ConductorOne Docs

Tailscale integration

ConductorOne provides identity governance and just-in-time provisioning for Tailscale. Integrate your Tailscale instance with ConductorOne to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.

Overview

Tailscale is a VPN service that makes the devices and applications you own accessible anywhere in the world, securely and effortlessly.

Availability

✅ General availability. The Tailscale integration is available to all ConductorOne users.

Capabilities

  • Sync user identities from Tailscale to ConductorOne
  • Resources supported:
    • Tailscale Groups
    • Tailscale ACL Rules
    • Tailscale SSH Rules

Set up the Tailscale integration

A user with the Super Administrator role in ConductorOne must perform this task.

  1. In ConductorOne, open Administer and click Integrations > Tailscale.

  2. If this is your first Tailscale integration, the integration form opens automatically. Otherwise, click Add connector.

  3. Choose whether to add the new Tailscale connector to an existing application (and select the app of your choice) or to create a new application.

    Do you SSO into Tailscale using your identity provider (IdP)? If so, make sure to add the connector to the Tailscale app that was created automatically when you integrated your IdP with ConductorOne, rather than creating a new app.

  1. Set the integration owner for this connector. You can manage the integration yourself, or choose someone else from the list of ConductorOne users. Setting multiple integration owners is allowed.

    A Tailscale integration owner must have the following permissions:

    • Integration Administrator or Super Administrator role in ConductorOne
    • Admin role in Tailscale
  1. Click Create and add details.

Next steps

  • If you are the integration owner, proceed to Integrate your Tailscale instance for instructions on integrating Tailscale with ConductorOne.

  • If someone else is the integration owner, ConductorOne will notify them by email that their help is needed to complete the integration.

Integrate your Tailscale instance

A user with the Integration Administrator or Super Administrator role in ConductorOne and Admin role in Tailscale must perform this task.

Step 1: Generate a New API Key

  1. Log into Tailscale as an Admin user and click Settings.

  2. Click Keys.

  3. Click Generate API key. A Generated new key window opens showing the full value of the newly created key.

  4. Copy the API key.

Step 2: Add your Tailscale Credentials to ConductorOne

  1. In ConductorOne, open Administer and click Integrations > Tailscale.

  2. In the list of connectors, locate and click on the name of the connector with the Not connected label.

  3. Find the Settings area of the page and click Edit.

  4. Paste the API key you generated in Step 1 into the Tailscale API Key field.

  5. In the Tailnet field, enter the name of your Tailscale network.

    • You can find the name of your Tailnet in the top left corner of the Tailscale Admin Panel, next to the Tailscale logo.

  6. Click Save.

  7. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

That’s it! Your Tailscale instance is now integrated with ConductorOne.

Configure the Tailscale integration using Terraform

As an alternative to the integration process described above, you can use Terraform to configure the integration between Tailscale and ConductorOne.

See the ConductorOne Tailscale integration resource page in the ConductorOne Terraform registry for example usage and the full list of required and optional parameters.