Microsoft Entra

Okta is an identity provider and identity platform for employees, customers, and AI systems. In the cited use, its groups can be synchronized into a Tailscale tailnet so a gateway can use a user's group membership for access decisions. The Okta and Auth0 platforms provide authentication, secure access, and identity automation.

Dex is an open-source federated OpenID Connect provider developed under the Cloud Native Computing Foundation. It sits between applications and identity sources such as LDAP, SAML, GitHub, Google, GitLab, Microsoft, and other OIDC providers, exposing those sources through a standard OIDC interface so applications do not need separate authentication integrations. Dex is distributed as a single Go binary, container, or Kubernetes deployment, with configuration, clients, storage, and connectors defined in YAML; it includes a login UI and supports Kubernetes single sign-on and local development through a mock connector. In the cited NetBird setup, Dex handles local-user authentication in the background.

tsnet is an open-source Tailscale library for building applications that can join a tailnet. It lets those applications use the Tailscale network and see the identity of the caller on the other side of a connection. Aperture, Tailscale's AI gateway, uses tsnet for tailnet-based identity.

Tailtab is a browser extension and native host that gives each browser profile its own Tailscale node, allowing profiles to use different tailnets and exit nodes simultaneously. The extension communicates with a Go host through native messaging; the host embeds Tailscale's tsnet, becomes a tailnet node, and exposes an authenticated HTTP/SOCKS5 loopback proxy. Chromium uses a PAC script and Firefox applies equivalent per-request proxy rules, so tailnet traffic—including MagicDNS, tailnet domains, and routed private ranges—uses Tailtab while ordinary browsing bypasses it. Each profile has separate node keys and state, and the proxy uses a per-process credential to prevent other programs from borrowing the profile's identity. Tailtab also supports multiple Tailscale accounts, custom Headscale-compatible coordination servers, per-profile exit nodes, and tailnet machine search. It is distributed from the GitHub repository with release binaries and browser extension packages for Chromium-based browsers and Firefox/Zen; installation is currently manual, and the project describes itself as experimental. It is licensed under BSD-3-Clause.

Pocket ID is a self-hosted OpenID Connect and OAuth 2.0 identity provider that authenticates users with passkeys instead of passwords. It provides group-based access control, LDAP integration, SCIM provisioning, audit logs, a REST API for administration, and resource-specific OAuth tokens with configurable scopes. Applications and APIs can use Pocket ID for passwordless sign-in, while compatible AI applications and remote MCP servers can use it as an OAuth provider.