CICSPlex profile should display authorized resources

[jshewbert]

Problem Description

When using CICSPlex in the Zowe Explorer for IBM CICS TS profile ("type": cics) the user should be able to see all resource for which they are authorized (ex. regions, programs, files). If a user is not authorized for all resources defined to the CICSPlex this results in the following error:
Response details: API_FUNCTION: GET, RESP: 1031 (NOTPERMIT), RESP2: 1345 (USRID).

The user should see a list of resources for which they are authorized, even if this is only a subset of the resources defined to the CICSPlex. This is how the CICSPlex WUI works.

Details about the behavior:

1. Command issued: CICSPlex used in Zowe profile ("type": cics)
2. Expected results: Display authorized resources (ex. regions, programs, files, etc)
3. Actual results: API error message
4. Applicable log files: 'Zowe Explorer.log' and 'Zowe Explorer for IBM CICS TS.log'

Describe your environment:

• Zowe CLI version installed (run command zowe --version): 7.29.1
• Zowe Explorer version installed: 3.4.2
• Installed plug-ins and their version numbers (run command zowe plugins list --short): No plugins have been installed into your CLI application.
• Installed z/OS-related VSCode Extensions and their version numbers:
• Node.js and NPM versions installed (run node --version, npm --version): IBM IDzEE extension pack 6.4.0
• Environment variables in use: N/A
• Operating system and version: Windows 11 Enterprise 23H2
• Shell/terminal (bash, cmd, powershell, etc...): N/A (VS Code0
• Daemon mode enabled or disabled: Disabled

[github-actions]

Thank you for creating a bug report.
We will investigate the bug and evaluate its impact on the product.
If you haven't already, please ensure you have provided steps to reproduce the bug and as much context as possible.

[davenice]

Hi @jshewbert - we're going to have a look at how we can help with this. Before we do, I have a couple of questions.

Looking at your bug report, initially I thought you meant that if you, say, didn't have access to the PROGRAM resource, you weren't able to see LIBRARYs or LOCFILEs "the user should be able to see all resource for which they are authorized"

However reviewing the code I can see that we don't actually attempt to retrieve a resource (and therefore discover we can't access it) until the user attempts to expand the tree.

So I think perhaps you're saying "I don't want to see tree nodes relating to items that I don't have access to".

If that's the case I'm not sure whether we have the API available to verify that ahead of time. However we can certainly do some work to improve the error reported - perhaps updating the decorator on the tree node to show a lock symbol and giving a more user-readable error.

Please can you help me understand exactly what the situation was and what you expected?

As an aside, in the settings for the CICS tree you can alter (globally) which resources are visible:

Not as automatic as you were hoping for, but an option. (Perhaps in our error message we could offer to globally hide the resource you don't have access to).

[jshewbert]

Thank you for reaching out! When defining the connection to a CICSPlex environment that is used to manage many CICS regions and their resources, a user may not have access to all of the CICS regions managed by this CICSPlex. In my example, our CICSPlex manages all of our non-production CICS regions. I have access to almost all of them (something like 140 out of 160). But when I attempt to expand the tree I cannot see any regions, even the ones to which I am authorized. So, it appears that a user must have access to all CICS regions managed by a CICSPlex, or they cannot see anything. Does that help? Would be happy to jump on a call and demonstrate.

