Explorer for Endevor -repeated authentication issues

Products

• Endevor

Issue/Introduction

Explorer for Endevor plug-in for VS Code encounters repeated authentication issues when using Multi-Factor Authentication (MFA), specifically an 8-digit PIN + RSA token.

• The user can initially log in and set up the inventory location successfully.
• After a short period (typically 10 minutes), the connection fails with authentication errors.
• The user is forced to redo the entire connection/inventory location setup to restore access.

Cause

The Explorer for Endevor extension uses the provided base credentials to fetch a PassTicket from Endevor Web Services.

1. PassTicket Lifecycle: By default, a PassTicket is valid for 10 minutes.
2. Automatic Renewal: When the PassTicket expires, the extension attempts to automatically fetch a new one using the original credentials stored in the session.
3. Token Expiration: While this works for standard passwords, an RSA token is typically valid for only 30-60 seconds. By the time a renewal is required (after 10 minutes), the stored RSA token has already expired, causing the renewal request to fail.

Resolution

To resolve this issue, users should configure the connection to prompt for credentials only when they are needed, rather than storing a single-use MFA token.

1. Modify Connection Settings: When creating a new Endevor Service or Inventory Location (or repairing an existing one), do not specify credentials in the setup wizard.
2. Username/Password Prompt: When prompted for a username and password/passphrase in the VS Code input box, leave them blank and press Enter.
3. Interactive Login: With this configuration, the extension will prompt you for credentials only when the current PassTicket expires.
4. Provide Fresh Token: When the prompt appears after the 10-minute window, enter your current 8-digit PIN + the new RSA token currently displayed on your device.

Verification:

Ensure that the Endevor: Auth with Token setting is set to true (default) in your VS Code settings. This allows the extension to use the PassTicket workflow correctly while prompting for the MFA factor on-demand.

Additional Information

For mainframe administrators, ensure that the PassTicket evaluation window in IBM MFA is configured to allow for the refresh cycle (default is 600 seconds/10 minutes). Refer to Broadcom documentation on  Enabling Passtickets for detailed backend setup.