Delegated passticket API by Joe-Winchester · Pull Request #4925 · zowe/docs-site

Joe-Winchester · 2026-02-05T18:07:00Z

PR to support the APIML PR zowe/api-layer#4368

Signed-off-by: Joe Winchester <winchest@uk.ibm.com>

github-actions · 2026-02-05T18:07:16Z

😺 Thank you for creating this PR! To publish your content to Zowe Docs, follow these required steps.

Add the label review: doc.
Identify your content topic with a label. (Examples: area: apiml, area: cli, area: install and config, etc.)
Specify the major Zowe release(s) for your content. (Examples: release: V1, release: V2, release: V3)
- If adding content that needs to be removed from V3 documentation, add the V3 N/A tag.
Select the master branch if your PR updates content that is on the live site. Select docs-staging if your PR updates content for a future release.
Notify the Doc Squad about this PR. If you don't know whom should review your content, message the #zowe-doc Slack channel. If you know which Doc Squad writer should approve your content, add that person as a reviewer.

Need help? Contact the Doc Squad in the #zowe-doc Slack channel.

github-actions · 2026-02-05T18:07:18Z

⚠️ Looks like something is wrong with the PR description. Remember to add a description and the file(s) included in this PR.

If you have addressed this issue already, refresh this page in your browser to remove this comment.

github-actions · 2026-02-05T18:13:42Z

🚀 Deployed on https://698c8be7b7ed8434ecbd4541--zowe-docs-master.netlify.app

taban03 · 2026-02-06T09:39:48Z

docs/user-guide/api-mediation/configuration-delegated-passticket.md

+:::info Role: system administrator
+:::
+
+As a system administrator, you can enable the endpoint of the API Gateway that allows passticket generation for a delegated e-mail.  This API allows the authenticated user to create a passticket for another user, so has the potential be be misused for priviledge escalation or impersonation.  For that reason the API authentication must be done with a client certificate for a userID who has `READ` access to the class `ZOWE.APIML.DELEGATE.PASSTICKET` and the endpoint must be enabled by setting `zowe.components.gateway.apiml.security.delegatePassticket` parameter to `true`.


I think this property should also be listed here docs/appendix/zowe-yaml-configuration.md.

Good catch !
I've added a section to https://github.com/zowe/docs-site/pull/4925/changes#diff-4aa9da9e24586a19b2d4ccf057707a6f4b9f0f7cb559d83c4c8339e0ad437d39.

