A spurious error message on controller with ext-jwt-signer?

Support
1

I am currently experimenting with ext-jwt-signer setup. I am seeing what appears to be a spurious error message in the controller log when authenticating an identity. Seeing the same message against both Auth0 and Oracle IDCS as JWT signers:

curl -s -X POST -H "Accept: application/json" \
    --cert pki/certs/2faclient.cert \
    --key pki/keys/2faclient.key \
    --cacert pki/certs/2faclient.pem \
    -H "Authorization: Bearer $(cat etc/mytoken.tok)" \
    https://localhost:8441/edge/client/v1/authenticate?method=ext-jwt | jq -r '.data.token' > etc/2faclient.tok

[  15.170]   ERROR ziti/controller/env.(*AppEnv).getJwtTokenFromRequest: {error=[token is unverifiable: error while executing keyfunc: key for kid SIGNING_KEY, not found]} error during JWT parsing during API request

The auth appears to succeed. The etc/2faclient.tok contains the session token. A subsequent command against /edge/client/v1/current-api-session shows an empty list in the authQueries attribute. A further lookup of /edge/client/v1/services also shows the service that the client is authorized for by policy.

2

Yeah, I believe @andrew.martinez resolved that issue recently. If you're not running the latest controller, you might try upgrading to the latest to see if that error goes away. As you mention, it was indeed spurious and didn't affect the authentication flow.

3

Thank you @TheLumberjack .
Yes I am currently using v1.1.7 (since newer versions broke glibc compatibility on my Linux distro). I will pull up my bootstraps and retest :slight_smile:

4

Confirming that the error is not observed with ziti v1.1.11.

A pleasant surprise that the glibc issue is also not seen and I can continue to work with OracleLinux8 :slight_smile: