Hello all. I am doing some tests using Keycloak as an external JWT signer and I have a few questions:
Ziti Controller: 2.0.8 ZAC: 4.1.2
First, I want to understand how exactly the process of creating and Identity using external JWT works.
I have set up a signer:
{
"name": "keycloak-jwt",
"issuer": "XXXX",
"audience": "XXXX",
"jwksEndpoint": "XXXX",
"externalAuthUrl": XXXX,
"claimsProperty": "XXXX",
"useExternalId": true,
"enabled": true,
"certPem": "",
"kid": "",
"tags": {}
}
and an auth policy:
{
"name": "keycloak-jwt",
"primary": {
"cert": {
"allowed": false,
"allowExpiredCerts": false
},
"extJwt": {
"allowed": true,
"allowedSigners": [
"keycloak-jwt"
]
},
"updb": {
"allowed": false,
"lockoutDurationMinutes": 0,
"maxAttempts": 0
}
},
"secondary": {
"requireTotp": false,
"requireExtJwtSigner": ""
},
"tags": {}
}
With these in mind I have set up an Admin Identity which can be used to enter ZAC. But I am more interested in creating Identities that correspond to the other users (non-admin) from Keycloak.
I was able to create an identity which corresponds to a 'test' user with the following:
curl -k -sS
-X POST
"${ZITI_EDGE_CLIENT_URL}/edge/client/v1/enroll/token"
-H "Authorization: Bearer ${ZITI_JWT}"
-H "Content-Type: application/json"
--data-binary @token-enrollment-request.json
-o enrollment-response.json
-w '\nHTTP %{http_code}\n'
I also noticed that with the ziti binary I can do:
ziti edge create identity test -P keycloak-jwt --external-id "<sub-value-from-JWT>"
Which also creates the 'test' user. My question is what is the difference between these creation methods?
And also, in the second case, what does the Signer verify exactly? I noticed that I can also do, for example: ziti edge create identity test2 -P keycloak-jwt --external-id "<random-values>"
Even though I don't have a test2 user, the related Identity is created anyway. So what does the Signer do in this case exactly?
Finally I'd like to know, how may I activate this Identity for a Ziti Edge Tunnel? The idea is to utilize the JWT provided by Keycloak in order to register a device on my Ziti. I have seen that the JWT can be used for the Identity creation, but can it also be used for the enrollment of a ziti edge tunnel?
Any help would be appreciated.