# How do I get the json file in ntity\_file /path/to/ziti/identity1.json;?

**URL:** <https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732>\
**Category:** Uncategorized\
**Created:** [January 8, 2025, 6:14am UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732 "2025-01-08T06:14:27Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![roycyz](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/roycyz/32/2973_2.png) [@roycyz](https://openziti.discourse.group/u/roycyz)\
**Post date:** [January 8, 2025, 6:14am UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/1 "2025-01-08T06:14:27Z")

</div>

How do I get the json file in ntity\_file /path/to/ziti/identity1.json;? Is it obtained via ziti-edge-tunnel enroll --jwt http.client.jwt --identity http.client.json? But it is via source /dev/stdin \<\<\< “$(wget -qO- [https://get.openziti.io/ziti-cli-functions.sh](https://get.openziti.io/ziti-cli-functions.sh))”; expressInstall  
The openziti service installed with this command does not contain an app.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [January 8, 2025, 12:05pm UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/2 "2025-01-08T12:05:14Z")

</div>

Hi @roycyz, welcome to the community and to OpenZiti (and zrok/BrowZer)!

The referenced identity file is obtained by creating an identity in the OpenZiti controller and enrolling it. have a look at the doc for more info if you need it [Ziti Identities | OpenZiti](https://openziti.io/docs/learn/core-concepts/identities/overview). [Tunneling to NGINX Upstreams | OpenZiti](https://openziti.io/docs/reference/tunnelers/nginx/#create-identities) also links to a subsection of this doc.

The qiuckstarts (expressInstall) will deploy a controller and a router for you to use. They are necessary in order to create an identity and for it to be useful.

Hopefully that's enough information to get you going.

---

<div class="post-metadata">

**Author:** ![roycyz](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/roycyz/32/2973_2.png) [@roycyz](https://openziti.discourse.group/u/roycyz)\
**Post date:** [January 13, 2025, 7:29am UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/4 "2025-01-13T07:29:26Z")

</div>

Thank you for your reply, here is another question I would like to ask, what is the reason for the error reported here,

 ![5fe061a34a9ce8e4c19b5cb1e92a0ce4](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/e/e93dc8aff01b2b5414bc8e489d84ae84a65b3f64.jpeg)

the configuration file is as follows  
load\_module modules/ngx\_http\_ziti\_module.so;  
worker\_processes 1;

events {  
worker\_connections 1024;  
}

thread\_pool ziti threads=32 max\_queue=65536;

http {  
include mime.types;  
default\_type application/octet-stream;  
sendfile on;  
keepalive\_timeout 65;

```
server {
    listen 80;
    server_name localhost;

    location / {
            proxy_pass http://192.168.11.183;
            ziti_pass 'xxxxxx';
            ziti_identity /opt/nginx/ziti/zb.json;
    }

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root html;
    }

```

}

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [January 13, 2025, 1:27pm UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/5 "2025-01-13T13:27:23Z")

</div>

In my experience, when you see our logs state something like

> request failed: -103(software caused connection abort)

This is generally an active failure, meaning a request was attempted, but it was forcefully rejected. In my experience, a very common cause for this is the identity is simply invalid. For example, the identty json file is not correct for whatever reason.

A simpler way to debug this and let me/us help you would be to use the ziti-edge-tunnel with that identity and see if it will connect. This will rule any nginx stuff from the equation. It will be as simple as installing/downloading ziti-edge-tunnel and running:

```plaintext
ziti-edge-tunnel run -i /opt/nginx/ziti/zb.json

```

Can you try that? Let's just make sure that identity can connect and if not, make a new identity, and test with ziti-edge-tunnel to ensure it's valid before adding it to nginx. If it works, well then we know we'll need to focus on the nginx part.

