PH00693: RECEIVING DFHPI0401, DFHPI0503, DFHPI0997 REPEATEDLY SINCE UPGRADED TO CICS TS 5.4

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• You encountered an outage due to CICS not processing web
  services after upgrading to TS 5.4. You were receiving messages
  DFHPI0401, DFHPI0503 and DFHPI0997 repeatedly.
  2 issues in CICS TS 5.4,
  - When using the optimised web attach processing and a
  TCPIPSERVICE with AUTHENTICATE(BASIC) the password gets checked
  twice.
  - The second time the password gets checked it is done on the
  SO TCB instead of an L8.  This can hold up the SO TCB if the
  password check takes a long time (as is the case here)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: Message DFHPI0401 is issued when        *
  *                      running HTTP web services requests that *
  *                      are optimised to bypass attaching the   *
  *                      CWXN transaction.                       *
  ****************************************************************
  CICS receives an HTTP request on a TCPIPSERVICE with
  AUTHENTICATE(BASIC) and uses the optimisation of directly
  attaching the transaction named in an associated URIMAP rather
  than first using an intermediate web attach CWXN transaction.
  During transaction initialization, the password is checked by
  calling an external security manager (ESM). DFHXSSB switches
  from the QR TCB to an L8 TCB before making this call.
  
  Later in transaction initialization, the DFHWBXM
  authenticate_user routine requests a second password check while
  running under the SO TCB and DFHXSSB calls the ESM without a TCB
  switch. This can cause delays to socket processing which
  eventually lead to the region issuing DFHPI0401 messages
  reporting that the CICS pipeline HTTP transport mechanism was
  unable to handle an inbound request.
  
  If the password is a single-use token the second verification
  request will fail with message DFHXS1201.
  
  Additional keywords: MSGDFHPI0401 PI0401 MSGDFHPI0503 PI0503
  MSGDFHPI0997 PI0997 MSGDFHXS1201 XS1201
  

Problem conclusion

• CICS has been changed so a second password check is not
  requested.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI59349 PH13001

Modules/Macros

• DFHWBA   DFHWBA1  DFHWBAP  DFHWBAPF DFHWBBLI DFHWBDM  DFHWBDUF
  DFHWBENV DFHWBPA  DFHWBPW  DFHWBSO  DFHWBSR  DFHWBTRI DFHWBTTA
  DFHWBXM  DFHWBXN
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels

• R100 PSY UI59349

     UP18/10/27 P F810

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.