# Unable to login to ZAC using Entra (Ext-JWT-Signer) **URL:** \ **Category:** Support\ **Created:** [October 9, 2025, 5:17pm UTC](https://openziti.discourse.group/t/unable-to-login-to-zac-using-entra-ext-jwt-signer/5217 "2025-10-09T17:17:17Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![NullZiti](https://avatars.discourse-cdn.com/v4/letter/n/7ba0ec/32.png) [@NullZiti](https://openziti.discourse.group/u/NullZiti)\ **Post date:** [October 9, 2025, 5:17pm UTC](https://openziti.discourse.group/t/unable-to-login-to-zac-using-entra-ext-jwt-signer/5217/1 "2025-10-09T17:17:17Z")
Hi guys, I am new to OpenZiti and so far it looks promsing. **Controller: v1.6.7** **ZAC: 3.12.5** While trying to connect to ZAC to our SSO solution (Entra), everything in the configuration looks perfect but I am unable to logs in. The error I recive in the UI is: ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/d/dd0b22997697a0f1b8df7bafde30d57889cd97a9.png) When looking on Ziti’s logs: `{"file":"github.com/openziti/ziti/controller/model/authenticator_mod_ext_jwt.go:285","func":"github.com/openziti/ziti/controller/model.(*AuthModuleExtJwt).pubKeyLookup","issuer":"https://sts.windows.net//","kid":"HS23b7Do7TcaU1RoLHwpIq24VYg","knownIssuers":["https://login.microsoftonline.com//v2.0","https://login.microsoftonline.com//v2.0","https://login.microsoftonline.com//v2.0"],"level":"error","method":"ext-jwt","msg":"issuer not found, issuers are bit-for-bit compared, they must match exactly","time":"2025-10-09T16:47:14.469Z"} {"authMethod":"ext-jwt","file":"``github.com/openziti/ziti/controller/model/authenticator_mod_ext_jwt.go:422","func":"github.com/openziti/ziti/controller/model.(*AuthModuleExtJwt).process","level":"error","msg":"encountered`` 1 candidate JWTs and all failed to validate for primary authentication, see the following log messages","time":"2025-10-09T16:47:14.469Z"} {"authMethod":"ext-jwt","error":"jwt failed to parse: token is unverifiable: error while executing keyfunc: INVALID_AUTH: The authentication request failed","expectedAudience":"","file":"github.com/openziti/ziti/controller/model/authenticator_mod_ext_jwt.go:88","func":"github.com/openziti/ziti/controller/model.(*candidateResult).LogResult","issuer":"","level":"error","msg":"failed to validate candidate JWT at index 0","time":"2025-10-09T16:47:14.469Z","tokenAudiences":""}` I looked at other posts and verified that the user must to be an admin (it is) and I also ran: ```auto ziti ops verify ext-jwt-signer oidc --controller-url https://myctrl.mydomain.com/ Entra --authenticate ``` The response is looking as it should (I think πŸ˜… ): ```auto INFO using supplied redirect url: http://localhost:20314/auth/callback INFO found external JWT signer INFO - issuer: https://login.microsoftonline.com//v2.0 INFO - clientId: INFO supplied issuer matches discovered issuer: https://login.microsoftonline.com//v2.0 ``` Any idea what I am been missing as it does not look like something related to Auth\_policy or JWT\_signer configuration.. Thanks! ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [October 9, 2025, 5:35pm UTC](https://openziti.discourse.group/t/unable-to-login-to-zac-using-entra-ext-jwt-signer/5217/2 "2025-10-09T17:35:26Z")
Hi @NullZiti, welcome to the community and to OpenZiti! > [@NullZiti](#): > > token is unverifiable: error while executing keyfunc: INVALID\_AUTH: The authentication request failed" This error stands out to me. It makes me think that perhaps the jwks uri is incorrect. You shared the first parts from the `ziti ops verify` command but you didn't share the final part. Do you get a "login succeeded"? ```auto INFO attempting to authenticate to controller with specified target token type: ACCESS Token: xxxxxxxx INFO login succeeded ``` If you get login succeeded, then the next thing would be to have a look at the ZAC in developer tools -\> console to see if there's anything wrong listed in there. Perhaps the user you are logging in with is **NOT** marked as an admin? That's really easy to miss as it's under the 'Show More Options' and is a toggle: ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/2/2fecab95ca9541e024c7ce4a8de4d45fbbd1d6fc.png) My guess though is that the jwks uri is somehow wrong since the controller can't connect and verify the token. (that's what it looks like to me) ---
**Author:** ![ekoby](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/ekoby/32/14_2.png) [@ekoby](https://openziti.discourse.group/u/ekoby)\ **Post date:** [October 9, 2025, 5:38pm UTC](https://openziti.discourse.group/t/unable-to-login-to-zac-using-entra-ext-jwt-signer/5217/3 "2025-10-09T17:38:12Z")
seems like issuer mismatch -- this what comes in JWT: > [@NullZiti](#): > > `"issuer":"https://sts.windows.net//"` ---
