How to avoid user revocation in case of wrong password in Zowe CLI access

[FALLAI-Denis]

Hi,

Our users work both with TSO/ISPF and with Zowe CLI through extensions for VS Code, (Zowe Explorer in particular).

MVS passwords should be changed regularly.
Usually this happens during a native z/OS connection in 3270 mode (at the level of the TPX session manager).

If the password used in Zowe CLI profiles are not kept up to date at the same time, this triggers a user revocation at the security system level (RACF), especially when using VS extensions Code because in this case several connections attempts are sent, which fail, and the limit of 5 connections before revocation arrives quickly.

How to avoid these user revocations?

We use the RACF security system and connections are made at z/OSMF level, and possibly FTP, CICS, Db2, Endevor (Web Services).
We do not use Zowe Server (nor Mediation Layer).

Our security teams tell us that they cannot set up an access blocking (invalid password) without at the same time activating the user revocation system after 5 failed attempts.

A solution could be not to save the password in the Zowe CLI profiles (encrypted with SCS) but:

• the user experience will be greatly degraded by forcing you to constantly re-enter passwords ...
• it is not certain that the VS Code extensions work correctly in this configuration: tested with Zowe Explorer, the use of a Zowe CLI profile without a password first triggers a password entry request, then systematically triggers a confirmation of updating the profile to save the password, (and once saved, it becomes impossible to delete the password without recreating the profile).

We would be interested in hearing feedback from user sites on Zowe CLI password management.

[dkelosky]

For REST APIs - like z/OSMF - token authentication appears to avoid revocation. That is, if you obtain a token from a service, you can attempt to authenticate any number of times with an expired / invalid token and you should not revoke your user ID.

Right now, the only tokens we support in "Zowe" is the API ML token (e.g. we'd don't support token auth directly to z/OSMF).