Question around using External JWT signer for apps through SDKs

Ziti Overlay
1

Hi there, I'm fairly new to concepts around authentication and OIDC in particular, and so I'm looking for help around integrating external JWT signers. I might be completely misunderstanding its purpose so please feel free to correct me there too:

  1. Is it possible to use OIDC for applications that are using the SDKs directly? For example, if I have a web server that needs to send traffic over the ziti overlay and I build the transport using the openziti SDK, is it possible to not use the identities generated directly via the controller and use external auth instead? From, here, it looks like this might only be possible via the tunnelers and not an application that is built using the SDK.

  2. For the tunnelers, if we take the ziti-edge-tunnel on Linux as an example, again please pardon my ignorance: This doc helps providing details on gathering the right config of a deployed OIDC service, but I can't seem to find documentation or an example on how to actually configure a tunneler to use this configuration. The example here provides a way to test it, but again how would I go about integrating it either in a tunneler or in an SDK-based app if that's possible.

Thanks for the help!

2

Hi @iprr, welcome to the community and to OpenZiti!

Sure. You can look at the ziti-test-kitch project called zssh for this exact example. It can use OIDC to authenticate to the OpenZiti overlay. GitHub - openziti-test-kitchen/zssh: Ziti SSH Accompanying blog here Zero Trust SSH with Multifactor Authentication related youtube https://www.youtube.com/watch?v=gldZDTMsnbY

If you wanted to auth to an IdP you'd have to use the client credential grant flow and you'd have a client id and secret. You'd use those credentials with the IdP to obtain an access token. You'd then configure an ext-jwt-signer and use that access token to auth to the overlay network. You'd still require an identity in the OpenZiti controller with a correct external id mapping.

As to how you integrate it you were close but you want to find your IdP in the list: Identity Providers | OpenZiti Hopefully that doc will give you what you need.

Have a look at that stuff and if you get stuck, I'll try to help out as I can. Cheers!