zowe / zowe/api-layer

/gateway/api/v1/auth/ticket does not accept OIDC token

Open
#4,444 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug Priority: High size/S
Dominant language
Java
Stars
92
Forks
81
Avg merge
1d 9h
Merged PRs (30d)
46

Description

I have Zowe v3.3 configured with OIDC, and can successfully call: /gateway/api/v1/auth/oidc-token/validate passing header "Authorization: Bearer {{oidc-token}}"

I've also called other APIs such as /ibmzosmf/api/v1/zosmf/tsoApp/v1/tso for the TSO command "LU" (again with header "Authorization: Bearer {{oidc-token}}"), and I can see that the tso command is executed for the userid mapped from the OIDC id to RACF userid with RACMAP.

However, if I call /gateway/api/v1/auth/ticket it does not accept the ODIC token

{ "messages": [ { "messageType": "ERROR", "messageNumber": "ZWEAO402E", "messageContent": "The request has not been applied because it lacks valid authentication credentials.", "messageAction": "Review the product documentation for more details about acceptable authentication. Verify that your credentials are valid and contact security administrator to obtain valid credentials.", "messageReason": "The accessed resource requires authentication. The request is missing valid authentication credentials or the token expired.", "messageKey": "org.zowe.apiml.common.unauthorized" } ] }

It looks like OIDC tokens is not accepted by the /gateway/api/v1/auth/ticket endpoint?
Is there any reason for that?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the request to /gateway/api/v1/auth/ticket with the OIDC bearer token, then compare it with /gateway/api/v1/auth/oidc-token/validate and the working TSO API call described in the report. Check the product documentation for the endpoint's accepted credentials and determine whether the observed rejection is expected or identifies a defect; done means the behavior is explained and the issue has a clear resolution path.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.