DFS3649A /SIGN COMMAND REQUIRED.

(3270/SLU2 type devices)

 (3270/SLU2 type devices) IMS Sign on panel 

or

(Non-3270/SLU2 devices) /SIGN COMMAND REQUIRED FOR IMS imsid. NODE node name. (NO)
OUTPUT SECURITY AVAILABLE (,REJECTED reason.)

Explanation
 The user of a terminal requiring sign on, which
includes all ETO terminals except ISC, SLU P, and FINANCE terminals,
must enter valid sign-on data before IMS will
accept other input data, such as transactions, commands, and message
switches. The only commands permitted at this time are /SIGN and /RCLSDST.
For
3270 terminals, the first form of the message appears and the sign-on
data can be entered into the panel displayed. For non-3270 terminals,
the second form of the message appears; use the /SIGN command
when permitted. 
If this message is sent again due to the rejection
of a sign-on attempt, the reason for the rejection will be shown after
the word REJECTED.
The last form of this message, the key message,
is displayed when the pre-edit message was unable to be built. For
all the conditions that cause DFS3649 to be sent, see Conditions for signon for DFS3649.
See
the following list for the reason codes reason and
their meanings:   

Code (dec)
Meaning

04

User profile is not defined to RACF®.

08

Password is not authorized, or was not specified.

12

Password has expired.

16

New password is invalid.

20

User is not defined to the group.

24

RACINIT was failed by the installation exit routine.

28

User access has been revoked.

32

RACF is not active.

36

The user's access to the specified group has been revoked.

40

OIDCARD parameter is required but not supplied.

44

OIDCARD parameter is invalid for specified user.

48

User is not authorized to use the terminal.

52

User is not authorized to use the application.

56

Reserved.

60

Reserved.

64

Reserved.

68

Reserved.

72

Reserved.

76

SIGNON internal error

80

Terminal is in conversation.

84

Reserved.

88

Terminal is in Preset Mode.

92

Terminal is in Response Mode.

96

The terminal is not authorized to this conversation. For
a static terminal or a dynamic terminal with the SPQBname the same
as the node name, you are not allowed to sign on unless all conversations
are held, or you are authorized to use the transaction for the active
conversation.

100

Rejected by DFSCSGNO exit routine.

104

Storage unavailable to process request.

108

Reserved.

112

Rejected by DFSSGNX0 exit routine.

116

The structure of the /SIGN command is in error.

120

Resources unavailable for command.

124

The LTERM name returned by DFSSGNXO exit exists as LU 6.2 descriptor
name

128

Syntax error detected by IMS.

132

Storage unavailable to IMS while processing signon or signoff
parameters, or one of the parameters is invalid.

136

Return code 104 from ARM call. Storage was unavailable to complete
this call.

140

Return code 108 from ARM call. A system error caused this call
to fail.

144

User ID has more than eight characters.

148

Descriptor specified by the USERD parameter could not be found,
or no user descriptor could be found (DFSUSER could not be found).

152

User descriptor specified has more than eight characters.

156

User structure is already allocated to a terminal structure.

160

Associated printer user structure exists and is temporary.

164

Descriptor name returned in the associated printer output buffer
by DFSSGNX0 does not exist in the system.

168

DFSUSER user descriptor does not exist in the system, and no other
descriptor was specified to build the associated printer structure.

172

Associated printer structures could not be obtained using DFSBCB.

176

Specified user ID is currently in use as a dynamic user. It is
unavailable at this time as a static user ID. Or, the specified user
ID is not valid for this terminal type because it was statically defined
with the system definition SUBPOOL macro for use with static ISC parallel
session nodes.

180

USERD parameter cannot be specified by a static terminal.

184

Queues returned in the user output queue buffer that modify the
existing user structure do not belong to the existing user.

188

Queues returned in the user output queue buffer that modify the
existing user structure are not defined in the system.

192

User ID returned in the user output queue buffer from DFSSGNX0
contains invalid characters.

196

Associated print user name returned in the associated print output
buffer from DFSSGNX0 contains invalid characters.

200

Queues returned in the user output queue buffer from DFSSGNX0
contain special prefixes reserved to IMS or
contain invalid characters. If no buffer data is returned by DFSSGNX0,
the parameter in error might have been entered as signon data.

