Domain Posture Check Failure

1

I'm running windows Edge Client 2.9.5 to access OpenZiti Overlay Network, it works well.

I try to create a Posture Check OS System Check, it works well.
I try to create a Posture Check with Domain check, BUT it doesn't work.

  1. This is my posture check config

https://controller.poc.net:1280/edge/management/v1/posture-checks/54qc5ku1XrCfKb1QNoy1cn
{
"name": "windows-domain-check",
"typeId": "DOMAIN",
"tags": {},
"domains": [
"apollo.workspace.poc.net"
]
}

  1. This is my dial policy
    {
    "name": "700644-legacy-sftp-dial",
    "appData": "",
    "serviceRoles": [
    "@3oUr7xpAPWVutdqWYjQVR6"
    ],
    "identityRoles": [
    "#700644-legacy-sftp-dial"
    ],
    "postureCheckRoles": [
    "@54qc5ku1XrCfKb1QNoy1cn"
    ],
    "semantic": "AnyOf",
    "type": "Dial",
    "tags": {}
    }

  2. The identity used to run the edge client has below env info
    "envInfo": {
    "arch": "x86_64",
    "domain": "apollo.workspace.poc.net",
    "hostname": "1bd4c6da001",
    "os": "MINGW32_NT-10.0",
    "osRelease": "10.0.26100",
    "osVersion": "Windows 11 Enterprise"
    },

  3. The error log from the edge client shows
    ERROR ziti-sdk:ziti_ctrl.c:504 ctrl_body_cb() ctrl[https://controller.poc.net:1280/\] API request[/sessions] failed code[INVALID_POSTURE] message[Posture response data is missing or wrong]
    WARN ziti-sdk:connect.c:476 connect_get_net_session_cb() conn2.80/z3XPalVQ/Connecting failed to get 'Dial' session for service[700644-legacy-sftp]: INVALID_POSTURE(Posture response data is missing or wrong)
    ERROR tunnel-cbs:ziti_tunnel_cbs.c:122 on_ziti_connect() ziti dial failed: failed posture check

Please advise what could be the issue here. The identity envinfo shows domain matchs Posture check domain, why here posture check was failed?

2

Hi experts,

Anyone can provide some advices here, throw some hints here. much appreciated!

3

Hey there cao,

Can you provide the following:

  • controller version
  • deployment model (single controller, multiple controllers)
  • logs showing the authentication portion from your client ( /authenticate or /oidc endpoints)
4

Thanks andrew.martinez for looking into this.

Here the the information.

  • OpenZiti: v1.6.13

  • Windows Edge Client:V2.9.5

  • Deploy Model:
    Single Controller and Single Router

Windows Edge Client Logs during Authentication (OIDC):

