← All modules — full architecture

Meridian Logistics — OpenZiti 2.0 architecture

High-level design — click any component to drill into its low-level design
Module 05: Identity, enrollment & PKI — external IdP (Entra) · verified against OpenZiti v2.0.3
Read the guides: Certificates · OIDC and tokens
M05 · Identity & PKI
✕ Close
External IdP (Entra) Identity Signer / auth-policy Tunneler (user) Controller / service lines: auth / OIDC dial (hosting)
Control plane (M03) ctrl1 · ctrl2 · ctrl3 · OIDC provider controller config Microsoft Entra ID external IdP · OIDC / JWT app registration openziti-meridian role Logistics → #remote-users logistics user Entra-backed · tunneler 1 · OIDC sign-in external-jwt-signer validates iss / aud · JWKS 2 · JWT auth-policy primary ext-jwt · MFA (TOTP) identity Entra-backed 3 · claim → identity meridian-yard yard.meridian.internal 4 · Dial enrollment methods 3rd-party CA (concept) cert lifecycle
Tip: click Entra, the signer, the auth-policy, the identity, the hosted service, the M03 control plane, or a concept chip (enrollment / CA / cert lifecycle).
From the course Enterprise Zero Trust Architecture with OpenZiti 2.0 · cawachlabs.com · Guides Meridian Logistics is a fictional company. © 2026 CawachLabs · by Girish Reddy. All rights reserved. Not affiliated with or endorsed by the OpenZiti project. Icons adapted from Lucide (ISC, parts MIT).
TrademarksMicrosoft, Azure and Microsoft Entra are trademarks of the Microsoft group of companies. Docker is a trademark or registered trademark of Docker, Inc. in the United States and/or other countries. Kubernetes, Helm and SPIFFE are registered trademarks of The Linux Foundation in the United States and/or other countries. OpenTofu is a registered trademark of LF Projects, LLC. Ubuntu is a registered trademark of Canonical Ltd. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries. Elasticsearch and Kibana are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries. Grafana is a trademark of Raintank, Inc. dba Grafana Labs. Other names belong to their owners. CawachLabs is independent and not affiliated with or endorsed by these companies.