…

-Jason

________________________________ From: Dave Nice ***@***.***> Sent: Thursday, May 7, 2026 11:32 AM To: zowe/cics-for-zowe-client ***@***.***> Cc: Jason Shewbert ***@***.***>; Mention ***@***.***> Subject: [EXTERNAL] Re: [zowe/cics-for-zowe-client] CICSPlex profile should display authorized resources (Issue #617) davenice left a comment (zowe/cics-for-zowe-client#617) [github. com] Hi @jshewbert [github. com] - we're going to have a look at how we can help with this. Before we do, I have a couple of questions. Looking at your bug report, initially I thought [https://avatars.githubusercontent.com/u/32769325?s=20&v=4]davenice left a comment (zowe/cics-for-zowe-client#617) [github.com]<https://urldefense.com/v3/__https://github.com/zowe/cics-for-zowe-client/issues/617*issuecomment-4398494071__;Iw!!AQegZw!dNzS231xxNdULMFKO7IxpHQABfsrCDddVqt6CJyjkyq6romJQS0sWIcbt7d2O0cmZqjH27hLf-CuUGFvE6vgb4Y$> Hi @jshewbert [github.com]<https://urldefense.com/v3/__https://github.com/jshewbert__;!!AQegZw!dNzS231xxNdULMFKO7IxpHQABfsrCDddVqt6CJyjkyq6romJQS0sWIcbt7d2O0cmZqjH27hLf-CuUGFvz62LxW0$> - we're going to have a look at how we can help with this. Before we do, I have a couple of questions. Looking at your bug report, initially I thought you meant that if you, say, didn't have access to the PROGRAM resource, you weren't able to see LIBRARYs or LOCFILEs "the user should be able to see all resource for which they are authorized" However reviewing the code I can see that we don't actually attempt to retrieve a resource (and therefore discover we can't access it) until the user attempts to expand the tree. So I think perhaps you're saying "I don't want to see tree nodes relating to items that I don't have access to". If that's the case I'm not sure whether we have the API available to verify that ahead of time. However we can certainly do some work to improve the error reported - perhaps updating the decorator on the tree node to show a lock symbol and giving a more user-readable error. Please can you help me understand exactly what the situation was and what you expected? As an aside, in the settings for the CICS tree you can alter (globally) which resources are visible: image.png (view on web) [github.com]<https://urldefense.com/v3/__https://github.com/user-attachments/assets/2cf1b542-937f-4aa9-8aa7-e09889073435__;!!AQegZw!dNzS231xxNdULMFKO7IxpHQABfsrCDddVqt6CJyjkyq6romJQS0sWIcbt7d2O0cmZqjH27hLf-CuUGFv6pzKglc$> Not as automatic as you were hoping for, but an option. (Perhaps in our error message we could offer to globally hide the resource you don't have access to). — Reply to this email directly, view it on GitHub [github.com]<https://urldefense.com/v3/__https://github.com/zowe/cics-for-zowe-client/issues/617*issuecomment-4398494071__;Iw!!AQegZw!dNzS231xxNdULMFKO7IxpHQABfsrCDddVqt6CJyjkyq6romJQS0sWIcbt7d2O0cmZqjH27hLf-CuUGFvE6vgb4Y$>, or unsubscribe [github.com]<https://urldefense.com/v3/__https://github.com/notifications/unsubscribe-auth/AI4HFI3CTOKBYC65RLXBWCL4ZST7VAVCNFSM6AAAAACW4QFTCWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DGOJYGQ4TIMBXGE__;!!AQegZw!dNzS231xxNdULMFKO7IxpHQABfsrCDddVqt6CJyjkyq6romJQS0sWIcbt7d2O0cmZqjH27hLf-CuUGFvQrKJSIQ$>. Triage notifications on the go with GitHub Mobile for iOS [apps.apple.com]<https://urldefense.com/v3/__https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675__;!!AQegZw!dNzS231xxNdULMFKO7IxpHQABfsrCDddVqt6CJyjkyq6romJQS0sWIcbt7d2O0cmZqjH27hLf-CuUGFve8xhBAk$> or Android [play.google.com]<https://urldefense.com/v3/__https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign*3Dnotification-email*26utm_medium*3Demail*26utm_source*3Dgithub__;JSUlJSU!!AQegZw!dNzS231xxNdULMFKO7IxpHQABfsrCDddVqt6CJyjkyq6romJQS0sWIcbt7d2O0cmZqjH27hLf-CuUGFvMCOR77w$>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[davenice]

OK gotcha. That makes sense.

I think rather than me trying to recreate something that might not actually represent reality, it would be easiest to get some data back from you directly, if you're willing. The easiest way to do that is for you to make the REST calls that we're making, using your browser.

If you can't obfuscate enough to post in here then we could get on a call like you suggest, you could submit via a case to CICS FAO me, or you could email me the data.

Here's what the extension does (it's similar in principle to CICS Explorer)

The first request we make is to get the list of CICSplexes we can see from the WUI you connected to:
http://yourmainframehostname.example.com:12345/CICSSystemManagement/CICSCICSplex
This returns some XML with record listing CICSplexes. I don't think there will be errors in there.

Then in the CICS tree you expand the CICSplex node that you're interested in. At this point we request a list of managed regions, giving the CICSplex name at the end of the URL:
http://yourmainframehostname.example.com:12345/CICSSystemManagement/CICSManagedRegion/CICSPLEXNAMEHERE

I think this is probably the return that's giving you errors. I'd be interested to see the XML that's returned - I suspect from what you've said that this will show responses and errors.

Your hostname is in the schemaLocation attribute at the top - you'll want to obfuscate that. You might also need to obfuscate your region names.

Are you able to help us understand what it looks like, assuming it's not just a long list of records?

[jshewbert]

Looks like the first request is even failing for me. But, I can access the CICSPlex WUI and list the CICS regions that I am authorized to see.

Here is the request error:

This XML file does not appear to have any style information associated with it. The document tree is shown below.
<response xmlns="http://www.ibm.com/xmlns/prod/CICS/smw2int" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.ibm.com/xmlns/prod/CICS/smw2int http://nnn.nnn.com:####/CICSSystemManagement/schema/CICSSystemManagement.xsd" version="3.0" connect_version="0610">

[jshewbert]

The second request does seem to display managed CICS region information for me. There is too much sensitive information to obfuscate and post here. I could share with you in direct email exchange, if that is ok?

[davenice]

I had a chat with @jshewbert today and we went through his issue. As described above, in summary he doesn't have access to every region.

When we make a CICSManagedRegion request, this gives us an XML return that contains both an error message ... but also the data he's allowed to see. In the extension I think we see the error message and don't continue.

I'm attaching a mock up of his situation for us to use in our wiremocks.

CICSManagedRegions.xml

It would be good to work on a fix where for any request we make, we show the data if data is returned. (There are other possible scenarios in this list of errors where I believe we might get partial data - https://www.ibm.com/docs/en/cics-ts/6.x?topic=commands-get)

We will also want to surface that the data might be limited - which would be an opportunity to alert the user to the error information. This wants a bit more thinking about - it might be too much to show a notification about this every time... Although that would be fine as a first implementation! Perhaps there's another way that we can flag the issue to the user in the tree area.

So - @BRSinha08 - next steps on this are to setup a wiremock scenario with this data as our CICSManagedRegion return. Then we'll be able to recreate in the GUI and look at a good fix.
We might want @Rajat-Sahrawat involved to think about the right UX to alert the user that results might be limited.
As a bonus thought... What does Zowe CLI do? 🤔