I’m testing OpenZiti 2.0.1 with Authentik as the external OIDC identity provider.
I authenticated successfully through Authentik and established an OpenZiti session. I then deactivated the corresponding user account in Authentik while leaving the existing OpenZiti session active.
OpenZiti continues to permit access using that existing session. I tested again after more than 72 hours, and access was still permitted.
Is this the expected behavior?
I understand that Authentik is involved during authentication and that an already-issued OpenZiti session may remain valid independently afterward. However, I would expect disabling the account in the authoritative IdP to result in access being revoked within a reasonably short period.
Centralized identity management is an important part of a Zero Trust approach. If an identity is disabled in the authoritative IdP, I would expect that change to propagate to systems relying on that identity so that access can be revoked consistently rather than continuing indefinitely under an existing session.
Is there currently a mechanism in OpenZiti 2.0.1 to detect that the Authentik account has been disabled and terminate or invalidate existing sessions? If not, is the recommended approach to rely on relatively short OpenZiti session/token lifetimes and require periodic reauthentication against Authentik?