misleading prompt of updating config file with autoStore:false

[JillieBeanSim]

@traeok This fix does not work for me. When I have my credentials manager disables and autoStore:false I still get this dialog. Clicking on Save Credentials will not save, which is good, but the dialog is confusing. Cancel does not cancel but continue with the entered credentials.

So we need a different or better no dialog when autoStore:false.

Originally posted by @phaumer in #3524 (comment)

additional conversation:

@phaumer I did not make any changes to how the credential manager is handled or how plaintext credentials are stored in this PR. This improves the behavior where autoStore is false but the secure credential manager is enabled, and these settings are independent of one another. In the case where autoStore is false and the secure credential manager is enabled, this PR fixes the issue where in-memory credentials were wiped as a result of an unnecessary refresh in Zowe Explorer.

It sounds like we may need to adjust prompting based on the use of a secure credential manager. We can address this separately, but this fix does resolve the scenario where autoStore is disabled.

[github-actions]

Thank you for creating a bug report.
We will investigate the bug and evaluate its impact on the product.
If you haven't already, please ensure you have provided steps to reproduce the bug and as much context as possible.

[traeok]

Just to clarify, this message is only shown when the secure credential manager is disabled and does not depend on autoStore: false. We'll just need to adjust this dialog to show the proper text when autoStore is disabled. @t1m0thyj was looking into behaviors regarding the disabled secure credential manager, he might be able to provide more context here.

Update: In hindsight, the fix is a bit different than what I initially described - see details below

[phaumer]

Thanks for clarifying @traeok. For me autoStore's main use case is with no credentials manager. We are kind of broken if we run on a platform that does not have support for the default credentials manager. We show dialogs like these that are ignorant of the autoStore settings.

Also the K8s extension is also broken right now, so there is no alternative for Che other than prompting and that is broken with this dialog as well. We should also work on a credentials manager that uses env variables that can be used with all kinds of Cloud-based solution such as Codespaces, Strong Network, etc.

[traeok]

No problem @phaumer - I wanted to dig into this further, but realized that this prompt should really depend on the value of the credentialManager property and didn't want to make the PR any bigger 😅 Feel free to correct me if I'm missing something, but I believe the "save credentials" prompt should be updated so that it only prompts when the credential manager is explicitly disabled on their machine. When a custom credential manager is in use, this prompt is ineffective (one could also argue its insecure) and shouldn't be shown.

[phaumer]

Agreed. The dialog should show when credentials managers are disabled and autoStore is true. If it is false then the dialog is also not needed.

[traeok]

Would it be reasonable to rename this issue to omit autoStore: false to avoid any confusion? Currently the dialog is shown when the "team config is not secured" (using ProfileInfo.isSecured) and the prompting needs refactored regardless of the value of autoStore.

[JillieBeanSim]

it's specific to autoStore:false, the message shouldn't show if nothing is being written to file or secure credentials. When autoStore:true then whether it is secure or not something is being written either to file in plain text or to credential manager.

[traeok]

Maybe I'm missing something - but what about when the credential manager is set to a custom one? In that case we shouldn't show this dialog regardless of what the value of autoStore is.

[JillieBeanSim]

Maybe I'm missing something, about when the credential manager is not the default but a custom one? In that case we shouldn't show this dialog regardless of what the value of autoStore is.

there is suppose to be a message making users aware if autoStore:true and disabled used of secure credential setting that it is being written in plain text. It just shouldn't show when autoStore:false since nothing written. Just need an extra check before presenting message to user.

[traeok]

Sorry for the confusion, I didn't realize that our isSecured function factors in the presence of a custom credential manager. It sounds like this is mostly for handling environments where the credential manager is completely external and not integrated as an extension/plug-in for Zowe, which explains why the credential manager is disabled in Peter's case. Thanks for clarifying

[t1m0thyj]

Had some internal discussion with the team about how we expect autoStore to behave in ZE which resulted in the following table. Does this seem correct? We can discuss further at standup 😋

AutoStore [1]	CredMgr [2]	Expected Behavior [3]
True	Enabled	Store creds securely without prompting
True	Disabled	If cred already stored in plain text, store insecurely w/o prompting Else, prompt to store creds in plain text
False	-	Cache creds temporarily in memory

[1] The value of autoStore property in team configuration file
[2] The value of "Secure Credentials Enabled" setting in Zowe Explorer
[3] Based on https://docs.zowe.org/stable/user-guide/ze-usage/#credentials-in-zowe-explorer