Netskope: mark live in Hub, document console tag path, add setup screenshots
Cover Manage Tags via Settings → Devices, Hub create/link CA + policy flows, and embed the console and Hub screenshots.
Netskope: Linux device UID is readable, correct the no-Linux-support claim
The client writes nsdeviceid= to /opt/netskope/stagent/provisioning at
install time; verified against client 139.0.0.2721. Linux is supported
given a recent enough agent, so replace the hard exclusion with a version
caveat and correct the prerequisites table.
Document that overlay/endpoint integrations have no IP or MAC fallback
NetBird, Tailscale and Netskope address devices only by an identity the
vendor's own client issues. Saying a device without that identity is
'silently skipped' left it open whether EDAMAME falls back to the IP or
MAC it also holds. It does not, and cannot: an enforcement point that
keys on its own identifier has no way to resolve an address it never
issued.
Spell out the consequence per provider, since it differs and is never
neutral: omission from the NetBird group, active deauthorization from
the Tailscale tailnet, and denial by the allow-on-tag policy in
Netskope. All three fail towards denial, so a broken agent cannot leave
a device authorized.
Add integration principles and architecture page
Add Netskope setup guide
Netskope tags compliant devices rather than allow-listing them, so the guide
leads with the label-versus-enforce split and the Netskope-side policy chain
the customer has to build for the tag to mean anything.
Documents the constraints that are invisible from the Hub UI: Linux devices
cannot be tagged (no provisioning device UID), a device already at Netskope's
five-tag cap silently loses EDAMAME's tag, Base URL takes a bare hostname, and
the tag marks compliant devices so the policy must allow on its presence.
Marked as not yet available in the index, since the provider is not selectable
in Hub yet while the tenant-side steps can be prepared now.
Correct the JSON configuration contract, add FortiGate guide, add navigation
The JSON configuration guide described a schema the trigger engine does not
accept. Corrected against the deserialisation types in
edamame-services/services-core/src/value_objects/access_control/config_file.rs
and the executors that consume them:
- rest and graphql inside add_action / delete_action are arrays, not single
objects. The documented shape panics on deserialisation. auth.rest stays a
single object, which is the one genuine asymmetry.
- The device identifier placeholder is ${ENV.user.deviceId}, not device_id.
An unrecognised attribute name silently interpolates an empty string.
- Documented the attributes that were missing entirely: ipv4, ipv6, username,
peerIds.<key>, and the six ${ENV.internal.*} whole-list placeholders.
- Documented the built-in "internal" action form and the bypass_error /
bypass_certificate flags, including why bypass_error hides real failures.
- Replaced the blanket "case-insensitive" claim on rest_type with the spellings
actually accepted.
New FortiGate guide. The integration has shipped and is offered in Hub, but had
no documentation. It is also the only MAC-based provider, so the L2 adjacency
requirement needed writing down.
NetBird and Tailscale guides gain the device-side prerequisites they were
missing: the provider's client must be installed and connected, and the agent
needs elevation to read the peer identity. Neither failure reports an error, so
without this a stalled rollout has no visible cause. The Tailscale guide also
now states up front that the integration acts on the entire tailnet and will
deauthorize non-compliant devices, including servers and CI runners.
Home was a one-line stub while being the wiki's landing page; it is now an index
with a provider-to-Hub-label mapping, since those names differ. Added _Sidebar
for navigation, and repointed Access-control-Documentation, which the Hub links
to directly, at the index instead of dead-ending.