# Problem: Automating Identity Creation for OpenZiti via Authentik **URL:** \ **Category:** Ziti Overlay\ **Created:** [August 4, 2025, 2:33pm UTC](https://openziti.discourse.group/t/problem-automating-identity-creation-for-openziti-via-authentik/4943 "2025-08-04T14:33:06Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![poithar](https://avatars.discourse-cdn.com/v4/letter/p/74df32/32.png) [@poithar](https://openziti.discourse.group/u/poithar)\ **Post date:** [August 4, 2025, 2:33pm UTC](https://openziti.discourse.group/t/problem-automating-identity-creation-for-openziti-via-authentik/4943/1 "2025-08-04T14:33:06Z")
I'm currently experimenting with OpenZiti, with the goal of securing my SaaS application for future use. My setup involves a controller in Kubernetes, a separate VM running Browzer, and integration with Authentik as my identity provider (IdP). The entire purpose of this setup is to explore Zero Trust access for my clients. ### Problem Summary During my experimentation, I've run into a significant hurdle related to identity creation. My current configuration requires me to **manually create an OpenZiti identity** for each new user or client before they can log in via Authentik. This manual process is not a feasible solution for a real-world, scalable deployment. The current workflow is: 1. A user successfully authenticates through Authentik. 2. However, their access is blocked because a corresponding OpenZiti identity does not yet exist. 3. I have to manually create the identity in OpenZiti to allow the user to proceed. This manual step is a bottleneck and prevents me from achieving the seamless, automated user onboarding experience that's crucial for my future plans. ### Goal I'm looking for a way to automate the identity creation process. My goal is to have OpenZiti dynamically provision an identity for a user the very first time they log in via Authentik. This "Just-in-Time" (JIT) provisioning would eliminate the need for any manual intervention on my part. ### Technical Details I've already integrated Authentik as an external identity provider using OpenID Connect (OIDC). My research suggests that OpenZiti has a feature for **external JWT signers** and a concept of **third-party auto-enrolled identities** , which seems to be the solution I'm looking for. I believe the correct path forward involves: - Configuring an external JWT signer in OpenZiti that trusts Authentik. - Creating or modifying an authentication policy to allow primary authentication via this external signer. - Leveraging a claim from the JWT (e.g., email or a custom attribute) to automatically create a corresponding OpenZiti identity with appropriate attributes. I'm looking for guidance or a detailed example of how to implement this "Just-in-Time" (JIT) identity provisioning. I want to avoid the manual pre-provisioning step and have OpenZiti dynamically create identities based on successful authentication from Authentik. Is there a standard or recommended way to achieve this dynamic identity creation with OpenZiti and a custom OIDC provider like Authentik? Are there specific configuration settings or CLI commands I'm missing to enable this functionality? Thank you for your help! ---
**Author:** ![smilindave26](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/smilindave26/32/185_2.png) [@smilindave26](https://openziti.discourse.group/u/smilindave26)\ **Post date:** [August 4, 2025, 2:55pm UTC](https://openziti.discourse.group/t/problem-automating-identity-creation-for-openziti-via-authentik/4943/2 "2025-08-04T14:55:03Z")
Hi @poithar - welcome to the community! We are considering adding a lightweight feature to OpenZiti that does some limited auto-provisioning (similar to 3rp party CA auto-enrollment). NetFoundry covers the enterprise-class use case via SCIM integration (auto-create Ziti identities and assign attributes when they are added to the IdP), so they “just work” on first login. If you’d like to talk with someone from NetFoundry (e.g., @PhilipGriffiths) I’m happy to connect you… ---
**Author:** ![HenkVanMaanen](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/henkvanmaanen/32/3731_2.png) [@HenkVanMaanen](https://openziti.discourse.group/u/HenkVanMaanen)\ **Post date:** [August 22, 2025, 9:22pm UTC](https://openziti.discourse.group/t/problem-automating-identity-creation-for-openziti-via-authentik/4943/3 "2025-08-22T21:22:00Z")
That would be a great feature! Other applications with oidc integration work that way too, like apache guacamole. It will auto create the user on first login, and also adds the groups from the group claim. That way the access policies can be made upfront for groups, and when a new user is onboarded in the idp and added to a group, all other applications are then auto configured correctly because of the group claim. ---
**Author:** ![LukeDope](https://avatars.discourse-cdn.com/v4/letter/l/d78d45/32.png) [@LukeDope](https://openziti.discourse.group/u/LukeDope)\ **Post date:** [August 28, 2025, 10:06am UTC](https://openziti.discourse.group/t/problem-automating-identity-creation-for-openziti-via-authentik/4943/4 "2025-08-28T10:06:48Z")
To automate identity creation in OpenZiti via Authentik, you can integrate Authentik as an external JWT signer. This allows dynamic identity creation based on authentication, using JWT claims like email or groups. Consider using SCIM for a more automated solution, similar to NetFoundry's approach. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [August 28, 2025, 10:57am UTC](https://openziti.discourse.group/t/problem-automating-identity-creation-for-openziti-via-authentik/4943/5 "2025-08-28T10:57:58Z")
> [@LukeDope](#): > > This allows dynamic identity creation based on authentication FYI OpenZiti doesn't perform dynamic identity creation at this time. You will still need to generate the identity and map an external id accordingly. It's a feature we have discussed (as mentioned above), but not something that exists as of Aug 2025. Any IdP with proper support can be added, not just Authentik. Have you automated something to get dynamic identity creation, @LukeDope? ---
**Author:** ![saravanan30erd](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/saravanan30erd/32/4175_2.png) [@saravanan30erd](https://openziti.discourse.group/u/saravanan30erd)\ **Post date:** [March 26, 2026, 1:07pm UTC](https://openziti.discourse.group/t/problem-automating-identity-creation-for-openziti-via-authentik/4943/6 "2026-03-26T13:07:51Z")
@TheLumberjack > > FYI OpenZiti doesn't perform dynamic identity creation at this time. Can you provide update about `just in time provisioning` support for MacOS tunneler? OIDC works but not JIT provisioning from MacOS desktop app. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [March 26, 2026, 1:16pm UTC](https://openziti.discourse.group/t/problem-automating-identity-creation-for-openziti-via-authentik/4943/7 "2026-03-26T13:16:47Z")
It's not implemented by tunnelers yet. It'll get done at some point I believe but it's still not on the top of anyone's queue just yet.