---

<div class="post-metadata">

**Author:** ![roycyz](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/roycyz/32/2973_2.png) [@roycyz](https://openziti.discourse.group/u/roycyz)\
**Post date:** [January 22, 2025, 6:51am UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/6 "2025-01-22T06:51:21Z")

</div>

Now I start the openziti with the docker.Create the json file follow:

docker exec -it docker-ziti-controller-1 bash

zitiLogin

ziti edge create identity user http-client -a 'http-clients' -o http.client.jwt

ziti edge create config http.intercept.v1 intercept.v1 '{"protocols":["tcp"],"addresses":["http.ziti"], "portRanges":[{"low":80, "high":80}]}'

ziti edge create config http.host.v1 host.v1 '{"protocol":"tcp", "address":"web-test-blue", "port":8000}'

ziti edge create service http.svc --configs http.intercept.v1,http.host.v1

ziti edge create service-policy http.policy.dial Dial --service-roles "@http.svc" --identity-roles '#http-clients'

ziti edge create service-policy http.policy.bind Bind --service-roles '@http.svc' --identity-roles "@ziti-private-blue"  
Then I exit the docker. Copied the file to my dir and execute command like:  
ziti-edge-tunnel enroll --jwt http.client.jwt --identity http.client.json

ziti-edge-tunnel run -i http.client.json

The error follows:

 ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/8/8d8b981497fd1712dda9a92d8672702644c2b6ca.jpeg)

---

<div class="post-metadata">

**Author:** ![mike.gorman](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/mike.gorman/32/7_2.png) [@mike.gorman](https://openziti.discourse.group/u/mike.gorman)\
**Post date:** [January 22, 2025, 12:19pm UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/7 "2025-01-22T12:19:57Z")

</div>

You are connecting to the controller, and getting an edge router from the controller, which you are then trying to connect to. Is the edge router process running? Does the name ziti-edge-router resolve? Or is the edge listener configured with an IP that is correct and reachable? That info would be in the router's configuration file.

---

<div class="post-metadata">

**Author:** ![roycyz](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/roycyz/32/2973_2.png) [@roycyz](https://openziti.discourse.group/u/roycyz)\
**Post date:** [January 23, 2025, 5:56am UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/8 "2025-01-23T05:56:06Z")

</div>

Now I can use it with ziti-edge-tunnel run -i http.client.json.But when I want to connect on windows, I downloaded the desktop-edge-win 2.5.2.8 from the github. Then I add the jwt file there is the error in logfile.  
[2025-01-23T05:33:23.325Z] ERROR tlsuv:win32\_keychain.c:108 failed to generate key[ziti://wkJ7LlXai@zhibei-virtual-machine:1280]: The object is already exists.  
[2025-01-23T05:33:23.325Z] ERROR ziti-edge-tunnel:process\_cmd.c:60 tunnel\_enroll\_cb() enrollment failed: error generating private key(-10)  
[2025-01-23T05:33:23.325Z] ERROR ziti-edge-tunnel:process\_cmd.c:68 tunnel\_enroll\_cb() removing failed identity file: c:\windows\system32\config\systemprofile\appdata\roaming\netfoundry\http.client.json

And an other error when I excused zitiLogin.  
[12.377] ERROR transport/v2/tls.(\*sharedListener).processConn [tls:0.0.0.0:1280]: {remote=[127.0.0.1:60184] error=[remote error: tls: bad certificate]} handshake failed

Also add the jwt file it's having the same error with different ip.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [January 23, 2025, 12:29pm UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/9 "2025-01-23T12:29:22Z")

</div>

First, I want to make sure you're not using the same jwt. JWTs are single-use. Assuming you're using a different JWT, it looks like you might be hitting a problem with a feature that was recently introduced - keychain support. Can you share a feedback.zip file by emailing it to clint at [openziti.org](http://openziti.org)? I'd like to see a bunch of information that it contains (the zip file). I'm gussing this is a machine that doesn't have a TPM on it?

You can try to disable keychain support for this identity by going to Main Menu -\> Advanced Settings -\> Tunnel Config -\> Use Keychain --\> unchecked -\> Save  
 ![disable-keychain](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/a/a77c3f2f48b7bd4cdc65c111d980d5863c896de8.gif)

Looks like we might need to change the way this code works to surface an error back to the user or something in this situation.

