Ziti edge login fails in 2.0.0 when edge-oidc and edge-management are on separate listeners

Support General Questions
1

We upgraded a controller from 1.6.17 to 2.0.0 and ziti edge login stopped working.

Both CLI and controller are v2.0.0. Also tested it with a fresh install.

The default config is everything one listener. We split ours into two,
edge-client and edge-oidc on 443, edge-management, fabric and the console on 444. We don't want the management API accessible by everyone. Port 444 is firewalled down to a single static IP.
I saw this config in the forum for hardening purposes.
This is what we ended up with:

web:
  - name: client-management
    bindPoints:
      - interface: 0.0.0.0:443
        address: ctrl1.example.com:443
    apis:
      #- binding: edge-management
      - binding: edge-client
        options: { }
      - binding: edge-oidc
        options: { }

  - name: admin-management
    bindPoints:
      - interface: 0.0.0.0:444
        address: ctrl1.example.com:444
    apis:
      - binding: edge-management
        options: { }
      #- binding: edge-client
      #  options: { }
      - binding: fabric
        options: { }
      #- binding: edge-oidc
      #  options: { }
      - binding: spa
        options:
          path: zac
          ...

The controller advertises all of this correctly:

"edge-client":     { "v1": { "apiBaseUrls": ["https://ctrl1.example.com:443/edge/client/v1"] } },
"edge-oidc":       { "v1": { "apiBaseUrls": ["https://ctrl1.example.com:443/oidc"] } },
"edge-management": { "v1": { "apiBaseUrls": ["https://ctrl1.example.com:444/edge/management/v1"] } },
"fabric":          { "v1": { "apiBaseUrls": ["https://ctrl1.example.com:444"] } }

Under 1.6.17 this was fine. Logging in against the management port just worked:

$ ziti edge login
Enter controller host[:port] (default localhost:1280): localhost:444
Enter username: admin
Enter password:
Token: cc68c868-...
Saving identity 'default' to /root/.config/ziti/ziti-cli.json

With 2.0.0, login against 444 gives us:

Error: failed to initiate authorization flow: could not find auth request id header
from authorize endpoint

On a test controller with the same layout we got a more detailed version of what looks like
the same failure:

Error: failed to initiate authorization flow: authentication request start failed with
status 404, either a misconfigured request was sent or the expected redirect URL
(http://localhost:8080/auth/callback) is not allowed: 404 page not found

And against 443:

Error: [POST /authenticate] authenticate (status 404): {}

On 1.6.17 it falls back to the legacy /authenticate path?

What fixed it for us was uncommenting edge-oidc on the management listener:

  - name: admin-management
    apis:
      - binding: edge-management
      - binding: edge-oidc     # added
      - binding: fabric
      - binding: spa

After that /oidc/.well-known/openid-configuration returns 200 on both 443 and 444, and
ziti edge login ctrl1.example.com:444 -u admin works again.

Access over ZAC works fine without the second oicd listener.

So, a few questions:

  1. Is running edge-oidc on two listeners actually OK? We've now got it bound on both 443 and
    444 and it works, but I'd rather know up front if that causes issues with issuer or
    redirect-URI handling, token audience, key material, or anything specific to an HA cluster.

  2. Is there a supported way to point the CLI at one host:port for OIDC and a different one for
    the management API or is it just a bug? Keeping the management API off the public port is a hardening requirement for us, so if binding OIDC twice turns out to be a bad idea
    we'd need another way to do this.

Happy to post full configs or more logs if that helps.