# OpenZiti use External JWT Signers with keycloak **URL:** \ **Category:** Uncategorized\ **Created:** [March 20, 2025, 2:59am UTC](https://openziti.discourse.group/t/openziti-use-external-jwt-signers-with-keycloak/4215 "2025-03-20T02:59:55Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![zzh](https://avatars.discourse-cdn.com/v4/letter/z/b77776/32.png) [@zzh](https://openziti.discourse.group/u/zzh)\ **Post date:** [March 20, 2025, 2:59am UTC](https://openziti.discourse.group/t/openziti-use-external-jwt-signers-with-keycloak/4215/1 "2025-03-20T02:59:55Z")
I have own keycloak,but error like this,I dont know where the problem ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/a/a0e03deaad7ddae2441683cbc9596dd6467354e5.png) ---
**Author:** ![zzh](https://avatars.discourse-cdn.com/v4/letter/z/b77776/32.png) [@zzh](https://openziti.discourse.group/u/zzh)\ **Post date:** [March 20, 2025, 3:01am UTC](https://openziti.discourse.group/t/openziti-use-external-jwt-signers-with-keycloak/4215/2 "2025-03-20T03:01:21Z")
keycloak config ![1742439668103](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/f/f491ca08c6c55692bbcd6fa1700e6b22b71c994a.png) ---
**Author:** ![zzh](https://avatars.discourse-cdn.com/v4/letter/z/b77776/32.png) [@zzh](https://openziti.discourse.group/u/zzh)\ **Post date:** [March 20, 2025, 3:04am UTC](https://openziti.discourse.group/t/openziti-use-external-jwt-signers-with-keycloak/4215/3 "2025-03-20T03:04:46Z")
ontinue with the previous question my keycloak config ![1742439668103](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/f/f491ca08c6c55692bbcd6fa1700e6b22b71c994a.png) ---
**Author:** ![zzh](https://avatars.discourse-cdn.com/v4/letter/z/b77776/32.png) [@zzh](https://openziti.discourse.group/u/zzh)\ **Post date:** [March 20, 2025, 3:05am UTC](https://openziti.discourse.group/t/openziti-use-external-jwt-signers-with-keycloak/4215/4 "2025-03-20T03:05:35Z")
Continue with the previous question ,openziti config ![1742439439266](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/b/b8ea6cbe3a5d69b76e15a4c928d3fadf316a0dbf.png) ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [March 20, 2025, 11:10am UTC](https://openziti.discourse.group/t/openziti-use-external-jwt-signers-with-keycloak/4215/5 "2025-03-20T11:10:54Z")
Hi @zzh, welcome to the community and to OpenZiti! I've got some preliminary documentation (I'm still working on it but it should be done today/tomorrow) about this you can have a look at. I can give you the answer here, but would you be willing to look at the doc to see if it makes enough sense for you to figure it out? It would help me help the project to get a very fresh set of eyes on the doc and to know whether it covers what you would want to find in documentation. Would you be willing to do that for me and the project? > **[Keycloak | OpenZiti](https://ziti-doc-git-issue-1022using-idps-openziti.vercel.app/docs/guides/external-auth/identity-providers/keycloak)** > > The following fields are necessary in order to configure an external JWT signer with OpenZiti. This configuration will also the [root of the OIDC doc has other information](https://ziti-doc-git-issue-1022using-idps-openziti.vercel.app/docs/guides/external-auth/) that might be relevant and helpful to you. If you get stuck after reading the doc, your feedback on what had you stuck would be really helpful. That sound ok? Thanks so much ---
**Author:** ![zzh](https://avatars.discourse-cdn.com/v4/letter/z/b77776/32.png) [@zzh](https://openziti.discourse.group/u/zzh)\ **Post date:** [March 21, 2025, 9:21am UTC](https://openziti.discourse.group/t/openziti-use-external-jwt-signers-with-keycloak/4215/8 "2025-03-21T09:21:53Z")
Hi client,I found my question because my console version to low,but now I can successfully authenticate，my ZDEW client also have not permission ![1742548861081](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/0/069a37d208fe32fdf63b3953b1998c9cfb6f3d44.png) ![1742548889490](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/1/102cdf2700e29c74300b72d25b3bd66031b4b40b.png) ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [March 21, 2025, 9:53am UTC](https://openziti.discourse.group/t/openziti-use-external-jwt-signers-with-keycloak/4215/9 "2025-03-21T09:53:25Z")
Ok. I might have to add more generic doc telling people how to troubleshoot this situation. The problem will be a mismatch between the security tokens obtained by the tunneler and the ext jwt signer. Keycloak is one of the better, and helpful idps. Specifically at the bottom of that page here [Keycloak | OpenZiti](https://ziti-doc-git-issue-1022using-idps-openziti.vercel.app/docs/guides/external-auth/identity-providers/keycloak#verifying-tokens-in-keycloak) tells you how to verify the tokens. Did you find that section and was it sufficient? Or did you find that section but the doc still wasn't sufficient? Since you're successfully completing the flow, my expectation is that either the issuer or the audience is incorrect. It's easy to get them wrong. Pay very careful attention to the audience and if it ends with a slash. That's a very very common error. ---
**Author:** ![zzh](https://avatars.discourse-cdn.com/v4/letter/z/b77776/32.png) [@zzh](https://openziti.discourse.group/u/zzh)\ **Post date:** [March 24, 2025, 3:50am UTC](https://openziti.discourse.group/t/openziti-use-external-jwt-signers-with-keycloak/4215/10 "2025-03-24T03:50:00Z")
Hi,client，I found the doc and I think I have the correct configuration，I verify the tokens ![1742788183357](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/3/31fa2fca8932533d63a0bc7f0027173818c7c111.png) ---
**Author:** ![zzh](https://avatars.discourse-cdn.com/v4/letter/z/b77776/32.png) [@zzh](https://openziti.discourse.group/u/zzh)\ **Post date:** [March 24, 2025, 3:52am UTC](https://openziti.discourse.group/t/openziti-use-external-jwt-signers-with-keycloak/4215/11 "2025-03-24T03:52:30Z")
to continue ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/e/e8c3e042db2ec27ceebe480213619becd2e59462.png) ---
**Author:** ![zzh](https://avatars.discourse-cdn.com/v4/letter/z/b77776/32.png) [@zzh](https://openziti.discourse.group/u/zzh)\ **Post date:** [March 24, 2025, 3:52am UTC](https://openziti.discourse.group/t/openziti-use-external-jwt-signers-with-keycloak/4215/12 "2025-03-24T03:52:48Z")
to continue ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/6/63ee6a560f1cf0bf54c7f3959385837412f4c38f.png) ---
**Author:** ![zzh](https://avatars.discourse-cdn.com/v4/letter/z/b77776/32.png) [@zzh](https://openziti.discourse.group/u/zzh)\ **Post date:** [March 24, 2025, 3:53am UTC](https://openziti.discourse.group/t/openziti-use-external-jwt-signers-with-keycloak/4215/13 "2025-03-24T03:53:56Z")
to continue ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/8/857708a947d9c8e16fd4783a02d04fca596cd613.png)