---

<div class="post-metadata">

**Author:** ![roycyz](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/roycyz/32/2973_2.png) [@roycyz](https://openziti.discourse.group/u/roycyz)\
**Post date:** [January 24, 2025, 11:36am UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/10 "2025-01-24T11:36:16Z")

</div>

Thank you for your help.

I did use the same jwt file for the test, and his generated instructions are as follows：  
`ziti edge create identity user http-client -a 'http-clients' -o http.client.jwt ziti edge create config http.intercept.v1 intercept.v1 '{"protocols":["tcp"],"addresses":["http.ziti"], "portRanges":[{"low":80, "high":80}]}' ziti edge create config http.host.v1 host.v1 '{"protocol":"tcp", "address":"xxx.xxx.xxx.xxx", "port":8000}' ziti edge create service http.svc --configs http.intercept.v1,http.host.v1 ziti edge create service-policy http.policy.dial Dial --service-roles "@http.svc" --identity-roles '#http-clients' ziti edge create service-policy http.policy.bind Bind --service-roles '@http.svc' --identity-roles "@http-client" ziti-edge-tunnel enroll --jwt http.client.jwt --identity http.client.json`

After modifying according to what you said, there is still an error as follows.

```auto
[2025-01-24T02:33:41.274Z] ERROR ziti-sdk:ziti_ctrl.c:527 ctrl_body_cb() ctrl[zhibei-virtual-machine:1280] API request[/enroll] failed code[INVALID_ENROLLMENT_TOKEN] message[The supplied token is not valid]
[2025-01-24T02:33:41.274Z] ERROR ziti-sdk:ziti_enroll.c:402 enroll_cb() failed to enroll with controller: https://zhibei-virtual-machine:1280 INVALID_ENROLLMENT_TOKEN[The supplied token is not valid] reason[]
[2025-01-24T02:33:41.274Z] ERROR ziti-edge-tunnel:process_cmd.c:60 tunnel_enroll_cb() enrollment failed: JWT not accepted by controller(-3)

```

I've tried generating even a file with the following instructions:

```auto
ziti edge create identity user http-server -o http-server.jwt
ziti edge create identity user http-client -o http-client.jwt
ziti edge create config http.intercept.v1 intercept.v1 '{"protocols":["tcp"],"addresses":["http.ziti"], "portRanges":[{"low":80, "high":80}]}'
ziti edge create config http.host.v1 host.v1 '{"protocol":"tcp", "address":"xxx.xxx.xxx.xxx", "port":8000}'
ziti edge create service http.svc --configs http.intercept.v1,http.host.v1
ziti edge create service-policy http.policy.dial Dial --service-roles "@http.svc" --identity-roles '#http-clients'
ziti edge create service-policy http.policy.bind Bind --service-roles '@http.svc' --identity-roles "@http-server"

```

But he can't convert it to a for json file.

This is the feedback.zip file  
[log.zip](https://openziti.discourse.group/uploads/short-url/nQUXDcO9F3UM7aDP2YGn7JdJbrU.zip) (9.0 KB)

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [January 24, 2025, 12:19pm UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/11 "2025-01-24T12:19:03Z")

</div>

Yeah, you can't use the same JWT. JWTs are **single use**. Once you use them, they become unusable. If you are seeing INVALID\_ENROLLMENT\_TOKEN, it's almost certainly because it's being used again. If you want to enroll again, you need to make a second identity and enroll that.