204

Queues returned in the user output queue buffer from DFSSGNX0
are not unique in this IMS system. If no buffer data is
returned by DFSSGNX0, then DFSUSER is used as the descriptor but an
LTERM with the same name as the user ID exists.

208

Queues returned in the user output queue buffer from DFSSGNX0
contain names that are currently defined as transaction names in this IMS system.

212

User structure blocks could not be obtained using DFSBCB.

216

User is allocated, but it is not ISC/SLU P/FINANCE.

220

User is allocated, and though it is ISC/SLU P/FINANCE, the user
address does not match the new user address.

224

User exists and is trying to sign on, but sign-on has the status
of having the stopped bit turned on by the /STOP USER command.

228

Sign-on exit routine DFSSGNX0 returned an invalid ICOMPT value
that was not between 1 and 4.

232

Signon exit routine DFSSGNX0 returned an invalid COMPT value that
was not between 1 and 4.

236

User existed as a real user and not a temporary user, but the
user does not have any queues.

240

Static or dynamic terminal with this user ID exists on the system.

244

LU6, SLU P, or FINANCE ETO terminal entered a /SIGN command,
but there are no user structures available under this terminal.

248

Associated printer buffer from DFSSGNX0 has a LUNAME that does
not follow the correct naming conventions.

252

Associated Printer buffer from DFSSGNX0 has a logon descriptor
which does not follow the correct naming conventions.

256

Associated Printer buffer from DFSSGNX0 has a mode table name
which does not follow the correct naming conventions.

260

Static user was not found for the user allocation of a static
ISC parallel session. A dynamic user was used for the user allocation
of a static ISC parallel session, or a static user was used for the
sign-on to an ETO terminal session.

264

Session initiation occurred for an ETO terminal that is an output-only
device, but no sign-on data (user ID and optionally user password
and user descriptor) was included. The session is terminated.

268

MSGDEL specifications for the USER and static ISC parallel session
terminal did not match. They must be the same.

272

The user structure name has been overridden by DFSSGNXO exit,
either because a name was provided in USEQUSTN or as a result of suffixing.
This name exists as a user descriptor and, therefore, cannot be used
as a user structure name by the user signing on.

276

The user exists and is currently being used by as part of an /ASSIGN, /STOP,
or /OPNDST command.

280

An LTERM name with a suffix added contained more than eight characters.

284

Temporary user structure is currently in use by another ITASK.
Wait a moment and try again.

288

The user sign-on exit, DFSSGNX0, has returned an invalid value in either the SGNOSRM1 or
SGNOSRM2 field.

292

A static terminal attempted to sign on and register the user ID
to RM. However, the sign-on is rejected due to an error in RM registration.

296

The user exists, but the user has Fast Path input in progress
and the user was defined with no Fast Path recovery (RCVYFP=NO). The
Fast Path program must complete before the user is allowed to sign
on.

300

Password verification is required.

304

Password verification failed.

308

A failure occurred in obtaining CTBWORK.

312

The user is stopped from signing on.

316

A user in Fast Path response mode attempted to sign on to an IMS system
that is not Fast Path capable or is not using an EMHQ structure.

320

A mismatch occurred between the local IMS and
RM: user type.

324

A mismatch occurred between the local IMS and
RM: number of assigned CNTs.

328

The user resource in RM does not have a fixed segment.

332

The user is currently active.

336

The limit has been reached for user update attempts.

340

The user is owned by another IMS.

344

The user update failed.

348

The user ID is owned by an active IMS.

352

The assigned CNT was not found.

356

The node query produced no RM output.

360

The node query failed.

364

User signon failed. The user attempted to log on as a static terminal,
but the node is already defined to RM as a dynamic terminal; or the
user attempted to log on as a dynamic terminal, but the node is already
defined as static.

368

A mismatch occurred between the local IMS and
RM: session manager session.

372

A mismatch occurred between the local IMS and
RM: user or subpool support.

376

A mismatch occurred between the local IMS and
RM: device type.

380

A mismatch occurred between the local IMS and
RM: output-only.

384

A mismatch occurred between the local IMS and
RM: output-only.

388

A mismatch occurred between the local IMS and
RM: output edit.

392

The node update did not produce RM output.

396

The node update failed.

400®

There is no storage.

404

Node cleanup has no RM output.

408

Node cleanup failed.

412

Node delete has no RM output.

