# A spurious error message on controller with ext-jwt-signer?

**URL:** <https://openziti.discourse.group/t/a-spurious-error-message-on-controller-with-ext-jwt-signer/3245>\
**Category:** Support\
**Created:** [October 13, 2024, 2:29am UTC](https://openziti.discourse.group/t/a-spurious-error-message-on-controller-with-ext-jwt-signer/3245 "2024-10-13T02:29:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![plakdawa](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/plakdawa/32/2119_2.png) [@plakdawa](https://openziti.discourse.group/u/plakdawa)\
**Post date:** [October 13, 2024, 2:29am UTC](https://openziti.discourse.group/t/a-spurious-error-message-on-controller-with-ext-jwt-signer/3245/1 "2024-10-13T02:29:49Z")

</div>

I am currently experimenting with ext-jwt-signer setup. I am seeing what appears to be a spurious error message in the controller log when authenticating an identity. Seeing the same message against both Auth0 and Oracle IDCS as JWT signers:

```auto
curl -s -X POST -H "Accept: application/json" \
    --cert pki/certs/2faclient.cert \
    --key pki/keys/2faclient.key \
    --cacert pki/certs/2faclient.pem \
    -H "Authorization: Bearer $(cat etc/mytoken.tok)" \
    https://localhost:8441/edge/client/v1/authenticate?method=ext-jwt | jq -r '.data.token' > etc/2faclient.tok

[15.170] ERROR ziti/controller/env.(*AppEnv).getJwtTokenFromRequest: {error=[token is unverifiable: error while executing keyfunc: key for kid SIGNING_KEY, not found]} error during JWT parsing during API request

```

The auth appears to succeed. The `etc/2faclient.tok` contains the session token. A subsequent command against `/edge/client/v1/current-api-session` shows an empty list in the `authQueries` attribute. A further lookup of `/edge/client/v1/services` also shows the service that the client is authorized for by policy.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [October 13, 2024, 2:47am UTC](https://openziti.discourse.group/t/a-spurious-error-message-on-controller-with-ext-jwt-signer/3245/2 "2024-10-13T02:47:02Z")

</div>

Yeah, I believe @andrew.martinez resolved that issue recently. If you're not running the latest controller, you might try upgrading to the latest to see if that error goes away. As you mention, it was indeed spurious and didn't affect the authentication flow.

---

<div class="post-metadata">

**Author:** ![plakdawa](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/plakdawa/32/2119_2.png) [@plakdawa](https://openziti.discourse.group/u/plakdawa)\
**Post date:** [October 13, 2024, 3:14am UTC](https://openziti.discourse.group/t/a-spurious-error-message-on-controller-with-ext-jwt-signer/3245/3 "2024-10-13T03:14:28Z")

</div>

Thank you @TheLumberjack .  
Yes I am currently using v1.1.7 (since newer versions broke glibc compatibility on my Linux distro). I will pull up my bootstraps and retest 🙂

---

<div class="post-metadata">

**Author:** ![plakdawa](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/plakdawa/32/2119_2.png) [@plakdawa](https://openziti.discourse.group/u/plakdawa)\
**Post date:** [October 14, 2024, 2:49am UTC](https://openziti.discourse.group/t/a-spurious-error-message-on-controller-with-ext-jwt-signer/3245/4 "2024-10-14T02:49:21Z")

</div>

Confirming that the error is not observed with ziti v1.1.11.

A pleasant surprise that the glibc issue is also not seen and I can continue to work with OracleLinux8 🙂