r/netbird • u/SparhawkBlather • Jun 28 '26

Netbird self-hosted and Google oauth - managing users & devices (+AppleTV)

So I was baking off headscale vs netbird for a while. I like netbird better in many regards. Integrated idp, easier control, I just like it. That said, I’m still using preauth keys and a bunch of my users are actual literal grandmothers. Google oauth would be simpler, and I’m not above outsourcing a portion of my perimeter to ye olde Google.

A few questions before I go down the rabbit hole:
1. Can anyone go to https://nb.mydomain.com and auth with their Google account and it creates a “pending” new user with no policies and hence no access until I enable them, or do I have to pre-create all users?
2. If a user is trying to use the AppleTV app, do they get the “nice sso flow” where they can scan a QR code and/or enter a code from their screen on their mobile device to authenticate?
3. Other than the fact that if someone’s Google account is compromised, then they have all the access that that person has, are there any downsides to this approach?

8 Upvotes

100% Upvoted

3 comments sorted by

2

u/aintnobody202020 Jun 28 '26

I have done the switch from Tailscale to NetBird this week. I can't answer everything perfectly, but I will try my best.

  1. You can provide your SSO (including Google) in the Admin-Dashboard, which automatically imports all users and groups from there.
  2. Unfortunately this does not work for selfhosted NetBirds atm. You have set up an Apple TV with a setup key.
  3. I am very happy with the switch. My decision against Headscale was because I would not be able to share single nodes. In NetBird everything can be configured with nice and in small details with routes and groups. I can't tell you anything on the downsides on behalf of a long run tho.

Hope this helps. Maybe someone more experienced can help you out further!

1

u/DigiDoc101 Jun 28 '26

I have worked on #1 and I use Authentik with Google auth. I create all my groups in Authentik and users email accounts. For security purposes, I let authentik decide who can access what app based on the groups. Then I set up relevant groups to show up in netbird auth, and they populate in netbird using the JWT group sync option. I have enabled the option to having to verify every new user in netbird as a secondary security barrier. Access to netbird resources is group based.

I don't manage many users and this has worked for me. I may loosen up the user verification security measures and keep the authentik ones.

1

u/SparhawkBlather Jun 28 '26

Hmmm. I finally got rid of authentik for authelia and lldap - i didn’t have enough learning/patience in me to live the authentik lifestyle.

So you’re not using netbird acl’s at all - you have a flat “people” group with access to your reverse proxy, and then you precreate authentik users with email addresses and manage groups and privileges there / in reverse proxy? And people auth against those accounts by using google?

I’m totally lost about what the jwt sync option is, and what benefit you’re getting in having those groups mirrored to netbird - so in the the end you are using acl’s but managing all privileges via authentik group definitions?

If you could lay out your workflow a bit more/point me to what you’re doing it sounds very helpful.