PM73400: RODISPT TIME IS LONGER BECAUSE OF INCREASED CALLS TO RACF TO VERIFY A 7 CHARACTER ( OR LESS ) PASSWORD.

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• There is a fast way for CICS and RACF to verify a password.
  And there is a slower way for CICS and RACF to verify a
  password.  For valid passwords, the fast way ought to work.
  But with a 7 character ( or less ) valid password, CICS doesn't
  do the fast way correctly and so has to also do the slow way.
  Having to do the slow way causes more IO to the RACF datasets.
  And it causes RODISPT time to increase, potentially enough such
  that the RO TCB could become a bottleneck.
     You can tell that this is happening with a trace.  There
  will be a trace entry like this:
  XSSB  EXIT  FUNCTION(INQUIRE_PASSWORD_DATA) RESPONSE(OK)
   SAF_RESPONSE(0) SAF_REASON(0) ESM_RESPONSE(0) ESM_REASON(0)
   FASTPATH_AUTH(NO)
  This trace entry shows that the Inquire_password_data call
  completed with an OK response and all SAF and ESM response
  and reasons codes were 0.  This means that the password was
  valid.  But the FASTPATH_AUTH(NO) means that CICS was not
  able to verify the password using the fast method.  When
  the call completes OK, FASTPATH_AUTH should say YES.
  

Local fix

• Use 8-character passwords
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All                                          *
  ****************************************************************
  * PROBLEM DESCRIPTION: CICS VERIFY PASSWORD performance is     *
  *                      degraded when using passwords which are *
  *                      less than 8 characters long.            *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  EXEC CICS VERIFY PASSWORD and internal CICS use of VERIFY
  PASSWORD has degraded performance when using passwords which are
  less than 8 characters long.
  DFHXSSB uses a fastpath mechanism to check that the password
  is correct. This always fails with passwords that are
  less than 8 characters long. The effect is that DFHXSSB issues
  a RACROUTE VERIFYX to validate the password. This results in
  additional RACF IO causing a performance degradation.
  .
  A separate problem can affect 8 character password validation
  resulting in the same unnecessary RACROUTE VERIFYX call.
  However, this problem is intermittent and most of the time
  the fastpath mechanism works with 8 character passwords.
  

Problem conclusion

• DFHXSSB has been changed to ensure that fastpath validation of
  all length passwords succeeds when the password is correct.
  

Temporary fix

• FIX AVAILABLE BY PTF ONLY
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  PM80800 UK91376

Modules/Macros

•    DFHXSSB
  

Fix information

• Fixed component name

  CICS TS Z/OS V4

• Fixed component ID

  5655S9700

Applicable component levels

• R700 PSY UK91376

     UP13/02/08 P F302

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.