OpenZiti identity with Entra-signed JWT cannot access resources

Ziti Overlay
1

Hello everyone,

I’m running OpenZiti, and overall everything is working fine.

Last week, I tried to configure network access through identity, but it’s not working as expected.
Sometimes I can log in to the UI console using a Microsoft Entra user.

When I create an identity with a JWT signed by Entra, I can add the identity and Entra authentication appears to succeed. However, in the UI the user is shown as not connected (Router Connection: No, API Connection: No), so this user cannot access any resources.

Also, the Entra JWT user has the same service permissions as users with default authentication.
Those same services and routers are accessible for users with default auth, but not for the Entra JWT user.

Has anyone seen this behavior before or knows how to fix it?

Any help would be greatly appreciated.

image

image

image
image1142×441 50.3 KB

2

Hi @carol, welcome to the community and to OpenZiti! We're glad things are working well.

This is easy to get wrong, so you'll forgive me if I ask if you're certain. :slight_smile: Can you run:

ziti edge policy-advisor identities login-CG-ADM -q

(or whatever that identity name is)

You should see results like:

OKAY : login-CG-ADM(1) -> normal-user-01.svc.0.ziti (1) Common Routers: (1/1) Dial: Y Bind: N

can you verify you can see the service you expect to see?

Also can you look through the logs for any obvious signs of errors?

3

Hi @TheLumberjack ,

thank you very much for the warm welcome! :wink:

So far, I’m generally very satisfied with the product, and I’m really happy to join the OpenZiti community. I’m looking forward to learning more, sharing experiences, and connecting with everyone here!

This is what appears when I run the command "ziti edge policy-advisor identities login-CG-ADM -q"

image
image1339×158 8.47 KB

I should also mention that the DNS name configured during the creation of the Ziti network was, for example, ziti.test. However, the automatically generated certificate for this domain is reported as invalid when I try to add the network to Ziti Edge.

To work around this, I created a separate domain, ui.ziti.test, and configured it with a Let's Encrypt certificate so that I can access the Ziti UI through a trusted HTTPS connection.

When I add the network using the address https://ui.ziti.test, the identity successfully loads the connection to the IdP. I am able to authenticate the user with my Entra account, and the services are visible in the UI. However, the services remain inaccessible and I cannot establish a connection to them.

Interestingly, when I add the identity as an administrator, I can also log in to the Ziti UI using my Entra account and perform all administrative tasks successfully. This suggests that the Entra ID authentication and the connection to the IdP are working correctly However, the services remain inaccessible and I cannot establish a connection to them.

[2026-08-11T08:11:09.070Z] INFO tunnel-cbs:ziti_tunnel_ctrl.c:1042 on_ziti_event() ziti_ctx[login-CG-ADM] connected to controller

[2026-08-11T08:11:09.087Z] DEBUG ziti-edge-tunnel:ipc_event.c:119 send_events_message() Events Message => {"Op":"identity","Action":"added","Fingerprint":"ui.ziti.test_7112","Id":{"Name":"login-CG-ADM","Identifier":"c:\windows\system32\config\systemprofile\appdata\roaming\netfoundry\ui.ziti.test_7112.json","FingerPrint":"ui.ziti.test_7112","Active":true,"Loaded":true,"Config":{"ztAPI":"https://ziti.test:7112/"},"ControllerVersion":"v2.0.1","IdFileStatus":false,"NeedsExtAuth":false,"ExtAuthProviders":["OIDC-Enroll-JWT-Signer"],"MfaEnabled":false,"MfaNeeded":false,"Metrics":{"Up":0,"Down":0},"MfaMinTimeout":0,"MfaMaxTimeout":0,"MfaMinTimeoutRem":0,"MfaMaxTimeoutRem":0,"MinTimeoutRemInSvcEvent":0,"MaxTimeoutRemInSvcEvent":0,"Deleted":false,"Notified":false}}

Is this information enough? Or could you tell me how to find the specific information you need? :slightly_smiling_face: