Google auth but you can run your OIDC provider if you're into that: https://tailscale.com/kb/1240/sso-custom-oidc.