PI90111: INCORRECT IFCID140 QW0140UR AUTHORISATION ID BEING CHECKED with AUTH EXIT ACAE AND AUTHEXIT_CHECK ZPARM PRIMARY

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• IFCID140 with authexit_check='primary' (or prior to V11) shows
  package OWNER instead of RUNNER, which is misleading and
  incorrect info. IFCID140 was meant to be for native
  authorisation check failuers, it can be also useful for auth
  exit check of failures.
  

Local fix

• n/a
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All Db2 11 or 12 for z/OS users who use      *
  *                 Access Control Authorization exit            *
  *                 (DSNX@XAC) and IFCID140 trace                *
  ****************************************************************
  * PROBLEM DESCRIPTION: When Access Control Authorization Exit  *
  *                      (ACAE) is active, the IFCID140 trace    *
  *                      record QW0140UR field contains the      *
  *                      authorization ID that Db2 uses to       *
  *                      perform authorization instead of the    *
  *                      primary authorization ID.               *
  ****************************************************************
  * RECOMMENDATION: Apply corrective PTF when available.         *
  ****************************************************************
  The IFCID140 trace records are written for failed
  authorization attempts.  When ACAE is active and the
  AUTHEXIT_CHECK zparm is set to PRIMARY, the authorization
  ID that is checked by ACAE should be the primary authorization
  id of the process.
  However, the QW0140UR field in IFCID140 trace records
  contains the authorization ID that Db2 uses to perform
  authorization.
  

Problem conclusion

• Code has been changed so that the QW0140UR field represents
  the correct authorization ID that is being checked.
  

Temporary fix

Comments

• ×**** PE19/03/20 PTF IN ERROR. SEE APAR PH09088  FOR DESCRIPTION
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI58663 UI58666

Modules/Macros

•    DSNXA02
  

Fix information

• Fixed component name

  DB2 OS/390 & Z/

• Fixed component ID

  5740XYR00

Applicable component levels

• RB10 PSY UI58666

     UP18/10/09 P F810

• RC10 PSY UI58663

     UP18/10/09 P F810

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.