fixes openziti/ziti#2324 add token based enrollment #3342

andrewpmartinez · 2025-10-27T20:34:05Z

allows enrollment to certificate auth
allows enrollment to ext jwt token auth
alters ext jwt claimsProperty (maps identity id) to support JSON pointers, defaults to /sub
adds ext jwt enrollToCert, enrollToToken to controller valid enrollment end-authenticator state
adds ext jwt enrollAuthPolicyId to map end identity auth policy to, defaults to default
adds ext jwt enrollAttributeSelector, supports single field name or JSON pointer to point to a single string or array of string attributes to give the identity, defaults to no selector
adds ext jwt enrollNameSelector, supports single field name or JSON pointer to a string field to use as the name, defaults to /sub
add enrollment errors to determine if enrollment has occurred
adds CLI support for ext jwt signer enroll flags

- allows enrollment to certificate auth - allows enrollment to ext jwt token auth - alters ext jwt claimsProperty (maps identity id) to support JSON pointers, defaults to `/sub` - adds ext jwt enrollToCert, enrollToToken to controller valid enrollment end-authenticator state - adds ext jwt enrollAuthPolicyId to map end identity auth policy to, defaults to `default` - adds ext jwt enrollAttributeSelector, supports single field name or JSON pointer to point to a single string or array of string attributes to give the identity, defaults to no selector - adds ext jwt enrollNameSelector, supports single field name or JSON pointer to a string field to use as the name, defaults to `/sub` - add enrollment errors to determine if enrollment has occurred - adds CLI support for ext jwt signer enroll flags

controller/model/enrollment_mod_token.go

tests/enrollment_token_to_token_test.go

ziti/cmd/edge/update_extjwtsigner.go

CHANGELOG.md

dovholuknf

negative tests would be swell but looks fine to me

ekoby · 2025-10-28T16:18:39Z

any chance to add support in ziti edge enroll?

andrewpmartinez requested review from a team as code owners October 27, 2025 20:34

spelling

7a2dcae