incorrectly configured external id shows successful login but should show failure

[CLBRITTON2]

ZET v1.18.7, controller v2.1.0-pre1

Reproduce:

• Created an Auth0 ext-jwt-signer with --claims-property sub and use-external-id on
• Created an auth policy with cert primary auth and that signer as required secondary auth
• Created an identity on that policy and accidentally set its external id to my email instead of the Auth0 sub
• Downloaded the JWT and enrolled it in ZDEW
• ZDEW showed the identity needing IdP auth, so I completed browser auth and got:

OpenZiti by NetFoundry
External token accepted, continue in the app to complete authentication
You may close this window.

It will try to close itself in a few seconds.

ZDEW still shows the identity needing IdP auth, and every browser auth ends the same way.
I expected to see some kind of "authentication failed" for X reason somewhere, but I seemed to end up in a partially authenticated state with no visible error until I fixed my identity external ID instead.

I noticed in the controller log:

Aug 25 15:15:02 ip-172-31-35-55 ziti[49912]: [746102.397]   ERROR ziti/v2/controller/model.getAuthPolicyByExternalId: {authMethod=[ext-jwt] authenticatorId=[] externalId=[google-oauth2|redacted]} identity not found by externalId
Aug 25 15:15:02 ip-172-31-35-55 ziti[49912]: [746102.397]   ERROR ziti/v2/controller/model.(*AuthModuleExtJwt).ProcessSecondary: {authMethod=[ext-jwt] error=[error during authentication policy and identity lookup by claims type [external id] and claim id [google-oauth2|redacted]: INVALID_AUTH: The authentication request failed]} token claim verification failed

So I'm not 100% sure if this is a ZET or C SDK issue.