Clarification on Future Support for Password-Based Authentication in IBM CDC

Hi IBM Team,

We are currently using IBM CDC on z/OS and authenticate to our source systems using credentials specified in CHCCLP scripts. As the passwords are stored in clear text within the scripts, we have raised a Risk Acceptance with our security/risk team as a temporary control.

Previously, we discussed options to avoid clear-text passwords, and IBM advised that PassTicket authentication can be used for DB2 and VSAM sources.

However, we have recently been informed that our Mainframe Platform Team is introducing an Enterprise Vault solution that will allow credentials to be securely stored in a vault and retrieved at runtime. Once this vault capability becomes available, our intention is to onboard to the vault solution and eliminate the use of clear-text passwords.

Before we proceed with implementing PassTickets, we would like to understand IBM CDC's future direction regarding password-based authentication.

Could you please clarify:

Does IBM CDC continue to support the current password-based authentication mechanism in CHCCLP scripts?
Is there any plan to deprecate or remove support for password-based authentication in future CDC releases?
Are there any IBM recommendations or best practices for integrating CDC with enterprise credential vault solutions where credentials are retrieved at runtime?
If password authentication remains supported, are there any known limitations or considerations we should be aware of when transitioning later to a vault-based solution?

Our objective is to determine whether we need to invest effort in implementing PassTickets now, or whether we can continue with the current password-based approach until the enterprise vault solution becomes available.

We would appreciate your guidance on the product roadmap and recommended approach.

Regards,
Muthuraj M