Summary
When core-management provisions a network's managed-auth External JWT Signer, the create request correctly includes tags ({any-tag}), but the resulting signer on the controller has empty tags (tags: {}). The signer is otherwise created successfully.
| Operation |
HTTP |
Tags after (via GET by id) |
| CREATE with tags |
201 |
{} — dropped |
| PATCH with tags |
200 |
persisted ✅ |
| PUT with tags |
200 |
persisted ✅ |
1. Create with tags → 201
curl -k -sS -L -X POST "$API/external-jwt-signers" \
-H "zt-session: $ZT_SESSION" -H 'Content-Type: application/json' \
-d '{
"name": "claude-tags-diagnostic",
"enabled": true,
"issuer": "https://example/issuer",
"audience": "example-aud",
"jwksEndpoint": "https://example/.well-known/jwks.json",
"claimsProperty": "sub",
"useExternalId": false,
"tags": { "managed": "NetFoundry", "network-id": "00000000-0000-0000-0000-000000000000" }
}'
# -> {"data":{...,"id":"<ID>"},"meta":{}}2. Read by id (detail endpoint) → tags are EMPTY
curl -k -sS -L -H 'Accept: application/json' \
-H "zt-session: $ZT_SESSION" \
"$API/external-jwt-signers/<ID>"
# -> "...","tags":{},"..." <-- dropped despite being in the create body
Summary
When core-management provisions a network's managed-auth External JWT Signer, the create request correctly includes tags ({any-tag}), but the resulting signer on the controller has empty tags (tags: {}). The signer is otherwise created successfully.
201{}— dropped2002001. Create with tags →
2012. Read by id (detail endpoint) → tags are EMPTY