put the if in the wrong location

zsshlib/authenticate.go

@@ -16,6 +16,11 @@ import (
 func NewContext(flags *SshFlags, enableMfaListener bool) ziti.Context {
 	oidcToken := ""
 	var oidcErr error
+
+	if flags.OIDC.OIDCOnly && !flags.OIDC.Mode {
+		flags.OIDC.Mode = true //override Mode to true
+	}
+
 	if flags.OIDC.Mode {
 		oidcToken, oidcErr = OIDCFlow(context.Background(), flags)
 		if oidcErr != nil {

zsshlib/flags.go

@@ -100,9 +100,6 @@ func (f *SshFlags) OIDCFlags(cmd *cobra.Command) {
 	cmd.Flags().BoolVarP(&f.OIDC.Mode, "oidc", "o", false, fmt.Sprintf("toggle OIDC mode. default: %t", defaults.OIDC.Enabled))
 	cmd.Flags().BoolVar(&f.OIDC.OIDCOnly, "oidcOnly", false, "toggle OIDC only mode. default: false")
 	cmd.Flags().StringVar(&f.OIDC.ControllerUrl, "controllerUrl", "", "the url of the controller to use. only used with --oidcOnly")
-	if f.OIDC.OIDCOnly {
-		f.OIDC.Mode = true
-	}
 }
 
 func (f *SshFlags) AddCommonFlags(cmd *cobra.Command) {

zsshlib/ssh.go

@@ -364,7 +364,7 @@ func RetrieveRemoteFiles(client *sftp.Client, localPath string, remotePath strin
 func EstablishClient(f *SshFlags, target string, targetIdentity string) *ssh.Client {
 	ctx := NewContext(f, true)
 	Auth(ctx)
-	
+
 	_, ok := ctx.GetService(f.ServiceName)
 	if !ok {
 		logrus.Fatalf("service not found: %s", f.ServiceName)