Are client side z/osmf certificates supported in zowe explorer gui?

[travatine]

Hi,

Please, I've set up client side certificates for authenticating with z/OSMF.

This works with the zowe-cli , for example, I can use the "list data set " command:

 travatine@penguin:~$ zowe zos-files list data-set "travist.**" --host pthsvz1.21csw.com.au 
TRAVIST
TRAVIST.DDIR
TRAVIST.DDIR.D
TRAVIST.DDIR.I
TRAVIST.DIGICERT.CERT.TODAY

This is my config :

    "$schema": "./zowe.schema.json",
    "profiles": {
        "zosmf_x-pthtsx1": {
            "type": "zosmf",
            "properties": {
                "host": "pthtsx1.21csw.com.au",
                "port": 443,
                "rejectUnauthorized": false,
                "certFile": "/home/travatine/jmirror/python-zosmf/certs/pthtsx1.21csw.com.au-TRAVIST.clientCert.pem",
                "certKeyFile": "/home/travatine/jmirror/python-zosmf/certs/pthtsx1.21csw.com.au-TRAVIST.clientCert.pem",
                "protocol": "https"
            },
            "secure": []
        },
        "zosmf_z-pthsvz1": {
            "type": "zosmf",
            "properties": {
                "host": "pthsvz1.21csw.com.au",
                "port": 443,
                "rejectUnauthorized": false,
                "certFile": "/home/travatine/jmirror/python-zosmf/certs/pthsvz1.21csw.com.au-TRAVIST.clientCert.pem",
                "certKeyFile": "/home/travatine/jmirror/python-zosmf/certs/pthsvz1.21csw.com.au-TRAVIST.clientCert.pem",
                "protocol": "https"
            },
            "secure": []
        }
    },
    "defaults": {
        "zosmf": "zosmf_z-pthsvz1"
    },
    "autoStore": true
}

The profiles appear in vs code , however when I attempt to run a data set search, I am asked to supply a user name and password .
Is this expected? ( or have I configured something incorrectly?)

I'm running this version of the extension , V2.8.1

and this vs code :

Version: 1.78.2
Commit: b3e4e68a0bc097f0ae7907b217c1119af9e03435
Date: 2023-05-10T14:47:05.613Z
Electron: 22.5.2
Chromium: 108.0.5359.215
Node.js: 16.17.1
V8: 10.8.168.25-electron.0
OS: Linux x64 5.15.103-17409-g07029265d738
Sandboxed: Yes

In case it is relevant , I ran the following to set up the CA and the client side certificates:

/* Create CERTAUTH */
RACDCERT CERTAUTH GENCERT  -
    SUBJECTSDN(CN('zOSMF Client Cert CA') -
     OU('IZUDFLT')) WITHLABEL('zOSMF Client Cert CA') -
     SIZE(2048) -
     TRUST NOTAFTER(DATE(2099/01/01))  

/* connect the CERTAUTH to the IZUSVR ( zos MF user ) keyring */
RACDCERT ID( IZUSVR ) CONNECT (LABEL('('zOSMF Client Cert CA') -
     RING(IZUKeyringG.letsenc) CERTAUTH)

/* restarted z/OSMF to force it to re-read the keyring & new certauth certificates */
/p izusvr1
/s izusvr1

/* Create client certificate */
RACDCERT ID(TRAVIST) GENCERT -
       SUBJECTSDN( -
       CN('PTHSVZ1 TRAVIST Client Cert') -
        O('21st Century Software') -
        C('AU')) -
        WITHLABEL('PTHSVZ1 TRAVIST Client Cert') -
        SIZE(2048)  -
        NOTAFTER(DATE(2098-01-01)) - 
       SIGNWITH(CERTAUTH LABEL('zOSMF Client Cert CA'))

/* Mark client certificate as trusted */
RACDCERT ALTER  (LABEL('PTHSVZ1 TRAVIST Client Cert')) TRUST

/* Refresh in-store profiles */
setropts raclist(DIGTCERT) refresh

/* Export the certificate to data set */
RACDCERT ID(TRAVIST) EXPORT( - 
        LABEL('PTHSVZ1 TRAVIST Client Cert')) -
        DSN('TRAVIST.CLIENT.CERT') -
      FORMAT(PKCS12DER) PASSWORD('{self.exportKey}')

/* ftp as binary the exported certificate */
ftp ...

