PI53111: WMQ Z/OS V8:WITH ICSF,CPACF IS NOT REQUIRED EVEN THOUGH SSL CHANNEL IS NOT USED.EITHER DOCUMENT IT OR USE PTF TOCO

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• Customer complains that they fail to connect to channel
  when they use ICSF  without  CPACF installed in
  MQ v8 even they do not enable SSL and get following message:
  +CSQX213E CSQ1 CSQXSUPR Communications error,  function
  'CSFPPRF' RC=12  reason=00008D3C
  
  There are two concerns:
  1.Is it needed to connect MQ V8 channels if customer use ICSF?
  If it's true, please document it in the manual.
  2.If CPACF is not a prerequisite for connecting V8 channels,
   it should be corrected this problem by PTF,  not using the
  service parm because service parm is not documented.
  
  
  Additional Symptom(s) Search Keyword(s):
  

Local fix

• use RECOVER QMGR under IBM service support's guidance
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of WebSphere MQ for z/OS Version 8 *
  *                 Release 0 Modification 0.                    *
  ****************************************************************
  * PROBLEM DESCRIPTION: MQ V8 clients fail to connect to MQ v8  *
  *                      queue mangers when ICSF is running but  *
  *                      CSFPPRF (PKCS#11 pseudo random          *
  *                      function) is not available.             *
  *                      Error message CSQX296E 'Password        *
  *                      protection negotiation failed' is       *
  *                      issued, even if password protection     *
  *                      was not requested.                      *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  During channel initiator startup, MQ attempts to determine
  whether to use ICSF or an internal algorithm to generate random
  data for use by the password protection function.
  If ICSF is running, and CSFPPRF is installed, the chinit will
  attempt to use ICSF, however if CSFPPRF cannot be used (for
  example, if CPACF is not installed), initialisation of the
  password protection function fails.
  When a V8 client subsequently starts, MQ determines that it
  is eligible for password protection (even if this is not
  required for this channel), however the earlier failure causes
  this to fail, preventing the channel from starting up.
  

Problem conclusion

• Channel initiator startup is changed to fallback to the internal
  method for generating random data, rather than using ICSF, if
  CSFPPRF is installed but is not available to be used.
  
  The description of message CSQX571E is updated to change the
  paragraph:
  "
  If func is CSFPPRF (Pseudo-random function) the feature affected
  is password protection. If this feature is not being used then
  this error can be ignored.
  "
  to:
  "
  If func is CSFPPRF (Pseudo-random function) the feature affected
  is password protection. If this feature is not being used then
  this error can be ignored. If this occurs at channel initiator
  startup, the password protection algorithm uses STCK instead.
  "
  000Y
  CMQXRAND
  

Temporary fix

• *********
  * HIPER *
  *********
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI34550

Modules/Macros

• CMQXRAND
  

Fix information

• Fixed component name

  WMQ Z/OS 8

• Fixed component ID

  5655W9700

Applicable component levels

• R000 PSY UI34550

     UP16/02/04 P F602 ¢

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.