Are client side z/osmf certificates supported in zowe explorer gui?

[travatine]

Hi,

Please, I've set up client side certificates for authenticating with z/OSMF.

This works with the zowe-cli , for example, I can use the "list data set " command:

 travatine@penguin:~$ zowe zos-files list data-set "travist.**" --host pthsvz1.21csw.com.au 
TRAVIST
TRAVIST.DDIR
TRAVIST.DDIR.D
TRAVIST.DDIR.I
TRAVIST.DIGICERT.CERT.TODAY

This is my config :

    "$schema": "./zowe.schema.json",
    "profiles": {
        "zosmf_x-pthtsx1": {
            "type": "zosmf",
            "properties": {
                "host": "pthtsx1.21csw.com.au",
                "port": 443,
                "rejectUnauthorized": false,
                "certFile": "/home/travatine/jmirror/python-zosmf/certs/pthtsx1.21csw.com.au-TRAVIST.clientCert.pem",
                "certKeyFile": "/home/travatine/jmirror/python-zosmf/certs/pthtsx1.21csw.com.au-TRAVIST.clientCert.pem",
                "protocol": "https"
            },
            "secure": []
        },
        "zosmf_z-pthsvz1": {
            "type": "zosmf",
            "properties": {
                "host": "pthsvz1.21csw.com.au",
                "port": 443,
                "rejectUnauthorized": false,
                "certFile": "/home/travatine/jmirror/python-zosmf/certs/pthsvz1.21csw.com.au-TRAVIST.clientCert.pem",
                "certKeyFile": "/home/travatine/jmirror/python-zosmf/certs/pthsvz1.21csw.com.au-TRAVIST.clientCert.pem",
                "protocol": "https"
            },
            "secure": []
        }
    },
    "defaults": {
        "zosmf": "zosmf_z-pthsvz1"
    },
    "autoStore": true
}

The profiles appear in vs code , however when I attempt to run a data set search, I am asked to supply a user name and password .
Is this expected? ( or have I configured something incorrectly?)

I'm running this version of the extension , V2.8.1

and this vs code :

Version: 1.78.2
Commit: b3e4e68a0bc097f0ae7907b217c1119af9e03435
Date: 2023-05-10T14:47:05.613Z
Electron: 22.5.2
Chromium: 108.0.5359.215
Node.js: 16.17.1
V8: 10.8.168.25-electron.0
OS: Linux x64 5.15.103-17409-g07029265d738
Sandboxed: Yes

In case it is relevant , I ran the following to set up the CA and the client side certificates:

/* Create CERTAUTH */
RACDCERT CERTAUTH GENCERT  -
    SUBJECTSDN(CN('zOSMF Client Cert CA') -
     OU('IZUDFLT')) WITHLABEL('zOSMF Client Cert CA') -
     SIZE(2048) -
     TRUST NOTAFTER(DATE(2099/01/01))  

/* connect the CERTAUTH to the IZUSVR ( zos MF user ) keyring */
RACDCERT ID( IZUSVR ) CONNECT (LABEL('('zOSMF Client Cert CA') -
     RING(IZUKeyringG.letsenc) CERTAUTH)

/* restarted z/OSMF to force it to re-read the keyring & new certauth certificates */
/p izusvr1
/s izusvr1

/* Create client certificate */
RACDCERT ID(TRAVIST) GENCERT -
       SUBJECTSDN( -
       CN('PTHSVZ1 TRAVIST Client Cert') -
        O('21st Century Software') -
        C('AU')) -
        WITHLABEL('PTHSVZ1 TRAVIST Client Cert') -
        SIZE(2048)  -
        NOTAFTER(DATE(2098-01-01)) - 
       SIGNWITH(CERTAUTH LABEL('zOSMF Client Cert CA'))

/* Mark client certificate as trusted */
RACDCERT ALTER  (LABEL('PTHSVZ1 TRAVIST Client Cert')) TRUST

/* Refresh in-store profiles */
setropts raclist(DIGTCERT) refresh

/* Export the certificate to data set */
RACDCERT ID(TRAVIST) EXPORT( - 
        LABEL('PTHSVZ1 TRAVIST Client Cert')) -
        DSN('TRAVIST.CLIENT.CERT') -
      FORMAT(PKCS12DER) PASSWORD('{self.exportKey}')

/* ftp as binary the exported certificate */
ftp ...

