Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

updating sec credential doc #3337

Merged
merged 8 commits into from
Jan 8, 2024
Merged
8 changes: 8 additions & 0 deletions docs/appendix/zowe-glossary.md
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,14 @@ A more general term used to describe a modular piece of some component. Dependin

A component may have multiple plug-ins, sometimes working together to form a single purpose or user experience, but an individual plug-in belongs to a single component. See [extension](#extension) for additional context.

#### Secure credential store

Secret storage functionality embedded in core Zowe CLI and Zowe Explorer starting from Zowe V2.

Securely stores configured private credentials in the secure vault available on your client operating system. Examples of such vaults include Windows Credential Manager on Microsoft Windows, and Passwords and Keys on Ubuntu Linux.

A separate plug-in of the same name used in Zowe V1 CLI.

#### Service

A service provides one or more APIs, and is identified by a service ID. Note that sometimes the term *service name* can be used to mean *service ID*.
Expand Down
78 changes: 71 additions & 7 deletions docs/user-guide/cli-using-team-managing-credential-security.md
Original file line number Diff line number Diff line change
@@ -1,15 +1,79 @@
# Managing credential security

When you first run the `zowe config init --global-config` command, the `profiles.base.properties.user` and `profiles.base.properties.password` fields are defined to the "secure" array in your configuration file, which helps to ensure that the username and password are stored securely on your computer.
## Secure credential storage

To store or update values for the secure fields (for example, when you want to change your username and password), issue the `zowe config secure` command. If, for example, you want to update several property values in a long list of properties, press Enter to skip a field.
With the introduction of team profiles in Zowe CLI V2, the **Secure Credential Store (SCS) Plug-in** is deprecated. The `zowe scs` command group is obsolete.

To secure a specific field, issue `zowe config set --secure <property-path>`. For example, `zowe config set --secure profiles.base.properties.password`. When you issue the command for an option that is already secured, the CLI prompts you to enter a new option value.
Secure credential encryption is now included with the Zowe CLI core application. When a command using a profile with missing `user` and `password` information is issued, Zowe CLI V2 prompts you to enter the username and password. Both are then stored securely by default.

You can use an editor to define options to the secure array in `zowe.config.json`. Any option that you define to there becomes secure/prompted-for.
For other ways to store credentials securely, use the `zowe config` command group. See the following instructions.

## Changes to secure credential storage
## Configuring secure properties
anaxceron marked this conversation as resolved.
Show resolved Hide resolved

With the introduction of team profiles in Zowe CLI V2, the **Secure Credential Store (SCS) Plug-in** is deprecated. The `zowe scs` command group is obsolete. Secure credential encryption is now included with the Zowe CLI core application.
Create a configuration file and set its secure properties (such as usernames and passwords):

Zowe CLI V2 prompts you to enter the `username` and `password` securely by default. Commands in the `zowe config` command group let you manage security for any option value.
1. Open the Zowe CLI command prompt.

2. To initialize a **project team** configuration file in the current working directory:

```
zowe config init
```
To initialize a **project user** configuration file in the current working directory:
```
zowe config init --user-config
```
To initialize a **global team** configuration file in the `ZOWE_CLI_HOME` directory:
```
zowe config init --global-config
```
To initialize a **global user** configuration file in the `ZOWE_CLI_HOME` directory:

```
zowe config init --global-config --user-config
```
A configuration file is created, if one does not already exist.

Additionally, the `profiles.base.properties.user` and `profiles.base.properties.password` fields are added to the base profile `secure` array for that configuration file. This stores the username and password in the [secure credential store](../appendix/zowe-glossary#secure-credential-store).

3. If needed, add other fields to the secure array.
- Use a text editor or an IDE (such as Visual Studio Code) to edit the configuration file.
- Issue the `zowe config set --secure <property-path>` command to secure a specific property in a specific profile.

For example, `zowe config set profiles.base.properties.password pw123 --secure` adds the `password` property to the base profile's `secure` array and saves the password `pw123` in the secure credential store.

If you issue the command for a property that is already secured, the CLI prompts you to enter a new property value.

The values for these properties are saved in the secure credential store.

## Updating secure properties
anaxceron marked this conversation as resolved.
Show resolved Hide resolved

Update secure credentials in an existing config profile:

1. Open the Zowe CLI command prompt.

2. To update values for secure fields in a **project team** configuration file:
```
zowe config secure
```
To update values for secure fields in a **project user** configuration file:
```
zowe config secure --user-config
```
To update values for secure fields in a **global team** configuration file:
```
zowe config secure --global-config
```
To update values for secure fields in a **global user** configuration file:
```
zowe config secure --global-config --user-config
```
Prompts request new values for all secure fields defined in the configuration file. In most cases, these properties include a username or password, but some users may include other fields, such as a token value or connection properties.

