# Confused about External JWT integration

**URL:** <https://openziti.discourse.group/t/confused-about-external-jwt-integration/3341>\
**Category:** Ziti Overlay\
**Created:** [October 30, 2024, 2:55pm UTC](https://openziti.discourse.group/t/confused-about-external-jwt-integration/3341 "2024-10-30T14:55:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![007bond007](https://avatars.discourse-cdn.com/v4/letter/0/3be4f8/32.png) [@007bond007](https://openziti.discourse.group/u/007bond007)\
**Post date:** [October 30, 2024, 2:55pm UTC](https://openziti.discourse.group/t/confused-about-external-jwt-integration/3341/1 "2024-10-30T14:55:53Z")

</div>

Hello, I've setup (using the host anywhere guide) and OpenZiti server and have successfully connected and managed to access a service. I've created an External JWT Signer (labeled "JWT Signer" in ZAC) in the ZAC which uses information from my create application in Authentik (Idp). I also saw this blog entry: [Zero Trust SSH with Multifactor Authentication](https://blog.openziti.io/multifactor-zero-trust-ssh) which gives me hope that I can have client Authentic with OIDC only for primary auth when they connect with the Android Ziti Mobile Edge app - however I still see a QR code/JWT file show up when I create a user and when trying to connect, no browser window opens on Android to authenticate me with my Idp. What could I be doing wrong?

On a side note... when I change services or apply an auth policy to a user, I noticed that "services" says 0 for all identities for a long time - restarting services or the app does not seem to help, I left it overnight and it worked again (until I made another change).

---

<div class="post-metadata">

**Author:** ![ekoby](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/ekoby/32/14_2.png) [@ekoby](https://openziti.discourse.group/u/ekoby)\
**Post date:** [October 30, 2024, 4:15pm UTC](https://openziti.discourse.group/t/confused-about-external-jwt-integration/3341/2 "2024-10-30T16:15:29Z")

</div>

External JWT auth support is coming to Android client soon. For now authentication is limited to cert/key

---

<div class="post-metadata">

**Author:** ![007bond007](https://avatars.discourse-cdn.com/v4/letter/0/3be4f8/32.png) [@007bond007](https://openziti.discourse.group/u/007bond007)\
**Post date:** [October 31, 2024, 1:42pm UTC](https://openziti.discourse.group/t/confused-about-external-jwt-integration/3341/3 "2024-10-31T13:42:13Z")

</div>

Thankyou for the confirmation. Do the other clients support this, such as Windows and Linux? This feature would make it far easier for users to use OpenZiti from a user perspective.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [October 31, 2024, 1:51pm UTC](https://openziti.discourse.group/t/confused-about-external-jwt-integration/3341/4 "2024-10-31T13:51:27Z")

</div>

We are in the midst of adding support for the functionality to all tunnelers. it's not supported yet, but it's actively being worked on.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [October 31, 2024, 1:52pm UTC](https://openziti.discourse.group/t/confused-about-external-jwt-integration/3341/5 "2024-10-31T13:52:56Z")

</div>

> [@007bond007](#):
>
> This feature would make it far easier for users to use OpenZiti from a user perspective.

I'm not sure I understand this sentiment. The user is given a jwt, they 'enroll' or 'add' the jwt to the tunneler and they are done. That's "pretty easy" imo and passes the "can my mother do this" test (she's notoriously not a techincal person) 🙂

Could you expand on what you mean?