Creating identites programatically and best practices for hiding .jwt on mobile devices

1

My use case is where there is a Flutter or Kotlin frontend and a Python FasAPI or other backend.
I want users of the frontend to be issued a Ziti identity after they register, are verified as a trusted user (might ask them to upload a scan of their identification) and attempt to log in for the first time.
Thus, I'd want to have an endpoint on the backend that sends back a Ziti identity securely on https plus some other encryption (can you suggest any?) to the frontend. The backend I want to be able to make a call to Net Foundry cloud to have an identity issued for a service and for that identity to be registered for it.

How would I do this?

Screenshot (for my second question below):

image
image1463×781 35.7 KB

That is the id I downloaded from Net Foundry and uploaded to my Android device sitting in my Documents/Ziti folder.
That's for the Kotlin weather app example.
I know in Flutter there is secure storage but I thought I recalled for the Ziti Edge app's documentation it said something along the lines of "Just put the identity anywhere and the app will find it. " Is this true and if so is it safe?
Also where are the identities stored if I scan the QR code?

2

I'd get that working first and layer on a second for of encryption later. The .jwt that's returned is very short-lived so for my money, https is "fine" since once you consume it, it's useless anyway... I personally probably wouldn't bother with another encryption.

This is true and 'safe' for the same reason stated above wrt transferring the jwt. Once it's consumed/enrolled that file is utterly useless. On mobile devices, the devices use application storage and/or the app's keychain for storing sensitive files so that's probably what you are wondering there?

3

From References - I try to open the Identity API page: NetFoundry Identity Service Guide

but it's full of error messages:

image
image1724×919 230 KB

so I can't read any of the documentation hence I asked here on how to do the identity issuing programatically.

4

sure enough. i'll mention it to the team and see if we can get that fixed. thx for pointing it out

1 Like
5

Is the workaround to write Python code that executes Linux commands to issue identities?

6

The open api spec might be available? I don't know tbh. I can try to ask someone to find it and have them share it. You could then read the schema to understand the invocations. You could use python if you like, sure.

@tburtchell - is the schema for the nfconsole APIs somewhere to share since the doc is having trouble?