Bridge for Git fails with INVALID_MF_CREDENTIALS when using Zowe PAT

Products

• Endevor
• Zowe

Issue/Introduction

After successfully entering credentials on the connection page using the "Login with APIML PAT" option, B4G returns an INVALID_MF_CREDENTIALS error during the "refresh element" action. 

Bridge for Git log shows:

| Operation: Refresh elements
 | Mapping: XXXX
 | Result: FAILED - INVALID_MF_CREDENTIALS
 | User: XXXX
 | Summary: Your mainframe account might be suspended or your credentials have expired.
 | Action: Please check your mainframe credentials for this branch.
 | Messages:
 |  - Invalid endevor credentials

Environment

All support Endevor Versions

Bridge for Git v2.15.x or higher or Bridge for Git v3

ZOWE APIML 2.x or 3.x

 

Cause

The INVALID_MF_CREDENTIALS error occurs because the Zowe API Mediation Layer Gateway is not configured to accept Personal Access Tokens. Even if a user can successfully authenticate to the APIML to issue a token, the Gateway security component will not validate or pass that token to downstream services (like Endevor Web Services) unless the PAT security feature is explicitly enabled in the configuration.

Resolution

To resolve this issue, you must enable Personal Access Token support in the Zowe configuration and restart the services.

1. Locate and edit your zowe.yaml configuration file.
2. Navigate to the Gateway component configuration and set components.gateway.apiml.security.personalAccessToken.enabled: true
3. Restart Zowe to apply the changes to the API Mediation Layer.
4. In Bridge for Git, re-attempt the connection or "Refresh elements" operation using the APIML PAT.

Additional Information

To enable Zowe SSO, ensure that PassTickets are configured on the Endevor side. This process requires the following steps:

 

1. Verify the settings in the apiml.properties file.

2. Successfully issue an /auth call using basic authentication.

3. Confirm that REST API calls can be completed using /auth generated token.