wiretastix

OIDC Integration

How Wiretastix uses OIDC/SSO authentication to drive automatic WireGuard tunnel provisioning and access control.

Wiretastix’s most powerful feature is its seamless single sign-on (SSO) integration with OpenID Connect (OIDC) Identity Providers (IdP). This integration transforms Wiretastix into a dynamic, user-centric VPN management system, where user authentication, tunnel provisioning, and access control are driven by your existing OIDC/SSO infrastructure.

Role of the OIDC IdP

The OIDC IdP serves as the central authority for user authentication and identity management. Wiretastix delegates user authentication entirely to the IdP. When a user attempts to access the Wiretastix web interface, they are redirected to the OIDC IdP for login. Upon successful authentication, the IdP provides Wiretastix with an OIDC token containing user identity information and claims, including group memberships.

User Self-Provisioning

Once authenticated via OIDC, users can access the Wiretastix web interface to self-provision their WireGuard tunnels. This eliminates the need for manual administrator intervention for each new client. Users can generate their own WireGuard configurations, which are automatically assigned IP addresses and integrated into the WireGuard server.

Continuous Token Refresh and Tunnel Management

Wiretastix continuously monitors the OIDC token’s validity. It automatically refreshes the token with the IdP to maintain active sessions. More critically, Wiretastix uses the OIDC token’s information to manage the state of provisioned tunnels:

  • User Removal: If a user is removed from the OIDC IdP, or their access is revoked, Wiretastix detects this change during token refresh and automatically disables or removes their associated WireGuard tunnels.
  • Group Changes: If a user’s group memberships change within the OIDC IdP, Wiretastix re-syncs its internal group associations both at the next login and at the next periodic token refresh (reauthenticate_every), and rebuilds the nftables firewall rules whenever the group list actually changed – not just the database bookkeeping. This depends on the IdP reissuing an id_token with fresh group claims on the refresh call, though; not every provider does that on every refresh_token grant. If yours doesn’t, group changes take effect at the user’s next full login rather than mid-session.

Fine-Grained Access Control with OIDC Groups

Wiretastix leverages OIDC group claims to provision fine-grained access rules for each user. Administrators can define network rules that are tied to specific OIDC groups. For example:

  • Users in the developers OIDC group might have access to development servers.
  • Users in the marketing OIDC group might have restricted internet access.

When a user authenticates, Wiretastix retrieves their OIDC group memberships. It then dynamically applies the corresponding nftables firewall rules, ensuring that each user’s WireGuard tunnel adheres to the network policies defined for their OIDC groups. This provides a powerful and automated way to manage network segmentation and security based on your organizational identity structure.

This deep integration with OIDC makes Wiretastix an ideal solution for organizations looking to extend their existing identity management systems to their VPN infrastructure, providing a secure, scalable, and easily manageable WireGuard deployment.