PK56391: FEPI SIGNON FAILS FOR WEBSERVICE TARGET PROGRAM USING PASSTICKET RECEIVES ERROR DFHCE3532 PASSWORD IS INVALID

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• Running CICS transaction server 3.1, customer using FEPI
  interface with their webservice. This program establishes
  a FEPI session, signs on a user with passticket and starts
  the target application. the signon fails with:
  DFHCE3532 Your password is invalid.
  AUX trace shows we are issuing an:
       ADD_USER_WITH_PASSWORD USERID_LENGTH(7)
  This fails with:
  REASON(PASSWORD_NOTAUTH) SAF_RESPONSE(8) SAF_REASON(0)
                           ESM_RESPONSE(8) ESM_REASON(0)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All.                                         *
  ****************************************************************
  * PROBLEM DESCRIPTION: DFHCE3532 when using security with      *
  *                      requeststreams.                         *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  A soap request is received which starts CPIH which in turn
  starts the provider task. A webservice handler program causes a
  context switch which starts an associated transaction. The
  security context for this new transaction is established by
  DFHRZXM. DFHRZXM always passes a userid length of 8 bytes. In
  fact the userid was only 7 bytes long. As part of this tasks
  execution a program utilizing FEPI will issue an EXEC CICS FEPI
  REQUEST PASSTICKET command. The passticket returned is based
  upon the 8 byte userid. Later a signon is issued utilizing the
  passticket and 7 byte version of the userid. This is rejected by
  the external security manager and msgDFHCE3532 is issued.
  Additional keywords: request streams
  

Problem conclusion

• DFHRZXM proc RZRS_XM_INIT has been changed to correctly
  calculate the length of the userid before initialising the
  user_token with add_user_without_password.
  

Temporary fix

• FIX AVAILABLE BY PTF ONLY
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UK33204 UK33205

Modules/Macros

•    DESRZRS  DESRZXM  DFHRZRMC DFHRZRMD DFHRZRSC
  DFHRZRSD DFHRZRS1 DFHRZXM
  

Fix information

• Fixed component name

  CICSTS V3 Z/OS

• Fixed component ID

  5655M1500

Applicable component levels

• R400 PSY UK33204

     UP08/01/29 P F801

• R500 PSY UK33205

     UP08/01/29 P F801

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.