3. Respond to prompts as needed. Press `Enter` to leave the value unchanged.

New values are saved in the secure credential store. After the last secure value is submitted, the user returns to the system command prompt.

## Setting secure properties programmatically

When configuring secure properties with scripts or workflow pipelines, use the `zowe config set` command. See Step 3 in [Configuring secure properties](#configuring-secure-properties) for instructions on how to use the command.
36 changes: 29 additions & 7 deletions docs/user-guide/cli-using-using-team-profiles.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,23 +6,49 @@ Zowe CLI V2 introduces the concept of **team profiles**, which add *team* config

Both team and user configurations can be applied either *globally* or *per project*, as described in the following definitions:

- A **team configuration file** stores *team profiles* and is used by a group of people who need the same properties to run commands.

- A **user configuration file** stores *user profiles* and is used for one person who needs their own unique properties to run commands.

- A **team configuration file** stores *team profiles* and is used by a group of people who need the same properties to run commands.
- A **project configuration file** resides in a directory of your choice. It contains project *user profiles* and project *team profiles*.

- A **global configuration file** resides in the `ZOWE_CLI_HOME` directory (YourUserHomeDirectory/.zowe, by default). It contains global *user profiles* and global *team profiles*.

- A **project configuration file** resides in a directory of your choice. It contains project *user profiles* and project *team profiles*.

## Zowe CLI profile types

Configuration files are made up of multiple profiles that can be used by Zowe CLI. These profiles contain credentials and/or settings that are applied by the commands run in the CLI.

The following profile types were introduced in Zowe V1 and continue to be used in Zowe V2:

- **Base profiles** let you store connection information for use with one or more services. Your service profiles can pull information from base profiles as needed, so that you can specify a common username and password once. The base profile can optionally store tokens to connect to Zowe API Mediation Layer, which improves security by enabling Multi-Factor Authentication (MFA) and Single Sign-on (SSO).

- **Service profiles** let you store connection information for specific mainframe service, such as IBM z/OSMF. Plug-ins can introduce other service profile types, such as the `cics` profile to connect to IBM CICS.

- **Base profiles** let you store connection information for use with one or more services. Your service profiles can pull information from base profiles as needed, so that you can specify a common username and password once. The base profile can optionally store tokens to connect to Zowe API Mediation Layer, which improves security by enabling Multi-Factor Authentication (MFA) and Single Sign-on (SSO).
## Updating secure credentials

To change an existing username or password in a team config profile, use the `zowe config secure` command for a quick update.

To update a username or password:

1. Open the Zowe CLI command prompt.

2. To update values for secure fields in a **project team** configuration file:
```
zowe config secure
```
To update values for secure fields in a **global team** configuration file:
```
zowe config secure --global-config
```
Prompts request new values for all secure fields defined in the configuration file. In most cases, these properties include a username or password, but some users may include other fields, such as a token value or connection properties.

3. Respond to prompts as needed. Press `Enter` to leave the value unchanged.

New values are saved in the [secure credential store](../appendix/zowe-glossary#secure-credential-store). After the last secure value is submitted, the user returns to the system command prompt.

For more ways to secure credentials in config profiles, see [Managing credential security](../user-guide/cli-using-team-managing-credential-security).

## Benefits of team profiles

Using team profiles in configuration files helps to improve the initial setup of Zowe CLI by making service connection details easier to share and easier to store within projects.
Expand Down Expand Up @@ -54,10 +80,6 @@ You can continue using Zowe CLI V1 profiles with Zowe CLI V2. However, we highly

:::


- Commands in the `zowe config` [command group](../user-guide/cli-using-understanding-core-command-groups#config) now let you manage security for any option value.

- The `zowe scs` and `zowe config` command groups were repurposed to work with team profiles.

- Zowe CLI V2 prompts you to enter the username and password securely by default.

2 changes: 1 addition & 1 deletion docs/user-guide/systemrequirements-cli.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ To install Node.js:

1. Go to [Node.js LTS](https://nodejs.org/en/) to select and install a runtime version with active support.

For a list of supported LTS versions, see [Nodejs Releases](https://https://nodejs.org/en/about/previous-releases).
For a list of supported LTS versions, see [Nodejs Releases](https://nodejs.org/en/about/previous-releases).

2. Restart the command prompt after installing Node.js, if required.

Expand Down
Loading