Roadmap

Not a new version of the old thing — a new one. New concept: the platform owns identity, devices and policy, and the protocol engines answer from that core instead of each keeping its own truth. New architecture: separate engines for TACACS+, RADIUS and 802.1X, one shared store, one policy table. New modules built around that core rather than bolted onto a daemon. And a new approach to shipping — containers, versioned releases, an upgrade path.

The name changed with the scope: TACACS+ was no longer the whole story.

Authentication is the kind of service where an outage is measured in people who can’t work. So Taranac learned to run as a cluster: PostgreSQL managed by Patroni with automatic leader election and failover, and a lightweight etcd witness so a two-node partition can’t split-brain.

Each node answers AAA from its own local replica, which is the part that matters — TACACS+, RADIUS and 802.1X keep serving straight through a primary crash, and writes resume on the new primary. An existing single node converts into a cluster in place.

It is also the one capability a licence gates. Everything else in the platform is unconditional, in every install.

One file instead of an afternoon. The OVA / qcow2 appliance imports into any hypervisor, walks a first-boot wizard on the console — hostname, network, timezone, a login password, then the address and the first administrator — and brings the whole stack up offline, from images already baked into the disk.

No registry is contacted at any point, which is what makes it usable in closed segments. Underneath it is the same bundle as a manual install, so the same ./taranac commands and the same upgrade path apply afterwards.

The directory integration was built for Active Directory, and only its code said so — bind by UPN, look accounts up by sAMAccountName, track them by objectGUID. A directory now has a type — Active Directory, OpenLDAP, FreeIPA, Google Workspace or generic — and the type supplies both what the protocol can do there and the schema guesses you are free to overwrite.

The same boundary kept falling. MS-CHAPv2 used to mean a domain join; it now also works against any directory that publishes the account’s NT hash — FreeIPA does — with no join and no winbind, and which mechanism a login takes is decided by the user’s own directory. Machines are imported from any directory that holds them, and an endpoint can be classified by where its machine sits: an LDAP DN, matched component-wise, or an LDAP group it belongs to. The release that removed the last domain requirement added the counterweight — console access is one decision for the whole installation, so a directory synchronised for AAA and NAC policy no longer hands every account it brings in a valid login to the management interface.

The platform stopped merely talking to devices and started knowing what they are. Device Profiling gives every endpoint a name from a profile tree — Any device › Computer › Windows › Laptop — together with how sure it is and one sentence saying why the name stops where it does. An endpoint group can classify on that name, so “everything under Computer › Windows” becomes a VLAN.

The name is only as good as what was heard, so the same release brought the sources that hear it. A passive DHCP Probe that never sends a byte; a scanner on the collector that listens first and asks quiet devices who they are only where you allow it; SNMP polling that asks network devices for their model, serial, ports, neighbours and forwarding table; and Web Probe, which asks your own script. The forwarding tables and neighbour tables also answer which switch port an endpoint is actually plugged into, and why.

What no rule explains lands on a worklist that can be handed to an AI assistant and brought back as a bundle you preview before anything changes. And a device type learned in one network can reach every installation between releases, through a signed rule-set exchange with taranac.pro.

Both layers of it are already collected. The NAC layer: every session records which endpoint sat on which device, on which port, in which VLAN. The SNMP layer: the neighbour and forwarding tables that show the backbone, the stacks and the devices that never authenticate to anything. What is missing is the picture.

What makes it ours isn’t the topology. It’s that every node and link carries an authorization verdict — authenticated and by what method, MAB bypass, rejected, never seen — so the map is coloured by trust. Click a node and you get its configuration history, its sessions, its profile and its neighbours in one place. A topology tool can’t do that; it has no idea who anyone is.

SNMP polling answers what a device is on each pass. Two things it doesn’t do yet. Traps arriving as alerts, so the picture updates on events rather than on the next poll. And lifecycle dates behind the serial numbers it already collects — end of sale, end of support — so a report can say which hardware is running out of road before it does.