Hello, thank you very much for this information.
Unfortunately, it does not help me in my case.
I am using the ziti-client-tunnel with certificate authentication in the first phase and OIDC authentication in the second phase.
I do not understand how you enroll the client for oidc.... it's maybe the problem
Here is how I did it on my end:
1: Create new identity with certificate
./ziti pki create client \
--pki-root="./pki" \
--ca-name=$ca_name \
--client-name=$client_name \
--client-file=$client_name
2: Enroll client:
./ziti edge enroll -v \
--cert "./pki/$ca_name/certs/${client_name}.cert" \
--key "./pki/$ca_name/keys/${client_name}.key" \
--jwt "./pki/$ca_name/${client_name}.jwt" \
--out "./pki/$ca_name/keys/${client_name}.json"
With this, the tunnel is working
sudo ziti-edge-tunnel run -i /home/user/tunnel/client1.json
In the auth-policy, I only specified authentication with a certificate.
Now on the client, I enable CA primary and OIDC authentication as secondary
I saw in another post that you were going to download the JWT from the ZAC page - JWT SIGNER.
And now i enroll the client1 with this ext JWT
sudo ziti-edge-tunnel enroll --jwt ext-ctrl.jwt -i client1-ext.json
(69960)[ 0.000] INFO ziti-sdk:utils.c:196 ziti_log_set_level() set log level: root=3/INFO
(69960)[ 0.000] INFO ziti-sdk:utils.c:165 ziti_log_init() Ziti C SDK version 1.8.5 @gca0d903gca0d903gca0d903gca0d903gca0d903gca0d903gca0d903gca0d903(HEAD) starting at (2025-11-07T13:32:34.377)
(69960)[ 0.000] INFO ziti-sdk:ziti_enroll.c:112 ziti_enroll() Ziti C SD@gca0d903 versio@gca0d903gca0d903 1.8.5 @gca0d903gca0d903(HEAD) starting enrollment at (2025-11-07T13:32:34.377)
(69960)[ 0.000] INFO ziti-sdk:ziti_ctrl.c:637 ziti_ctrl_init() ctrl[https://xxx.xxx.xx:443/\\\\\] controller initialized
(69960)[ 0.000] INFO ziti-sdk:ziti_ctrl.c:637 ziti_ctrl_init() ctrl[https://xxx.xxx.xx:443/\\\\\] controller initialized
(69960)[ 0.000] WARN ziti-sdk:ziti_ctrl.c:336 internal_version_cb() ctrl ziti context is disabled(operation canceled)
I run the tunnel: ( with the json given by CA enrollement )
sudo ziti-edge-tunnel run -i /home/user/tunnel/client1.json
And i run the ext
sudo ziti-edge-tunnel ext-jwt-login -i /home/user/tunnel/client1-ext.json -p keycloak
Here i have a error
{
"Success":false,
"Error":"ziti context not found",
"Code":500
}
Now i try to use the json generated with CA enrollement. It’s mutch better but the authentication failed ( AUTH INVALID)
sudo ziti-edge-tunnel ext-jwt-login -i /home/user/tunnel/client1.json -p keycloak | jq -r '.Data.url' | xargs xdg-open
Error:
(73902)[ 136.754] INFO tunnel-cbs:ziti_tunnel_ctrl.c:1128 on_ziti_event() ztx[/home/user/tunnel/exo_client1.json//home/user/tunnel/client1.json] ext auth event received
(73902)[ 136.754] INFO ziti-edge-tunnel:ziti-edge-tunnel.c:804 on_event() ztx[/home/user/tunnel/exo_client1.json] ext auth: login_with_ext_signer
(73902)[ 145.022] INFO ziti-sdk:oidc.c:416 request_token() requesting token path[https://sso.xxx.xx/realms/test/protocol/openid-connect/token\\\\\] auth[4b56173e-b147-4827-a1d1-e679797f2ba5.371f4524-9910-4adf-bed6-a4cadb6117ff.10b32b96-15af-4430-965a-0d8fdde7c980]
(73902)[ 145.111] WARN ziti-sdk:ziti_ctrl.c:815 verify_api_session() ctrl[https://sso.xxx.xx:443/edge/client/v1\\\\\] no API session
(73902)[ 145.111] WARN ziti-sdk:legacy_auth.c:183 login_cb() failed to login to ctrl[https://sso.xxx.xx/:443/edge/client/v1\\\\\] UNAUTHORIZED[-14] no api session token set for ziti_controller
(73902)[ 145.111] WARN tunnel-cbs:ziti_tunnel_ctrl.c:1018 on_ziti_event() ziti_ctx controller connections failed: failed to authenticate
(73902)[ 145.111] INFO ziti-edge-tunnel:ziti-edge-tunnel.c:460 on_event() ztx[/home/user/tunnel/client1.json] context event : status is failed to authenticate
(73902)[ 145.111] ERROR ziti-edge-tunnel:ziti-edge-tunnel.c:514 on_event() ztx[/home/user/tunnel/client1.json] failed to connect to controller due to failed to authenticate
Do you see the error ?
