AuthExceptionHandler references the message key defined in zaas-log-messages.yml.

Describe the bug

AuthExceptionHandler (in apiml-security-common) references the message key org.zowe.apiml.zaas.security.schema.missingAuthentication, which is only defined in zaas-log-messages.yml. However, the API Catalog loads its own set of message files that does not include zaas-log-messages.yml, so when an InsufficientAuthenticationException is handled by the API Catalog's DefaultExceptionHandler, the message service cannot resolve the key and logs a warning:

Invalid message key 'org.zowe.apiml.zaas.security.schema.missingAuthentication' was used. Please resolve this problem.

Steps to Reproduce

1. Deploy Zowe with the API Catalog running.
2. Send a request to the API Catalog that triggers an InsufficientAuthenticationException (e.g. a request missing authentication credentials).
3. Observe the server log for the API Catalog process.

Expected behavior

The message key org.zowe.apiml.zaas.security.schema.missingAuthentication resolves correctly in all services that use AuthExceptionHandler, with no "Invalid message key" warning in the logs.

Screenshots

N/A

Logs

2026-05-13 13:03:33.305 ZWEAAC1:https-jsse-nio-0.0.0.0-7552-exec-5:16777303 DEBUG ((o.z.a.m.c.AbstractMessageService)) Invalid message key 'org.zowe.apiml.zaas.security.schema.missingAuthentication' was used. Please resolve this problem.

Details

• Version and build number: v3.x.x
• Test environment: N/A — reproducible locally

API Catalog Web UI (in case of API Catalog issue):

• N/A — server-side log issue, not UI-specific

REST API client (in case of REST API issue):

• N/A

Additional context

The root cause is an architectural mismatch: the message key is defined in zaas-log-messages.yml (a ZAAS-service-specific file) but is consumed from AuthExceptionHandler in apiml-security-common, which is a shared module used across multiple services including the API Catalog.

Relevant files:

• apiml-security-common/src/main/java/org/zowe/apiml/security/common/error/AuthExceptionHandler.java:175 — hardcodes the ZAAS-specific message key
• zaas-service/src/main/resources/zaas-log-messages.yml:196 — where the key is defined
• api-catalog-services/src/main/java/org/zowe/apiml/apicatalog/config/BeanConfig.java — loads message files but omits zaas-log-messages.yml
• api-catalog-services/src/main/java/org/zowe/apiml/apicatalog/controllers/handlers/DefaultExceptionHandler.java — wires AuthExceptionHandler into the API Catalog

Proposed fix: Move the org.zowe.apiml.zaas.security.schema.missingAuthentication message definition from zaas-log-messages.yml into security-common-log-messages.yml, which is loaded by all affected services. This aligns the message definition's location with where it is actually used (shared security infrastructure).

Start with AuthExceptionHandler.java at line 175 and compare the message definition in zaas-log-messages.yml with the files loaded by api-catalog-services BeanConfig.java. Check how DefaultExceptionHandler wires AuthExceptionHandler, then verify that the key resolves without an Invalid message key warning in the API Catalog.