---

<div class="post-metadata">

**Author:** ![roycyz](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/roycyz/32/2973_2.png) [@roycyz](https://openziti.discourse.group/u/roycyz)\
**Post date:** [January 26, 2025, 3:11am UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/12 "2025-01-26T03:11:34Z")

</div>

When I try to create two jwts just like [Your First Service | OpenZiti](https://openziti.io/docs/learn/quickstarts/services/ztha)，I can't create the json files.The error it's (938604)[0.000] WARN ziti-sdk:model\_support.c:202 model\_parse() json parse error: unexpected character.  
What can I write about ${http\_server\_id}? Both http-client and http-server it had the same errors,when I create the json files.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [January 26, 2025, 3:39am UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/13 "2025-01-26T03:39:07Z")

</div>

Probably need more details. Can you recap where you're at and what commands you're using or what you did in the zac? You create the json files by enrolling jwts, the one time use tokens you get by creating identities.

I'm just not sure where you're at and what you're trying to do. If you could just let me know exactly where you're at and what you're trying to do I'll try to help out. Cheers

---

<div class="post-metadata">

**Author:** ![roycyz](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/roycyz/32/2973_2.png) [@roycyz](https://openziti.discourse.group/u/roycyz)\
**Post date:** [January 26, 2025, 4:07am UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/14 "2025-01-26T04:07:30Z")

</div>

root@zhibei-virtual-machine:/opt/nginx/ziti# ziti edge create identity user http-client -a 'http-clients' -o http.client.jwt  
Command "user" is deprecated, this command is deprecated, specifying identity type is no longer required  
New identity http-client created with id: UlOPAHcgB  
Enrollment expires at 2025-01-26T05:53:03.855Z  
root@zhibei-virtual-machine:/opt/nginx/ziti# ziti edge create identity user http-server -o http.server.jwt  
Command "user" is deprecated, this command is deprecated, specifying identity type is no longer required  
New identity http-server created with id: ZkkPAHc7B  
Enrollment expires at 2025-01-26T05:53:11.935Z  
root@zhibei-virtual-machine:/opt/nginx/ziti# ziti edge create config http.intercept.v1 intercept.v1 '{"protocols":["tcp"],"addresses":["http.ziti"], "portRanges":[{"low":80, "high":80}]}'  
New config http.intercept.v1 created with id: 2SCnr7azFSYMRmFfmsGpM9  
root@zhibei-virtual-machine:/opt/nginx/ziti# ziti edge create config http.host.v1 host.v1 '{"protocol":"tcp", "address":"192.168.12.207", "port":8000}'  
New config http.host.v1 created with id: 5qmwANe5BVDeNxI5NduYBs  
root@zhibei-virtual-machine:/opt/nginx/ziti# ziti edge create service http.svc --configs http.intercept.v1,http.host.v1  
New service http.svc created with id: 1G68kxApQxKCrERgaK0IQo

 ![{6D9D1825-A239-4874-B43C-455A45ED0646}](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/9/902c7626d2751440ac1d99ebe98c5b92bf7183ff.png)

These are all my commands aboat create json files.Among other things, about bind command I tried ziti edge create service-policy http.policy.bind Bind --service-roles '@http.svc' --identity-roles "@http-client",but useless.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [January 27, 2025, 6:32pm UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/15 "2025-01-27T18:32:02Z")

</div>

Thanks for the extra details. That's really strange.

Is this a local install of OpenZiti or is it public? I'd like to look at the JWT if I could. It's a sensitive token, so if this is a public instance of OpenZiti you shouldn't share it here....

@ekoby is there anything in the screen cap that loks interesting? `json parse error: unexpected character` is certainly unexpected.

If you look at the file, does it appear intact?

---

<div class="post-metadata">

**Author:** ![ekoby](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/ekoby/32/14_2.png) [@ekoby](https://openziti.discourse.group/u/ekoby)\
**Post date:** [January 27, 2025, 11:55pm UTC](https://openziti.discourse.group/t/how-do-i-get-the-json-file-in-ntity-file-path-to-ziti-identity1-json/3732/16 "2025-01-27T23:55:27Z")

</div>

you're trying to load jwt from `/tmp/http.server.jwt` but it is local to `/opt/nginx/ziti`, right?

the error is a bit misleading -- because `/tmp/http.server.jwt` has two dots it is trying to parse that string as JWT. This happens after it does not find the file with that path