# Ziti login -f admin1@gmail.com.json returns unAuthorized **URL:** \ **Category:** Uncategorized\ **Created:** [September 14, 2026, 12:38pm UTC](https://openziti.discourse.group/t/ziti-login-f-admin1-gmail-com-json-returns-unauthorized/6087 "2026-09-14T12:38:25Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![CarlosHleb](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/carloshleb/32/2187_2.png) [@CarlosHleb](https://openziti.discourse.group/u/CarlosHleb)\ **Post date:** [September 14, 2026, 12:38pm UTC](https://openziti.discourse.group/t/ziti-login-f-admin1-gmail-com-json-returns-unauthorized/6087/1 "2026-09-14T12:38:25Z")
i am running `openziti/quickstart v2.0.0`. when i exec inside `ziti-controller` and do `zitiLogin`(logs me in as default admin, username/password auth), i can list identities with ziti edge list identities and it works. when i cp a identity json file and do `ziti login -f admin1@gmail.com.json`, and then try to list identities, i get error: ```auto ziti@9ec4b4bf57c3:/persistent$ ziti login -f ./admin1@gmail.com.json Saving identity 'default' to /home/ziti/.config/ziti/ziti-cli.json ziti@9ec4b4bf57c3:/persistent$ ziti edge list identities Error: error listing https://ziti-edge-controller:443/edge/management/v1/identities in Ziti Edge Controller. Status code: 401 Unauthorized, Server returned: { "error": { "code": "UNAUTHORIZED", "message": "The request could not be completed. The session is not authorized or the credentials are invalid", "requestId": "M8iZRloe1" }, "meta": { "apiEnrollmentVersion": "0.0.1", "apiVersion": "0.0.1" } } error listing https://ziti-edge-controller:443/edge/management/v1/identities in Ziti Edge Controller. Status code: 401 Unauthorized, Server returned: { "error": { "code": "UNAUTHORIZED", "message": "The request could not be completed. The session is not authorized or the credentials are invalid", "requestId": "M8iZRloe1" }, "meta": { "apiEnrollmentVersion": "0.0.1", "apiVersion": "0.0.1" } } ziti@9ec4b4bf57c3:/persistent$ ``` [admin1@gmail.com](mailto:admin1@gmail.com) is a ziti admin. ![Screenshot from 2026-09-14 14-34-25](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/c/ce24fd7483e66196f6cb2f8cad7a0c71e8680c35.png) my goal is to delete default Admin user(created by ziti ziti-controller-init-container), and auth using certs only(no username/password at all). ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [September 15, 2026, 2:58pm UTC](https://openziti.discourse.group/t/ziti-login-f-admin1-gmail-com-json-returns-unauthorized/6087/2 "2026-09-15T14:58:11Z")
Hi @CarlosHleb, this seems like a regression. I'll file a bug and get it fixed. Thanks for letting us know. I'll follow up with a bug when i log it. > > > Logging in with an enrolled identity file works, but the next \`ziti edge\` comman…d fails with > \`401 UNAUTHORIZED\`. Same for \`ziti edge login --client-cert\`/\`--client-key\`. > > Certificate authentication binds the session to the client certificate, and the controller verifies > proof of possession on each request. \`ziti edge login\` never saves the client certificate to the CLI > config, so the next command builds its HTTP client without one and the controller rejects the session: > > \`\`\` > OIDC cert PoP failed: no client certificate presented controller/env/security\_ctx.go:482 > \`\`\` > > \`ziti/util/identities.go\` -- \`RestClientEdgeIdentity\` stores \`CaCert\` but no client cert, key, or > identity-file path, and \`NewTlsClientConfig\` sets only \`RootCAs\`, never \`tls.Config.Certificates\`. > > Reported at https://openziti.discourse.group/t/ziti-login-f-admin1-gmail-com-json-returns-unauthorized/6087 > > \## Reproduce > > \`\`\`bash > ziti edge quickstart & > ziti edge login localhost:1280 -u admin -p admin -y > ziti edge create identity bob --admin -o bob.jwt > ziti edge enroll bob.jwt -o bob.json > > export ZITI\_CONFIG\_DIR=$(mktemp -d) # so the admin session cannot mask the result > ziti edge login -f ./bob.json -y # succeeds > ziti edge list identities # 401 UNAUTHORIZED > \`\`\` > > The last two commands must be separate processes. That is what forces the CLI to rebuild its client > from the cached identity. > > \## Versions > > Broken in v2.0.0 through current main (\`v2.1.0-pre2-49-ga3e66f11a\`). Last good release is > \`v2.0.0-pre11\`. Introduced by 8297a817b, "enforce client certificate proof-of-possession for OIDC > sessions" (#3805), first tagged in \`v2.0.0-pre12\`. > > The deciding version is the \*\*controller's\*\*, not the CLI's. Pairing each build as both controller and > CLI, and then crossing them: > > | controller | CLI | result | > | --- | --- | --- | > | v2.0.0-pre11 | v2.0.0-pre11 | works | > | v2.0.0-pre11 | v2.0.0 | works | > | v2.0.0-pre12 | v2.0.0-pre12 | 401 | > | v2.0.0 | v2.0.0 | 401 | > | main | main | 401 | > > No CLI has ever sent the certificate on a cached session. Older ones only appeared to work because the > controller did not ask for it. \*\*Downgrading the CLI is not a workaround.