Zowe Client Java SDK 7.0.2
With the release of 7.0.1, users of the BASIC and TOKEN connection types may encounter the following error when connecting to a z/OSMF server:
zowe.client.sdk.rest.exception.ZosmfRequestException:
java.io.IOException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target
Prior to version 7.0.0, these connection types worked with untrusted or self-signed z/OSMF server certificates because SSL certificate verification was disabled.
BASIC and TOKEN authentication do not themselves require certificates; HTTPS/TLS does. When TLS certificate verification is enabled, the server's certificate must be trusted by the client.
HTTPS provides an encrypted TLS channel that protects the credentials being transmitted. For example, the username and password used by BASIC authentication, or the token used by TOKEN authentication, are encrypted while traveling between the client and the z/OSMF server.
However, TLS provides more than encryption. The server certificate is also used to verify the identity of the server the client is connecting to.
This distinction is important for BASIC authentication. Although the username and password are already encrypted when transmitted over HTTPS, certificate verification ensures that the client is actually establishing that encrypted connection with the intended and trusted server.
Without certificate verification, the connection can still be encrypted, but the client cannot reliably verify the identity of the server. This creates the potential for a man-in-the-middle attack in which credentials or tokens could be intercepted by an untrusted server.
Therefore, certificate verification provides an additional layer of security: encryption protects the credentials from being read, while certificate verification helps ensure they are being sent to the correct server..
As part of the 7.0.0 security hardening changes, SSL certificate verification is now enabled by default. As a result, the SDK no longer supports operations against an untrusted or self-signed z/OSMF server by default.
To connect to a server using an untrusted or self-signed certificate, you should import the server certificate into your client's trusted certificate store.
Alternatively, if you need to restore the previous behavior, you can explicitly configure the SDK to disable SSL certificate verification. See the core package README.md for details and configuration options.
This change is intentional and is designed to prevent insecure connections by default.
7.0.2 release also includes updates to fully support the usage of certificates with BASIC and TOKEN types as some configurations did not properly work in 7.0.0.
Release Notes
Zowe Client Java SDK 7.0.2 is a maintenance release focused on improving SSH connection security, timeout handling, SSL/TLS configuration, and connection reliability.
Security
-
Update Enable SSH host-key verification by default
SSH connections now verify host keys against the user's default known_hosts file by default. Unknown or changed host keys are rejected unless the existing zowe.sdk.allow.insecure.connection system property is explicitly enabled. A warning is logged when insecure host-key verification is enabled.
-
Fix SSL/TLS configuration for BASIC and TOKEN connections
Fixed an issue where SSL/TLS certificate validation settings were not applied to BASIC and TOKEN authentication connections. This prevented connections to z/OSMF endpoints using self-signed certificates when the appropriate SDK SSL configuration was enabled.
SSH Connection and Command Improvements
-
Add SSH timeout handling
Added timeout handling for SSH session connections, SSH channel connections, and remote USS command execution to prevent network hangs and stuck processes.
-
Improve timeout error reporting
Socket timeout detection now examines the exception cause chain to provide a more actionable timeout message.
Documentation
- Updated SSH timeout and security-related Javadocs.
- Updated SSL security hardening documentation to clarify secure and insecure connection configuration.
Issues Addressed
#608 — TSO command execution failing with BASIC connection after upgrading to 7.0.1
#610 — Insecure for BASIC and TOKEN connection
#611 — Improve SSH host-key verification and timeout handling
#612 — Add timeout handling for USS SSH connections and command execution
#613 — Update SSL security hardening documentation
Summary
Zowe Client Java SDK 7.0.2 strengthens SSH host-key verification, improves timeout handling for USS SSH operations, resolves SSL/TLS configuration issues affecting BASIC and TOKEN authentication, and improves security documentation.
Zowe Client Java SDK 7.0.2
With the release of 7.0.1, users of the BASIC and TOKEN connection types may encounter the following error when connecting to a z/OSMF server:
Prior to version 7.0.0, these connection types worked with untrusted or self-signed z/OSMF server certificates because SSL certificate verification was disabled.
BASIC and TOKEN authentication do not themselves require certificates; HTTPS/TLS does. When TLS certificate verification is enabled, the server's certificate must be trusted by the client.
HTTPS provides an encrypted TLS channel that protects the credentials being transmitted. For example, the username and password used by BASIC authentication, or the token used by TOKEN authentication, are encrypted while traveling between the client and the z/OSMF server.
However, TLS provides more than encryption. The server certificate is also used to verify the identity of the server the client is connecting to.
This distinction is important for BASIC authentication. Although the username and password are already encrypted when transmitted over HTTPS, certificate verification ensures that the client is actually establishing that encrypted connection with the intended and trusted server.
Without certificate verification, the connection can still be encrypted, but the client cannot reliably verify the identity of the server. This creates the potential for a man-in-the-middle attack in which credentials or tokens could be intercepted by an untrusted server.
Therefore, certificate verification provides an additional layer of security: encryption protects the credentials from being read, while certificate verification helps ensure they are being sent to the correct server..
As part of the 7.0.0 security hardening changes, SSL certificate verification is now enabled by default. As a result, the SDK no longer supports operations against an untrusted or self-signed z/OSMF server by default.
To connect to a server using an untrusted or self-signed certificate, you should import the server certificate into your client's trusted certificate store.
Alternatively, if you need to restore the previous behavior, you can explicitly configure the SDK to disable SSL certificate verification. See the core package
README.mdfor details and configuration options.This change is intentional and is designed to prevent insecure connections by default.
7.0.2 release also includes updates to fully support the usage of certificates with BASIC and TOKEN types as some configurations did not properly work in 7.0.0.
Release Notes
Zowe Client Java SDK 7.0.2 is a maintenance release focused on improving SSH connection security, timeout handling, SSL/TLS configuration, and connection reliability.
Security
Update Enable SSH host-key verification by default
SSH connections now verify host keys against the user's default
known_hostsfile by default. Unknown or changed host keys are rejected unless the existingzowe.sdk.allow.insecure.connectionsystem property is explicitly enabled. A warning is logged when insecure host-key verification is enabled.Fix SSL/TLS configuration for BASIC and TOKEN connections
Fixed an issue where SSL/TLS certificate validation settings were not applied to BASIC and TOKEN authentication connections. This prevented connections to z/OSMF endpoints using self-signed certificates when the appropriate SDK SSL configuration was enabled.
SSH Connection and Command Improvements
Add SSH timeout handling
Added timeout handling for SSH session connections, SSH channel connections, and remote USS command execution to prevent network hangs and stuck processes.
Improve timeout error reporting
Socket timeout detection now examines the exception cause chain to provide a more actionable timeout message.
Documentation
Issues Addressed
#608 — TSO command execution failing with BASIC connection after upgrading to 7.0.1
#610 — Insecure for BASIC and TOKEN connection
#611 — Improve SSH host-key verification and timeout handling
#612 — Add timeout handling for USS SSH connections and command execution
#613 — Update SSL security hardening documentation
Summary
Zowe Client Java SDK 7.0.2 strengthens SSH host-key verification, improves timeout handling for USS SSH operations, resolves SSL/TLS configuration issues affecting BASIC and TOKEN authentication, and improves security documentation.