/* convert the p12 format certificate to pem using openssl */
e.g.
openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys
openssl pkcs12 -in path.p12 -out newfile.key.pem -nocerts -nodes

/* Create a V1 profile using the zowe cli & and then convert to V2 format profile */

zowe profiles create zosmf-profile z-pthsvz1 --host pthsvz1.21csw.com.au --port 443 --reject-unauthorized false --cert-file ~/jmirror/python-zosmf/certs/pthsvz1.21csw.com.au-TRAVIST.clientCert.pem  --cert-key-file ~/jmirror/python-zosmf/certs/pthsvz1.21csw.com.au-TRAVIST.clientCert.pem

zowe config convert

[EnsonoStevenPerva]

I am experiencing the same thing and came hunting for an answer to this. Happy to provide additional information as well if anyone is looking into this.

[JillieBeanSim]

Thanks for creating the issue @EnsonoStevenPerva that will be used to track the work for certificate support.

[mvseverywhere]

Hi, are there any news regarding this issue? I'm very interested on using some technical accounts and use certificates for the authentication.
Hope this is useful....

I was able to test the client cert login using edge browser and curl using:
curl -k -v -L --cacert c:\tests\user.cert --key c:\test\user.key https://xxxxxxxxxxxx/zosmf >> curlout2.txt

• schannel: disabled automatic use of client certificate
• ALPN: curl offers http/1.1
• ALPN: server did not agree on a protocol. Uses default.
• using HTTP/1.x

GET /zosmf HTTP/1.1
Host:xxxxxxxxxxxxxxxxxxxxxx
User-Agent: curl/8.4.0
Accept: /

< HTTP/1.1 302 Found
< X-Powered-By: Servlet/3.1
< X-Frame-Options: SAMEORIGIN
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< Location: https://xxxxxxxxxxxxxx/zosmf/
< Content-Language: en-US
< Transfer-Encoding: chunked
< Date: Wed, 22 May 2024 07:58:40 GMT
<

• Ignoring the response-body
  { [5 bytes data]
  0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
• Connection #0 to host xxxxxxxxxxxxx left intact
• Issue another request to this URL: 'https://xxxxxxxxxxxxx/zosmf/'
• Found bundle for host: 0x1f79f0b42e0 [serially]
• Re-using existing connection with host xxxxxxxxxxxxx

GET /zosmf/ HTTP/1.1
Host: xxxxxxxxxxxxxx
User-Agent: curl/8.4.0
Accept: /

• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
  < HTTP/1.1 200 OK
  < X-Powered-By: Servlet/3.1
  < X-Frame-Options: SAMEORIGIN
  < X-Content-Type-Options: nosniff
  < X-XSS-Protection: 1; mode=block
  < Strict-Transport-Security: max-age=31536000; includeSubDomains
  < Content-Type: text/html; charset=UTF-8
  < Content-Language: en-US
  < Set-Cookie: JSESSIONID=0000ZPrA2VdoZ_JG1TdzP8Nctp9:68dc923f-9902-41d9-b263-b530699edb68; Path=/; Secure; HttpOnly
  < Transfer-Encoding: chunked
  < Date: Wed, 22 May 2024 07:58:40 GMT
  < Expires: Thu, 01 Dec 1994 16:00:00 GMT
  < Cache-Control: no-cache="set-cookie, set-cookie2"
  <
  { [13781 bytes data]
• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
  { [21596 bytes data]
• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
  { [10554 bytes data]
• schannel: failed to decrypt data, need more data
  { [16384 bytes data]
• schannel: failed to decrypt data, need more data
• schannel: failed to decrypt data, need more data
  { [16392 bytes data]
  100 81389 0 81389 0 0 86836 0 --:--:-- --:--:-- --:--:-- 86836

I got this messages on the zowe.log file
mDetails: {
msg: 'Must have user & password OR base64 encoded credentials',
additionalDetails: "For CLI usage, see ' auth login --help'"
},
mMessage: 'Must have user & password OR base64 encoded credentials'

[t1m0thyj]

@mvseverywhere Client-size z/OSMF certificates are partially supported in Zowe Explorer now - only if the certFile and certKeyFIle options have already been added to your zosmf profile by using Zowe CLI or manually editing your zowe.config.json.

We have an enhancement in our backlog to track adding an option for configuring client-side certs in the ZE GUI: #3715