\*\* > > \## Tests > > \`tests/cli\_tests/login\_test.go\` covers \`-f\` login but stops at "login succeeded", and the \`-f\` cases set > \`IgnoreConfig: true\`, which skips writing the cached identity entirely. Three failing tests are added > there: > > \- \`identity file auth then cached request\` > \- \`identity file auth then separate process\` > \- \`client cert auth then cached request\` ---
**Author:** ![CarlosHleb](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/carloshleb/32/2187_2.png) [@CarlosHleb](https://openziti.discourse.group/u/CarlosHleb)\ **Post date:** [September 23, 2026, 1:19pm UTC](https://openziti.discourse.group/t/ziti-login-f-admin1-gmail-com-json-returns-unauthorized/6087/3 "2026-09-23T13:19:56Z")
Hello, Its been 8 days. Can you give us some kind of timeline when this can be fixed and new docker openziti/quickstart image can be pushed? ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [September 23, 2026, 3:53pm UTC](https://openziti.discourse.group/t/ziti-login-f-admin1-gmail-com-json-returns-unauthorized/6087/4 "2026-09-23T15:53:48Z")
Timeline - dunno. I'll see if I can get this fixed this week or next week (I'll try to get to it as soon as possible so maybe sooner)... As for the quickstart not publishing that's a wholly different issue. I saw you mention that on a different thread. I'll have to look into why those are not publishing... I'll do that too... ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [September 25, 2026, 3:05am UTC](https://openziti.discourse.group/t/ziti-login-f-admin1-gmail-com-json-returns-unauthorized/6087/5 "2026-09-25T03:05:42Z")
These fixes should go out in the next point release of 2.0.x and 2.1.x. cheers. You can pull main and build it if you want to test it out yourself. Oh man, I see my msg and a release literally just crossed paths.. So prolly 2.0.7+ will have the fix if you want the 2.0.x line. ---
**Author:** ![CarlosHleb](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/carloshleb/32/2187_2.png) [@CarlosHleb](https://openziti.discourse.group/u/CarlosHleb)\ **Post date:** [October 19, 2026, 5:38pm UTC](https://openziti.discourse.group/t/ziti-login-f-admin1-gmail-com-json-returns-unauthorized/6087/6 "2026-10-19T17:38:14Z")
Hello, Its been 25 days since your reply. When can i expect a openziti/quickstart release with the fix? ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [October 20, 2026, 12:30am UTC](https://openziti.discourse.group/t/ziti-login-f-admin1-gmail-com-json-returns-unauthorized/6087/7 "2026-10-20T00:30:37Z")
Hi @CarlosHleb, 2.0.7 was released 3 ish weeks ago and had the fix. 2.0.8 a week ish after that. Both of those should have the login fix on it. Are you saying you tried them and they didn't work? ---
**Author:** ![CarlosHleb](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/carloshleb/32/2187_2.png) [@CarlosHleb](https://openziti.discourse.group/u/CarlosHleb)\ **Post date:** [October 20, 2026, 12:37am UTC](https://openziti.discourse.group/t/ziti-login-f-admin1-gmail-com-json-returns-unauthorized/6087/8 "2026-10-20T00:37:26Z")
Thats great, thank you! But can you release a new openziti/quickstart docker version with the fix? The newest docker image is 2.0.6. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [October 20, 2026, 12:38am UTC](https://openziti.discourse.group/t/ziti-login-f-admin1-gmail-com-json-returns-unauthorized/6087/9 "2026-10-20T00:38:03Z")
ugh. we'll check sure. I thought we had that publication all sorted -- seems like we don't ... ---
**Author:** ![plorenz](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/plorenz/32/54_2.png) [@plorenz](https://openziti.discourse.group/u/plorenz)\ **Post date:** [October 20, 2026, 1:12am UTC](https://openziti.discourse.group/t/ziti-login-f-admin1-gmail-com-json-returns-unauthorized/6087/10 "2026-10-20T01:12:54Z")
I suspect it's b/c 2.0.7 and 2.0.8 weren't marked as stable until today. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [October 20, 2026, 1:24am UTC](https://openziti.discourse.group/t/ziti-login-f-admin1-gmail-com-json-returns-unauthorized/6087/11 "2026-10-20T01:24:10Z")
i'm pushing 2.0.7 and 2.0.8 right now fwiw. thx Paul