/* convert the p12 format certificate to pem using openssl */
e.g.
openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys
openssl pkcs12 -in path.p12 -out newfile.key.pem -nocerts -nodes

/* Create a V1 profile using the zowe cli & and then convert to V2 format profile */

zowe profiles create zosmf-profile z-pthsvz1 --host pthsvz1.21csw.com.au --port 443 --reject-unauthorized false --cert-file ~/jmirror/python-zosmf/certs/pthsvz1.21csw.com.au-TRAVIST.clientCert.pem  --cert-key-file ~/jmirror/python-zosmf/certs/pthsvz1.21csw.com.au-TRAVIST.clientCert.pem

zowe config convert

[EnsonoStevenPerva]

I am experiencing the same thing and came hunting for an answer to this. Happy to provide additional information as well if anyone is looking into this.

[JillieBeanSim]

Thanks for creating the issue @EnsonoStevenPerva that will be used to track the work for certificate support.

[mvseverywhere]

Hi, are there any news regarding this issue? I'm very interested on using some technical accounts and use certificates for the authentication.
Hope this is useful....

I was able to test the client cert login using edge browser and curl using:
curl -k -v -L --cacert c:\tests\user.cert --key c:\test\user.key https://xxxxxxxxxxxx/zosmf >> curlout2.txt

• schannel: disabled automatic use of client certificate
• ALPN: curl offers http/1.1
• ALPN: server did not agree on a protocol. Uses default.
• using HTTP/1.x

GET /zosmf HTTP/1.1
Host:xxxxxxxxxxxxxxxxxxxxxx
User-Agent: curl/8.4.0
Accept: /

< HTTP/1.1 302 Found
< X-Powered-By: Servlet/3.1
< X-Frame-Options: SAMEORIGIN
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< Location: https://xxxxxxxxxxxxxx/zosmf/
< Content-Language: en-US
< Transfer-Encoding: chunked
< Date: Wed, 22 May 2024 07:58:40 GMT
<

• Ignoring the response-body
  { [5 bytes data]
  0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
• Connection #0 to host xxxxxxxxxxxxx left intact
• Issue another request to this URL: 'https://xxxxxxxxxxxxx/zosmf/'
• Found bundle for host: 0x1f79f0b42e0 [serially]
• Re-using existing connection with host xxxxxxxxxxxxx

GET /zosmf/ HTTP/1.1
Host: xxxxxxxxxxxxxx
User-Agent: curl/8.4.0
Accept: /

• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
  < HTTP/1.1 200 OK
  < X-Powered-By: Servlet/3.1
  < X-Frame-Options: SAMEORIGIN
  < X-Content-Type-Options: nosniff
  < X-XSS-Protection: 1; mode=block
  < Strict-Transport-Security: max-age=31536000; includeSubDomains
  < Content-Type: text/html; charset=UTF-8
  < Content-Language: en-US
  < Set-Cookie: JSESSIONID=0000ZPrA2VdoZ_JG1TdzP8Nctp9:68dc923f-9902-41d9-b263-b530699edb68; Path=/; Secure; HttpOnly
  < Transfer-Encoding: chunked
  < Date: Wed, 22 May 2024 07:58:40 GMT
  < Expires: Thu, 01 Dec 1994 16:00:00 GMT
  < Cache-Control: no-cache="set-cookie, set-cookie2"
  <
  { [13781 bytes data]
• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
  { [21596 bytes data]
• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
  { [10554 bytes data]
• schannel: failed to decrypt data, need more data
  { [16384 bytes data]
• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
  { [16392 bytes data]
  100 81389 0 81389 0 0 86836 0 --:--:-- --:--:-- --:--:-- 86836

I got this messages on the zowe.log file
mDetails: {
msg: 'Must have user & password OR base64 encoded credentials',
additionalDetails: "For CLI usage, see ' auth login --help'"
},
mMessage: 'Must have user & password OR base64 encoded credentials'