@dmuensterer and I have been been in communication on this topic via direct message. I just wanted to share a quick update here for the public, so anyone else who might be seeing the same issue can follow along or chime in.
The identities that are losing authentication are enrolled with the OpenZiti controller and authenticated with an external provider. Eventually the tunneler starts trying to use OpenZiti internal authentication for the identities, as can be seen in the log excerpt posted above. This is clearly a bug at one or more layers of the stack.
That’s all we really know at this point. We’ll try to start migrating our DM conversation to this thread. Thanks!