taban03 · 2026-02-06T09:42:07Z

docs/user-guide/api-mediation/configuration-delegated-passticket.md

+
+1. Define the resource class by running the command:
+
+    ```racf


Could we include the equivalent commands for TSS and ACF2 as well?

taban03 · 2026-02-06T09:44:04Z

docs/user-guide/api-mediation/configuration-delegated-passticket.md

+        apiml:
+            gateway:
+                security:
+                    delegatePassticket: false


shouldn't be true in this example?

Yes my bad - thank you for picking that up

taban03 · 2026-02-06T09:45:17Z

Left few comments, otherwise LGTM. Leaving it for @janan07 review

taban03 · 2026-02-06T09:53:22Z

As a side-note: There also used to be a file authentication-for-apiml-services.md that was documenting the auth GW endpoints (including auth/ticket) but I've seen it was removed for v3. Was there a reason for it? @janan07 It looks this endpoint is not documented anywhere now for v3.

Martin-Zeithaml · 2026-02-09T08:59:23Z

docs/user-guide/api-mediation/configuration-delegated-passticket.md

+:::info Role: system administrator
+:::
+
+As a system administrator, you can enable the endpoint of the API Gateway that allows passticket generation for a delegated e-mail.  This API allows the authenticated user to create a passticket for another user, so has the potential be be misused for priviledge escalation or impersonation.  For that reason the API authentication must be done with a client certificate for a userID who has `READ` access to the class `ZOWE.APIML.DELEGATE.PASSTICKET` and the endpoint must be enabled by setting `zowe.components.gateway.apiml.security.delegatePassticket` parameter to `true`.


priviledge -> privilege

Good catch - thank you. Fix in the latest PR commit.

Martin-Zeithaml · 2026-02-09T09:02:16Z

docs/user-guide/api-mediation/configuration-delegated-passticket.md

+components:
+    gateway:
+        apiml:
+            gateway:
+                security:
+                    delegatePassticket: false


There is an indentation of 4 spaces, which is fine. But we are usually using 2 spaces in examples. I would suggest to use 2 spaces.

Yes my bad for using 4 as I had done tab indents.
2 is the right indent for yaml so I've fixed this in the latest commit

Martin-Zeithaml · 2026-02-09T09:03:16Z

docs/user-guide/api-mediation/configuration-delegated-passticket.md

+```
+{
+    "applId": "APPLID",
+    "emailId": "email@domain.com"


email@domain.com -> email@example.com

Good catch - fixed in the latest commit.
Thank you !

Signed-off-by: Joe Winchester <winchest@uk.ibm.com>

Corrected indentation in YAML example and improved formatting. Signed-off-by: Martin Zeithaml <66114686+Martin-Zeithaml@users.noreply.github.com>

Martin-Zeithaml · 2026-02-10T07:41:24Z

docs/user-guide/api-mediation/configuration-delegated-passticket.md

+components:
+  gateway:
+    apiml:
+      security:
+        delegatePassticket: true


Is this correct? From the PR, it looks like

@ConditionalOnProperty(value = "apiml.security.delegatePassticket.enabled", havingValue = "true", matchIfMissing = false)

Should be

components: apiml: security: delegatePassticket: enabled: true

@taban03 Could you verify this? Thanks.

Good catch @Martin-Zeithaml . Yes that should be like you suggested

Signed-off-by: Andrew Jandacek <andrew.jandacek@broadcom.com>

janan07 · 2026-02-10T11:22:06Z

docs/user-guide/api-mediation/configuration-delegated-passticket.md

+
+<summary>Click here for command details to configure user access using Top Secret.</summary>
+
+**For Top Secret:**  


TSS commands are missing.

Signed-off-by: Andrew Jandacek <andrew.jandacek@broadcom.com>

Signed-off-by: Martin Zeithaml <66114686+Martin-Zeithaml@users.noreply.github.com>

Updated configuration steps for enabling delegated PassTicket. Signed-off-by: Martin Zeithaml <66114686+Martin-Zeithaml@users.noreply.github.com>

Delegated passticket API

fff495f

Signed-off-by: Joe Winchester <winchest@uk.ibm.com>

Joe-Winchester requested a review from taban03 February 5, 2026 18:07

Joe-Winchester added review: doc Needs review by Doc Squad member area: apiml This issue is related to Zowe API Mediation Layer release: V3 Zowe V3 content labels Feb 5, 2026

github-actions bot temporarily deployed to pull request February 5, 2026 18:13 Inactive

Joe-Winchester mentioned this pull request Feb 5, 2026

feat: API for delegating credentials to generate a z/OS PassTicket zowe/api-layer#4368

Open

15 tasks

taban03 reviewed Feb 6, 2026

View reviewed changes

taban03 requested a review from janan07 February 6, 2026 09:45

Martin-Zeithaml reviewed Feb 9, 2026

View reviewed changes

Joe-Winchester added 2 commits February 9, 2026 18:25

Updates following PR review

8ec850d

Signed-off-by: Joe Winchester <winchest@uk.ibm.com>

Fixed space indent from 4 to 2

f218a66

Signed-off-by: Joe Winchester <winchest@uk.ibm.com>

github-actions bot temporarily deployed to pull request February 9, 2026 18:37 Inactive

Fix formatting in YAML

0df2edb

Corrected indentation in YAML example and improved formatting. Signed-off-by: Martin Zeithaml <66114686+Martin-Zeithaml@users.noreply.github.com>

Martin-Zeithaml reviewed Feb 10, 2026

View reviewed changes

github-actions bot temporarily deployed to pull request February 10, 2026 07:43 Inactive

initial language refactoring

8df9323

Signed-off-by: Andrew Jandacek <andrew.jandacek@broadcom.com>

github-actions bot temporarily deployed to pull request February 10, 2026 10:05 Inactive

language refactor and restructure

13a9a73

Signed-off-by: Andrew Jandacek <andrew.jandacek@broadcom.com>

janan07 reviewed Feb 10, 2026

View reviewed changes

fix overview steps

4291f0a

Signed-off-by: Andrew Jandacek <andrew.jandacek@broadcom.com>

github-actions bot temporarily deployed to pull request February 10, 2026 11:31 Inactive

Martin-Zeithaml added 2 commits February 11, 2026 14:55

Update delegatePassticket configuration format

a6e5ccb

Signed-off-by: Martin Zeithaml <66114686+Martin-Zeithaml@users.noreply.github.com>

Corrected PassTicket configuration instructions

fa1da9e

Updated configuration steps for enabling delegated PassTicket. Signed-off-by: Martin Zeithaml <66114686+Martin-Zeithaml@users.noreply.github.com>

github-actions bot temporarily deployed to pull request February 11, 2026 14:03 Inactive


		<summary>Click here for command details to configure user access using Top Secret.</summary>

		For Top Secret:

Conversation

Joe-Winchester commented Feb 5, 2026

Uh oh!

github-actions bot commented Feb 5, 2026

Uh oh!

github-actions bot commented Feb 5, 2026

Uh oh!

github-actions bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

taban03 commented Feb 6, 2026

Uh oh!

taban03 commented Feb 6, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions bot commented Feb 5, 2026 •

edited

Loading