Netskope: mark live in Hub, document console tag path, add setup screenshots
Cover Manage Tags via Settings → Devices, Hub create/link CA + policy flows, and embed the console and Hub screenshots.
f1bf7ff
Correct the MAC-rotation claim, add the reverse-proxy ingress option
The agent re-reads the MAC on the same cache as the IP and reports it on
the next score report, and the address object is named after the device
rather than its MAC, so a rotation updates the object instead of breaking
the key. Cost is a propagation window, not a failed match.
On-premise ingress can also be a reverse proxy, as done for self-hosted
Netbird, so present that alongside direct exposure and note that FortiGate
trusted hosts then has to allow the proxy.
b65e30a
Netskope: Linux device UID is readable, correct the no-Linux-support claim
The client writes nsdeviceid= to /opt/netskope/stagent/provisioning at
install time; verified against client 139.0.0.2721. Linux is supported
given a recent enough agent, so replace the hard exclusion with a version
caveat and correct the prerequisites table.
693243a
Netskope: note the Linux gap is ours to close, not a Netskope limit
Operators reading "Linux devices cannot be tagged" had no way to tell
whether Netskope refuses to tag them or EDAMAME cannot name them. It is
the latter, and it is fixable, so say so and point at the shape of the
fix rather than leaving it as a flat limitation.
Also narrows "Netskope's API" to "the tag endpoints", since the
inventory endpoints do expose MAC and serial.
7effa61
Document that overlay/endpoint integrations have no IP or MAC fallback
NetBird, Tailscale and Netskope address devices only by an identity the
vendor's own client issues. Saying a device without that identity is
'silently skipped' left it open whether EDAMAME falls back to the IP or
MAC it also holds. It does not, and cannot: an enforcement point that
keys on its own identifier has no way to resolve an address it never
issued.
Spell out the consequence per provider, since it differs and is never
neutral: omission from the NetBird group, active deauthorization from
the Tailscale tailnet, and denial by the allow-on-tag policy in
Netskope. All three fail towards denial, so a broken agent cannot leave
a device authorized.
4210b95
Add integration principles and architecture page
d157a41
Add Netskope setup guide
Netskope tags compliant devices rather than allow-listing them, so the guide
leads with the label-versus-enforce split and the Netskope-side policy chain
the customer has to build for the tag to mean anything.
Documents the constraints that are invisible from the Hub UI: Linux devices
cannot be tagged (no provisioning device UID), a device already at Netskope's
five-tag cap silently loses EDAMAME's tag, Base URL takes a bare hostname, and
the tag marks compliant devices so the policy must allow on its presence.
Marked as not yet available in the index, since the provider is not selectable
in Hub yet while the tenant-side steps can be prepared now.
b6db3c5
Correct the JSON configuration contract, add FortiGate guide, add navigation
The JSON configuration guide described a schema the trigger engine does not
accept. Corrected against the deserialisation types in
edamame-services/services-core/src/value_objects/access_control/config_file.rs
and the executors that consume them:
- rest and graphql inside add_action / delete_action are arrays, not single
objects. The documented shape panics on deserialisation. auth.rest stays a
single object, which is the one genuine asymmetry.
- The device identifier placeholder is ${ENV.user.deviceId}, not device_id.
An unrecognised attribute name silently interpolates an empty string.
- Documented the attributes that were missing entirely: ipv4, ipv6, username,
peerIds.<key>, and the six ${ENV.internal.*} whole-list placeholders.
- Documented the built-in "internal" action form and the bypass_error /
bypass_certificate flags, including why bypass_error hides real failures.
- Replaced the blanket "case-insensitive" claim on rest_type with the spellings
actually accepted.
New FortiGate guide. The integration has shipped and is offered in Hub, but had
no documentation. It is also the only MAC-based provider, so the L2 adjacency
requirement needed writing down.
NetBird and Tailscale guides gain the device-side prerequisites they were
missing: the provider's client must be installed and connected, and the agent
needs elevation to read the peer identity. Neither failure reports an error, so
without this a stalled rollout has no visible cause. The Tailscale guide also
now states up front that the integration acts on the entire tailnet and will
deauthorize non-compliant devices, including servers and CI runners.
Home was a one-line stub while being the wiki's landing page; it is now an index
with a provider-to-Hub-label mapping, since those names differ. Added _Sidebar
for navigation, and repointed Access-control-Documentation, which the Hub links
to directly, at the index instead of dead-ending.
1cf4e1e
Updated Setting Up GitHub for Access Control Integration (markdown)
56b7996
Created Setting Up Tailscale for Access Control Integration (markdown)
96e3d71
Updated Setting Up Netbird for Access Control Integration (markdown)
b6af9ac
Created Setting Up Netbird for Access Control Integration (markdown)
8149f53
Updated Setting Up Gitlab for Access Control Integration (markdown)
c15370d
Updated Setting Up Gitlab for Access Control Integration (markdown)
208c080
Updated Setting Up Gitlab for Access Control Integration (markdown)
0ec6e9a
Updated Setting Up Gitlab for Access Control Integration (markdown)
ff5eca7
Created Setting Up Gitlab for Access Control Integration (markdown)
eaaac83
Updated Conditional Access Control (using IP or MAC addresses) (markdown)
110d0b0
Updated Setting Up Google for Access Control Integration (markdown)
545d8e6
Updated Setting Up Google for Access Control Integration (markdown)
e6bdd55
Updated Setting Up Google for Access Control Integration (markdown)
0dcfc1f
Updated Setting Up Google for Access Control Integration (markdown)
4685ad2
Updated Setting Up Google for Access Control Integration (markdown)
b50a875
Updated Setting Up Google for Access Control Integration (markdown)
519c63b
Updated Setting Up Google for Access Control Integration (markdown)
dbe5d05
Updated Setting Up Google for Access Control Integration (markdown)
99f4d92
Updated Setting Up Azure for Access Control Integration (markdown)
e8f4cc5
Updated Setting Up Azure for Access Control Integration (markdown)
d7e187a