/gateway/api/v1/auth/ticket does not accept OIDC token
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 92
- Forks
- 81
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 46
Description
I have Zowe v3.3 configured with OIDC, and can successfully call: /gateway/api/v1/auth/oidc-token/validate passing header "Authorization: Bearer {{oidc-token}}"
I've also called other APIs such as /ibmzosmf/api/v1/zosmf/tsoApp/v1/tso for the TSO command "LU" (again with header "Authorization: Bearer {{oidc-token}}"), and I can see that the tso command is executed for the userid mapped from the OIDC id to RACF userid with RACMAP.
However, if I call /gateway/api/v1/auth/ticket it does not accept the ODIC token
{ "messages": [ { "messageType": "ERROR", "messageNumber": "ZWEAO402E", "messageContent": "The request has not been applied because it lacks valid authentication credentials.", "messageAction": "Review the product documentation for more details about acceptable authentication. Verify that your credentials are valid and contact security administrator to obtain valid credentials.", "messageReason": "The accessed resource requires authentication. The request is missing valid authentication credentials or the token expired.", "messageKey": "org.zowe.apiml.common.unauthorized" } ] }
It looks like OIDC tokens is not accepted by the /gateway/api/v1/auth/ticket endpoint?
Is there any reason for that?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the request to /gateway/api/v1/auth/ticket with the OIDC bearer token, then compare it with /gateway/api/v1/auth/oidc-token/validate and the working TSO API call described in the report. Check the product documentation for the endpoint's accepted credentials and determine whether the observed rejection is expected or identifies a defect; done means the behavior is explained and the issue has a clear resolution path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100