Auto load configFile either from File Path or Raw String

SDK Questions
1

I have a usecase where i need to encrypt the configFile with TPM or Yubikey; so decryption will happen at runtime. I need to pass in raw string to ziti.newConfigFromFile or zitiContext , not a file path.

My suggestion is that, can we have process automatically detect the input and it load it automatically, regardless if its a file path or raw string ? The process should be able to detect if its a config file based on contents.

On the screenshot below (right image), zitiContext can't recognize the input because it's not a file path.

image
image1862×491 122 KB

2

Note that, it would be okay to use filePath approach on the server on private network but when distributing the app to end users, there's a need to encrypt the certificate once enrolled.

3

Ziti's C# SDK (GitHub), correct? If so, mention "TheLumberjack" in this topic to page Clint.

4

Hi @ghostidentity, the .NET SDK wraps around the ziti-sdk-c. It has a function to allow loading an identity from a string/byte array but it's not working at the moment. I filed this issue for the c sdk
Ziti_load_context does not process the pointer as json · Issue #602 · openziti/ziti-sdk-c · GitHub.

I've filed this issue to expose a function in the .NET SDK that allows you to supply an in-memory representation (byte) `ZitiContext` should also take a stream/byte array · Issue #67 · openziti/ziti-sdk-csharp · GitHub

Once that bug is fixed in the C SDK, I'll make a new .NET Native nuget package, and a new .NET SDK with the function you can try out.

5

Ziti SDK allows you to use YubiKey as a hardware key (via PKCS#11 driver), that way the private key is not stored in the identity file, and, instead, the file just has a reference to the YubiKey slot.

This may remove the need to encrypt your identity file since it won't have sensitive data.

6

Possibly helpful: YubiKey by Yubico | OpenZiti

7

Thanks to @ekoby, a new, fixed C SDK was published and I was able to publish OpenZiti.NET.0.9.23355.37738. I updated the WeatherSample (which I use to test) with usage:

1 Like
8

thank you @ekoby and @TheLumberjack I was able to confirm that it works. Here's the video for confirmation: https://youtu.be/U8ugrSULOac . WinUI3 can't use TPM to persist key because of its sandbox limitation so I had to use yubikey. I'm excited to use vTPM on Google Cloud to protect the certificate on the server side and further integration.

@smilindave26 I will likely deploy the app on microsoft store where end user can simply install it easilly without the need to install other tools.

1 Like