[2026-08-06T09:39:05.072Z] INFO ZitiDesktopEdge.Models.ZitiIdentity Identity: test_user updated To {"Name":"test_user","FingerPrint":"ida-enrollment","Identifier":"c:\windows\system32\config\systemprofile\appdata\roaming\netfoundry\ida-enrollment.json","Active":true,"Config":{"ztAPI":"https://controller.poc.net:1280/","id":null,"configTypes":null},"Status":null,"Services":[],"Metrics":{"TotalBytes":0,"Up":0,"Down":0},"ControllerVersion":"v1.6.13","MfaEnabled":false,"MfaNeeded":false,"MfaMinTimeout":-1,"MfaMaxTimeout":-1,"MfaMinTimeoutRem":-1,"MfaMaxTimeoutRem":-1,"MinTimeoutRemInSvcEvent":-1,"MaxTimeoutRemInSvcEvent":-1,"MfaLastUpdatedTime":"0001-01-01T00:00:00","NeedsExtAuth":true,"ExtAuthProviders":["IDA-DEV"]}
[2026-08-06T09:39:05.902Z] INFO ZitiDesktopEdge.Models.ZitiIdentity beginning external auth using url: " Home Realm Discovery "
[2026-08-06T09:39:19.493Z] INFO ZitiDesktopEdge.Models.ZitiIdentity Identity: test_user updated To {"Name":"test_user","FingerPrint":"ida-enrollment","Identifier":"c:\windows\system32\config\systemprofile\appdata\roaming\netfoundry\ida-enrollment.json","Active":true,"Config":{"ztAPI":"https://controller.poc.net:1280/","id":null,"configTypes":null},"Status":null,"Services":[],"Metrics":{"TotalBytes":0,"Up":0,"Down":0},"ControllerVersion":"v1.6.13","MfaEnabled":false,"MfaNeeded":false,"MfaMinTimeout":-1,"MfaMaxTimeout":-1,"MfaMinTimeoutRem":-1,"MfaMaxTimeoutRem":-1,"MinTimeoutRemInSvcEvent":-1,"MaxTimeoutRemInSvcEvent":-1,"MfaLastUpdatedTime":"0001-01-01T00:00:00","NeedsExtAuth":false,"ExtAuthProviders":["IDA-DEV"]}
[2026-08-06T09:39:21.691Z] INFO ZitiDesktopEdge.Models.ZitiIdentity Identity: test_user posture change. is a posture check failing: False
[2026-08-06T09:39:21.718Z] INFO ZitiDesktopEdge.Models.ZitiIdentity Identity: test_user posture change. is a posture check failing: False
[2026-08-06T09:39:21.718Z] INFO ZitiDesktopEdge.Models.ZitiIdentity Identity: test_user updated To {"Name":"test_user","FingerPrint":"ida-enrollment","Identifier":"c:\windows\system32\config\systemprofile\appdata\roaming\netfoundry\ida-enrollment.json","Active":true,"Config":{"ztAPI":"https://controller.poc.net:1280/","id":null,"configTypes":null},"Status":null,"Services":[{"Name":"700644-legacy-sftp","Protocols":["tcp"],"Addresses":[{"IsHost":true,"Hostname":"wh-13cd108dc1.svr.us.poc.net","IP":null,"Prefix":0}],"Ports":[{"High":2222,"Low":2222}],"OwnsIntercept":true,"AssignedIP":null,"PostureChecks":[{"IsPassing":true,"QueryType":"OS","Id":"6q8FejD31p4Of7uMC8kWn0"},{"IsPassing":false,"QueryType":"DOMAIN","Id":"54qc5ku1XrCfKb1QNoy1cn"},{"IsPassing":true,"QueryType":"PROCESS","Id":"2DwjeqOfiUb5q9DRdutVU3"}],"IsAccessible":false,"Timeout":-1,"TimeoutRemaining":-1,"Permissions":{"Bind":false,"Dial":true}}],"Metrics":{"TotalBytes":0,"Up":0,"Down":0},"ControllerVersion":"v1.6.13","MfaEnabled":false,"MfaNeeded":false,"MfaMinTimeout":-1,"MfaMaxTimeout":-1,"MfaMinTimeoutRem":-1,"MfaMaxTimeoutRem":-1,"MinTimeoutRemInSvcEvent":-1,"MaxTimeoutRemInSvcEvent":-1,"MfaLastUpdatedTime":"0001-01-01T00:00:00","NeedsExtAuth":false,"ExtAuthProviders":["IDA-DEV"]}
[2026-08-06T09:39:35.802Z] INFO ZitiDesktopEdge.MainMenu opening service logs at: \?\C:\Program Files (x86)\NetFoundry Inc\Ziti Desktop Edge\logs\service\ziti-tunneler.log.202608060000.log
[2026-08-06T09:39:36.207Z] INFO ZitiDesktopEdge.MainMenu showing service logs. file: \?\C:\Program Files (x86)\NetFoundry Inc\Ziti Desktop Edge\logs\service\ziti-tunneler.log.202608060000.log
[2026-08-06T09:47:57.102Z] INFO ZitiDesktopEdge.MainMenu opening UI logs at: \?\C:\Program Files (x86)\NetFoundry Inc\Ziti Desktop Edge\logs\UI\ZitiDesktopEdge.log
[2026-08-06T09:47:57.527Z] INFO ZitiDesktopEdge.MainMenu showing UI logs. file: \?\C:\Program Files (x86)\NetFoundry Inc\Ziti Desktop Edge\logs\UI\ZitiDesktopEdge.log

5

Adding Windows Version as well.

OS Name: Microsoft Windows 11 Enterprise
OS Version: 10.0.26100 N/A Build 26100

6

After read the source code, it turns out that this cloud be potential bug.

There are two different code path for the DOMAIN infomation and returns different value.

  • Identity envinfo.domain uses GetComputerNameExA, gives full FQDN apollo.workspace.poc.net
  • Posture Check Domain info uses NetGetJoinInformation,give short name apollo

I config the Posture Check from Identity's envinfo.domain which doesn't match Posture check domain. Change it to the short name apollo solve the issue.

I think this two code path need to be conslidated so that both return same consistent domain name.

Otherewise this behavior should be clearly documented in the Posture Check user guide, so that people can config the domain name correctly.