See JWT for my blog post on what JWT are and how they work.
I also gave myself the additional challenge of not saving sensitive information in disk files.
Once I got the scripts working I used a Python script- which was much easier to use.
Overall application
My overall application is
- Issue a request to z/OSMF “https://10.1.1.2:10443/zosmf/services/authenticate” to do certificate logon, and return a JWT.
- Use the JWT to send a request to MQWEB “https://10.1.1.2:9443/ibmmq/rest/v1/admin/action/qmgr/CSQ9/mqsc” to display MQ information
BASH
I initially tried using a BASH script for creating and using JWT to issue MQ REST API requests to MQWEB.
This worked, but capturing the JWT from the cookie was not easy to implement.
Get the JWT
#!/bin/bash
rm cookie.jar.txt
url="https://10.1.1.2:10443/zosmf/services/authenticate"
tls="--cacert doczosca.pem --tlsv1.2 --tls-max 1.2"
certs=" --cert ./colinpaice.pem:password --key ./colinpaice.key.pem"
insecure="--insecure"
cj="--cookie cookie.jar.txt --cookie-jar cookie.jar.txt"
curl -v $cj $tls $certs $url $insecure
Note: If there was a valid JWT in the cookie store, the code did not return a JWT. I deleted the cookie file to get round this.
Issue the MQ command
#!/bin/bash
set -x
url="https://10.1.1.2:9443/ibmmq/rest/v1/admin/action/qmgr/CSQ9/mqsc"
token="..."
tls="--cacert ./doczosca.pem --tlsv1.2"
certca="--cacert ./doczosca.pem "
origin="-H Origin:"
post="-X POST"
# need --insecure to avoid subjectAltName does not match
insecure="--insecure"
cj="--cookie cookie.jar.txt --cookie-jar cookie.jar.txt"
curl --verbose -H "Authorization: Bearer $token" -H "Connection: close" $cj $header $insecure $verify $tls -H "Content-Type: application/json" -H "ibm-mq-rest-csrf-token: value" $certs $trace $url --data "{ \"type\": \"runCommand\", \"parameters\": {\"command\": \"DIS QMGR ALL\"} }"
I used cut and paste to copy the JWT from the output of the CURL z/OSMF request, and paste it in token=”” in the MQ script.
I did this because my BASH scripting was not up trying to getting the JWT from the z/OSMF script.
ColinPaice 