Hi Ziti Community,
I'm hoping for some guidance on an issue I'm facing with Ziti Desktop Edge (ZDE) for Windows enrollment via OIDC using Microsoft Entra ID.
My Goal:
To allow users to enroll their ZDE for Windows clients using their Microsoft Entra ID credentials.
My Setup:
-
Ziti Controller Version: v1.5.4 (from Docker, URL https://controller-url:1280)
-
Ziti Desktop Edge: Service v1.5.8,
-
Identity Provider: Microsoft Entra ID
The Problem:
The OIDC authentication flow itself appears to complete successfully. The ZDE client authenticates via Entra ID, and the Ziti controller validates the received OIDC token and issues a Ziti API session token.
However, immediately afterward, when ZDE attempts subsequent API calls (like GET /current-identity or POST /current-api-session/certificates to finalize enrollment), these calls are rejected by the controller.
What I'm Seeing in the Logs:
- ZDE Client Logs show the successful OIDC flow and API session acquisition:
DEBUG ziti-sdk:oidc.c:927 oidc_client_set_tokens() using id_token={...<REDACTED OIDC ID TOKEN DETAILS>...}
DEBUG ziti-sdk:external_auth.c:94 ext_token_cb() received access token: <REDACTED_ACCESS_TOKEN_SNIPPET>...
VERBOSE ziti-sdk:ziti_ctrl.c:145 start_request() ctrl[https://<controller-url>/] starting POST[/authenticate]
VERBOSE ziti-sdk:ziti_ctrl.c:427 ctrl_body_cb() ctrl[https://<controller-url>/] HTTP RESPONSE: {"data":{"_links":{...},"id":"<REDACTED_api_session_id>", ...}}
DEBUG ziti-sdk:ziti_ctrl.c:394 ctrl_login_cb() ctrl[https://<your-controller-url>/] authenticated successfully session[<REDACTED_api_session_id>]
Then, subsequent calls immediately fail:
VERBOSE ziti-sdk:ziti_ctrl.c:145 start_request() ctrl[https://<controller-url>/] starting GET[/current-identity]
VERBOSE ziti-sdk:ziti_ctrl.c:427 ctrl_body_cb() ctrl[https://<controller-url>/] HTTP RESPONSE: {"error":{"code":"UNAUTHORIZED","message":"The request could not be completed. The session is not authorized or the credentials are invalid",...}}
ERROR ziti-sdk:ziti_ctrl.c:522 ctrl_body_cb() ctrl[...] API request[/current-identity] failed code[UNAUTHORIZED]...
(Similar errors occur for POST /current-api-session/certificates etc.)
- Controller (v1.5.4) Logs show successful OIDC token validation and API session issuance:
<timestamp> DBG authMethod=ext-jwt authPolicyId=<REDACTED_oidc_auth_policy_id> expectedAudience=<REDACTED_ENTRA_APP_CLIENT_ID> extJwtSignerId=<REDACTED_ext_jwt_signer_id> ... identityId=<REDACTED_ziti_identity_id> issuer=https://login.microsoftonline.com/<REDACTED_ENTRA_TENANT_ID>/v2.0 msg=validated candidate JWT at index 0 tokenAudiences=<REDACTED_ENTRA_APP_CLIENT_ID>
<timestamp> DBG apiSessionId=<example_api_session_id> ... msg=adding apiSession strategy=instant
But then, for the ZDE's very next API calls, the controller logs this:
<timestamp> ERR authMethod=ext-jwt ... msg=encountered 0 candidate JWTs, verification cannot occur
Key Configuration Points:
-
My controller uses an internal PKI for its listener on port 1280. ZDE client trusts this CA.
-
My External JWT Signer and Auth Policy are configured for Entra ID. The auth policy allows primary.extJwt with this signer.
-
The Ziti identity exists, has externalId matching preferred_username, is linked to the azureoidc auth policy, and has roleAttributes: ["default", "users"].
What I've Tried:
-
Ensured TLS trust. Router enrollment is fine.
-
Username/password login with ziti edge login (CLI v1.5.4) works correctly with API sessions.
-
Controller DEBUG logs are enabled via -v.
My Core Question:
Why does the Ziti controller after successfully issuing an API session token from an OIDC authentication, then appear to ignore that token for the ZDE client's subsequent API calls and incorrectly fall back to ext-jwt authentication (which then fails with "0 candidate JWTs")? This prevents the OIDC enrollment from completing.
Has anyone encountered a similar situation or have insights into potential misconfigurations or known behaviors with controller v1.5.4 and OIDC API sessions?
Thanks for any assistance!