**Author:** ![NullZiti](https://avatars.discourse-cdn.com/v4/letter/n/7ba0ec/32.png) [@NullZiti](https://openziti.discourse.group/u/NullZiti)\ **Post date:** [October 9, 2025, 9:32pm UTC](https://openziti.discourse.group/t/unable-to-login-to-zac-using-entra-ext-jwt-signer/5217/4 "2025-10-09T21:32:08Z")
Hi, Thanks for the quick response! @TheLumberjack yes, he is admin. As for the rest of the message - it failed becuased it is looking for localhost:20314 - which is irrelevent when log in to ZAC β€” @ekoby you are right but it is not what _`openid-configuration`_ holds nor what I assigned so I am not sure where it comes from. The full JWT signer configuration is the following: `Issuer: https://login.microsoftonline.com/aaaaaaaa-0000-0000-0000-aaaaaaaaaaaa/v2.0` `Audience: api://bbbbbbbb-0000-0000-0000-bbbbbbbbbbbb` `Claims Property: upn` `Use External ID: Yes` `Client ID: bbbbbbbb-0000-0000-0000-bbbbbbbbbbbb` `External Auth Url: https://login.microsoftonline.com/aaaaaaaa-0000-0000-0000-aaaaaaaaaaaa/v2.0` `SCOPES: openid` `Target token type: Access` `JWKS Endpoint: https://login.microsoftonline.com/aaaaaaaa-0000-0000-0000-aaaaaaaaaaaa/discovery/v2.0/keys` I also added the required callback URI for the authentication test, and it now returns a different error code from the login page: ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/b/b04ff695c266e1d9a8bf0dd3f1cefe9201d8d51e.png) And last, the error log from the docker: `{"authMethod":"ext-jwt","file":"github.com/openziti/ziti/controller/model/authenticator_mod_ext_jwt.go:422","func":"github.com/openziti/ziti/controller/model.(*AuthModuleExtJwt).process","level":"error","msg":"encountered 1 candidate JWTs and all failed to validate for primary authentication, see the following log messages","time":"2025-10-09T20:59:51.138Z"} {"authMethod":"ext-jwt","error":"jwt failed to parse: token signature is invalid: crypto/rsa: verification error","expectedAudience":"","file":"github.com/openziti/ziti/controller/model/authenticator_mod_ext_jwt.go:88","func":"github.com/openziti/ziti/controller/model.(*candidateResult).LogResult","issuer":"","level":"error","msg":"failed to validate candidate JWT at index 0","time":"2025-10-09T20:59:51.139Z","tokenAudiences":""}` Thanks again for the support! ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [October 9, 2025, 9:34pm UTC](https://openziti.discourse.group/t/unable-to-login-to-zac-using-entra-ext-jwt-signer/5217/5 "2025-10-09T21:34:27Z")
> [@NullZiti](#): > > As for the rest of the message - it failed becuased it is looking for localhost:20314 - which is irrelevent when log in to ZAC Yah, you need to enable the localhost:20314 redirect. Enable that and use the ziti CLI to test. It will show you your id, auth, and refresh token bodies which will help you figure the issue out better. You'll also need it if you want to add identities via url and use ext-jwt-signers for tunnelers. Also, make sure the identity you have an external identity mapped to uses the default auth policy for now. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [October 9, 2025, 9:36pm UTC](https://openziti.discourse.group/t/unable-to-login-to-zac-using-entra-ext-jwt-signer/5217/6 "2025-10-09T21:36:53Z")
> [@NullZiti](#): > > "jwt failed to parse: token signature is invalid: crypto/rsa: verification This is going to be difficult to figure out. I've seen this happen when the jwks uri is incorrect and when the idp being connected to is not trusted. I still think using the ziti CLI verify command will help you. But that's just my opinion πŸ™‚ ---
**Author:** ![NullZiti](https://avatars.discourse-cdn.com/v4/letter/n/7ba0ec/32.png) [@NullZiti](https://openziti.discourse.group/u/NullZiti)\ **Post date:** [October 9, 2025, 9:42pm UTC](https://openziti.discourse.group/t/unable-to-login-to-zac-using-entra-ext-jwt-signer/5217/7 "2025-10-09T21:42:20Z")
> [@TheLumberjack](#): > > Yah, you need to enable the localhost:20314 redirect. Enable that and use the ziti CLI to test. Are you reffering to auth callback for tunnelers in Entra ([http://localhost:20314/auth/callback](http://localhost:20314/auth/callback))? If so, it is not clear from the [documentation](https://netfoundry.io/docs/openziti/guides/external-auth/identity-providers/msentra/) how to enable both (ZAC & Tunnerlers) at the same time under the same application but I will try. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [October 9, 2025, 9:45pm UTC](https://openziti.discourse.group/t/unable-to-login-to-zac-using-entra-ext-jwt-signer/5217/8 "2025-10-09T21:45:47Z")
Yes. That page shows the tunneler url in the screenshot and this page generically talks about tunnelers [Configuring OIDC | NetFoundry Documentation](https://netfoundry.io/docs/openziti/guides/external-auth/#callback--redirect-url-configuration) To enable both at the same time, you just need to add the two different redirect urls. One for ZAC and one for tunnelers cap from the entra docs (all of the idps tbh) ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/3/32e05f073054eb9cd394f9390b39cf39d5c5680a.png)