A fix is available
APAR status
Closed as program error.
Error description
You encountered an outage due to CICS not processing web services after upgrading to TS 5.4. You were receiving messages DFHPI0401, DFHPI0503 and DFHPI0997 repeatedly. 2 issues in CICS TS 5.4, - When using the optimised web attach processing and a TCPIPSERVICE with AUTHENTICATE(BASIC) the password gets checked twice. - The second time the password gets checked it is done on the SO TCB instead of an L8. This can hold up the SO TCB if the password check takes a long time (as is the case here)
Local fix
Problem summary
**************************************************************** * USERS AFFECTED: All CICS users. * **************************************************************** * PROBLEM DESCRIPTION: Message DFHPI0401 is issued when * * running HTTP web services requests that * * are optimised to bypass attaching the * * CWXN transaction. * **************************************************************** CICS receives an HTTP request on a TCPIPSERVICE with AUTHENTICATE(BASIC) and uses the optimisation of directly attaching the transaction named in an associated URIMAP rather than first using an intermediate web attach CWXN transaction. During transaction initialization, the password is checked by calling an external security manager (ESM). DFHXSSB switches from the QR TCB to an L8 TCB before making this call. Later in transaction initialization, the DFHWBXM authenticate_user routine requests a second password check while running under the SO TCB and DFHXSSB calls the ESM without a TCB switch. This can cause delays to socket processing which eventually lead to the region issuing DFHPI0401 messages reporting that the CICS pipeline HTTP transport mechanism was unable to handle an inbound request. If the password is a single-use token the second verification request will fail with message DFHXS1201. Additional keywords: MSGDFHPI0401 PI0401 MSGDFHPI0503 PI0503 MSGDFHPI0997 PI0997 MSGDFHXS1201 XS1201
Problem conclusion
CICS has been changed so a second password check is not requested.
Temporary fix
Comments
APAR Information
APAR number
PH00693
Reported component name
CICS TS Z/OS V5
Reported component ID
5655Y0400
Reported release
100
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2018-07-18
Closed date
2018-10-26
Last modified date
2019-06-06
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
UI59349 PH13001
Modules/Macros
DFHWBA DFHWBA1 DFHWBAP DFHWBAPF DFHWBBLI DFHWBDM DFHWBDUF DFHWBENV DFHWBPA DFHWBPW DFHWBSO DFHWBSR DFHWBTRI DFHWBTTA DFHWBXM DFHWBXN
Fix information
Fixed component name
CICS TS Z/OS V5
Fixed component ID
5655Y0400
Applicable component levels
R100 PSY UI59349
UP18/10/27 P F810
Fix is available
Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.
[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSGMGV","label":"CICS Transaction Server"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"5.4","Edition":"","Line of Business":{"code":"LOB35","label":"Mainframe SW"}},{"Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"SG19M","label":"APARs - z\/OS environment"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"5.4","Edition":"","Line of Business":{"code":"","label":""}}]
Document Information
Modified date:
06 June 2019