Configure external JWT signers and authentication policies for the first time, add services to access HTTP web applications, associate/update identities with authorization policies, all passed, and finally prompt 'now go to': https://brozac.icebear.com:8446 And see your brozac!, The login page for Auth0 is displayed. I used my registered Google email and obtained my identity. I logged in using Google to display a blank page and seemed to be constantly refreshing requests. I realized something was wrong and checked the controller，route， console, which displayed running. Then, I logged in to the controller and displayed Token，but Configure external JWT signers and authentication policies show error
ubuntu@ip-172-31-8-243:~$ ziti edge login -u $ZITI_USER -p $ZITI_PWD -y ${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS}:${ZITI_CTRL_EDGE_ADVERTISED_PORT}
Token: ac921eb6-8ad7-41c9-801c-7aa5bc9c33f5
Saving identity 'default' to /home/ubuntu/.config/ziti/ziti-cli.json
ubuntu@ip-172-31-8-243:~$ echo "configuring OpenZiti for BrowZer..."
ziti_object_prefix=browzer-auth0
issuer=$(curl -s ${ZITI_BROWZER_OIDC_URL}/.well-known/openid-configuration | jq -r .issuer)
jwks=$(curl -s ${ZITI_BROWZER_OIDC_URL}/.well-known/openid-configuration | jq -r .jwks_uri)
echo "OIDC issuer : $issuer"
echo "OIDC jwks url : $jwks"
ext_jwt_signer=$(ziti edge create ext-jwt-signer "${ziti_object_prefix}-ext-jwt-signer" "${issuer}" --jwks-endpoint "${jwks}" --audience "${ZITI_BROWZER_CLIENT_ID}" --claims-property email)
echo "ext jwt signer id: $ext_jwt_signer"
auth_policy=$(ziti edge create auth-policy "${ziti_object_prefix}-auth-policy" --primary-ext-jwt-allowed --primary-ext-jwt-allowed-signers ${ext_jwt_signer})
echo "auth policy id: $auth_policy"
configuring OpenZiti for BrowZer...
OIDC issuer : https://dev-yggpt78zzf84cx25.us.auth0.com/
OIDC jwks url : https://dev-yggpt78zzf84cx25.us.auth0.com/.well-known/jwks.json
error: COULD_NOT_VALIDATE - The supplied request contains an invalid document or no valid accept content were available, see cause: INVALID_FIELD - name [browzer-auth0-ext-jwt-signer] duplicate value 'browzer-auth0-ext-jwt-signer' in unique index on externalJwtSigners store
ext jwt signer id:
Error: flag needs an argument: --primary-ext-jwt-allowed-signers
Usage:
ziti edge create auth-policy [flags]
Flags:
-i, --cli-identity string Specify the saved identity you want the CLI to use when connect to the controller with
-h, --help help for auth-policy
-j, --output-json Output the full JSON response from the Ziti Edge Controller
--output-request-json Output the full JSON request to the Ziti Edge Controller
--primary-cert-allowed Enable certificate authentication
--primary-cert-expired-allowed Allow expired certificates
--primary-ext-jwt-allowed Allow external JWT authentication
--primary-ext-jwt-allowed-signers stringArray Allow specific JWT signers
--primary-updb-allowed Allow username/password db authentication
--primary-updb-lockout-min int Lockout duration minutes after max attempts, 0=forever
--primary-updb-max-attempts int Number of invalid authentication attempts, 0=unlimited
--primary-updb-min-length int Minimum password length (default 5)
--primary-updb-req-mixed-case Require mixed case in passwords
--primary-updb-req-numbers Require numbers in passwords
--primary-updb-req-special Require special characters in passwords
--secondary-req-ext-jwt-signer string JWT required on every request
--secondary-req-totp MFA TOTP enrollment required
-t, --tags stringToString Add tags to entity definition (default )
--tags-json string Add tags defined in JSON to entity definition
--timeout int Timeout for REST operations (specified in seconds) (default 5)
--verbose Enable verbose logging
flag needs an argument: --primary-ext-jwt-allowed-signers
auth policy id:
