#sso

Tailscale can integrate with identity providers that support OpenID Connect (OIDC). The steps provided in this topic are required only for initial creation of a tailnet. After the signup process is completed, Tailscale will work like any other supported identity provider. For more information about OIDC, refer to Welcome to OpenID Connect.

Tailscale requires a properly configured WebFinger endpoint at .well-known/webfinger on the domain used for your email. Set this up according to your web server or application specifications.

"Google and Yahoo! (and likely Microsoft to follow) are ultimately competing with one another to become the branded single sign-on solution for the web. The good news for users is that by using the same underlying technology, most relying parties will able to turn on support for any new OpenID provider fairly easily. The bad news for users is that since none of the major providers are also relying parties, using services at each of these site still requires multiple accounts. Further, a sign in box with 100 different logos for 100 different providers isn’t a great user experience."

Food for thought. Note the number of pro users.