AuthExceptionHandler references the message key defined in zaas-log-messages.yml.

[balhar-jakub]

Describe the bug

AuthExceptionHandler (in apiml-security-common) references the message key org.zowe.apiml.zaas.security.schema.missingAuthentication, which is only defined in zaas-log-messages.yml. However, the API Catalog loads its own set of message files that does not include zaas-log-messages.yml, so when an InsufficientAuthenticationException is handled by the API Catalog's DefaultExceptionHandler, the message service cannot resolve the key and logs a warning:

Invalid message key 'org.zowe.apiml.zaas.security.schema.missingAuthentication' was used. Please resolve this problem.

Steps to Reproduce

1. Deploy Zowe with the API Catalog running.
2. Send a request to the API Catalog that triggers an InsufficientAuthenticationException (e.g. a request missing authentication credentials).
3. Observe the server log for the API Catalog process.

Expected behavior

The message key org.zowe.apiml.zaas.security.schema.missingAuthentication resolves correctly in all services that use AuthExceptionHandler, with no "Invalid message key" warning in the logs.

Screenshots

N/A

Logs

2026-05-13 13:03:33.305 ZWEAAC1:https-jsse-nio-0.0.0.0-7552-exec-5:16777303 DEBUG ((o.z.a.m.c.AbstractMessageService)) Invalid message key 'org.zowe.apiml.zaas.security.schema.missingAuthentication' was used. Please resolve this problem.

Details

• Version and build number: v3.x.x
• Test environment: N/A — reproducible locally

API Catalog Web UI (in case of API Catalog issue):

• N/A — server-side log issue, not UI-specific

REST API client (in case of REST API issue):

• N/A

Additional context

The root cause is an architectural mismatch: the message key is defined in zaas-log-messages.yml (a ZAAS-service-specific file) but is consumed from AuthExceptionHandler in apiml-security-common, which is a shared module used across multiple services including the API Catalog.

Relevant files:

• apiml-security-common/src/main/java/org/zowe/apiml/security/common/error/AuthExceptionHandler.java:175 — hardcodes the ZAAS-specific message key
• zaas-service/src/main/resources/zaas-log-messages.yml:196 — where the key is defined
• api-catalog-services/src/main/java/org/zowe/apiml/apicatalog/config/BeanConfig.java — loads message files but omits zaas-log-messages.yml
• api-catalog-services/src/main/java/org/zowe/apiml/apicatalog/controllers/handlers/DefaultExceptionHandler.java — wires AuthExceptionHandler into the API Catalog

Proposed fix: Move the org.zowe.apiml.zaas.security.schema.missingAuthentication message definition from zaas-log-messages.yml into security-common-log-messages.yml, which is loaded by all affected services. This aligns the message definition's location with where it is actually used (shared security infrastructure).