSti6sODPxITQCDt4bL3lx8qjx44I3zVnUAgyVoVHAs
7G5IwM1dDLjflwTefXR/4n2I5E/uW9IFvbWFh8z/IsHtAau69275pL7ta3+zcdL8ZKOHhz311FNP
PfXUU0899dRTTz311FNPPfXUU0899dRTTz311FNPPfXUU0899dRTTz311FNPfyb6HzQ8btgAUAAA