Configuring local authentication using Windows® Credential Manager
To run the Model Context Protocol (MCP) server in local or STDIO mode without exposing RACF passwords in configuration files, store your z/OSMF credentials in Windows® Credential Manager.
Before you begin
Ensure that you have a valid RACF user ID and password with access to z/OSMF REST interfaces on the target mainframe LPAR.
About this task
When running in local single-user mode (server.is-remote=false),
the MCP server queries Windows Credential Manager at startup to retrieve your RACF
credentials and request an authentication token from z/OSMF. Passwords are never
written to disk or configuration files.
Procedure
-
Use the following format for the credential target name:
FA:zosmf:your_racf_userid, for exampleFA:zosmf:JSMITH
-
Store the credential using either the Windows command line or the Control Panel GUI:
-
Command line: Open a command prompt and run cmdkey:
cmdkey /generic:FA:zosmf:your_racf_userid /user:your_racf_userid /pass:your_racf_password -
Control Panel GUI: Open Credential Manager, select Windows Credentials, click Add a generic credential, and enter the target name, user ID, and password.
-
-
Verify that the credential target name matches the
zosmf.userproperty in your server configuration file (application.yml).
Results
The MCP server can now authenticate securely with z/OSMF during local startup without prompting for passwords or storing plain-text credentials.