416

Node delete failed.

420

There is no LTERM for this signon.

428

The user currently allocates to a different node.

432

An error in the RACF database occurred. For more
information, see system abend 483-4C in z/OS® MVS™ System Codes  (SA22-7626). 

436

CQS is unavailable, which causes the registration of interest
to fail.
For ETO terminal, the user is signed off.

For static non-stsn terminal that requires signon, the session
persists. The user is signed off if already signed on.

440 

The user is allocated to a different node on the local IMS
system. 

444 

 Sign-on was unable to update the node resource in RM.  This condition
is temporary; try the sign-on again.

448

An application is using an LTERM associated with this user. This condition is a temporary.
Please try the sign-on again.

500

Either the user profile is not defined to RACF, or the
password is not authorized or was not specified.

Attention: For reason codes 4-52, see z/OS Security Server RACF System Programmer's Guide (SA22-7681)
for further details.

Conditions for signon for
DFS3649
Message DFS3649 is sent for various reasons. The
following table contains the conditions under which these messages
are sent to different devices.
In the table, a Y in the
cell indicates that the condition is valid for the device listed at
the top of that column. An N indicates that this condition
will not cause message DFS3649 to be sent to the device listed at
the top of that column. Blank cells in the tables indicate that the
condition is not applicable to the device listed at the top of that
column.
Because 3270 printers are output-only devices, they
never receive message DFS3649.
Numbers 058, 064, 165, 2467,
2469, 3650, 3662, and 3664 in the table indicate that messages DFS058,
DFS064, DFS165, DFS2467, DFS2469, DFS3650, DFS3662, and DFS3664 are
received instead of DFS3649.
A sign-on failure for an output-only
device causes message DFS2085 to be sent to the MTO with the reason
code from the DFS3649 message.
Table 1. Conditions that message DFS3649 is sent to certain
devices

Condition

3270

3270P

FIN

SLU1

SLU2

SLU4

SLU P

LU6

NTO

Session initiation (simple)

Y

Y

Y

Y

Y

Session initiation-NOTERM
specified, static terminal

N

N

N

N

N

Session initiation-NOTERM
specified, ETO terminal, without user data¹

Y

Y

Y

Y

Y

Session initiation with
sign-on data

3650

3650

3650

3650

3650

Session initiation (unattached
mode)

N

N

Session initiation (autologged
on)

N

N

N

N

N

Session initiation with
bad sign-on data

Y

Y

Y

Y

Y

Y

/SIGN ON failure, static
terminal, sign-on not required

Y

2467

Y

Y

Y

2467

2467

Y

/SIGN ON failure, static
terminal, sign-on required

Y

Y

Y

Y

Y

Y

Y

/SIGN ON failure, dynamic
terminal

Y

2469

Y

Y

Y

2469

2469

Y

Tran or command entered
before sign-on when sign-on required-static terminal

Y

Y

Y

Y

Y

Y

Y

Tran or command entered
before sign-on when sign-on required-dynamic terminal

Y

165 2469 064 3662

Y

Y

Y

165 2469 064 3662

165 2469 064 3662

Y

/SIGN OFF, static terminal,
sign-on not required

058

058

058

058

058

058

058

058

/SIGN OFF, static terminal,
sign-on required

Y

Y

Y

Y

Y

Y

Y

/SIGN OFF, dynamic terminal

Y

058

Y

Y

Y

058

058

Y

Remember:  
¹

OPTION=NOTERM does not affect the issuance of the DFS3649 message
for dynamic terminals because NOTERM is specified on the USER descriptor.
DFS3649 is not suppressed when NOTERM is specified on the USER descriptor
because NOTERM is not reflected in the blocks for the node until after
sign-on.

System action
 IMS processes signon input data when
entered. If the sign-on is successful, message DFS3650I is
sent to the terminal. Message DFS3650I provides the
status of the terminal session and user.

Operator response
 Enter valid signon data as requested. For RACF,
the sign-on data consists of the following strings:   

User ID

A user identification of eight characters or less.

User Descriptor

An optional keyword indicating a user descriptor name of eight
characters or less that is used by IMS to
build a user control block structure.

Password

An optional keyword indicating a password of eight
characters or less (or, if supported, a password phrase of 100 characters or less) that is
associated with the user identification. This field will have a non-display attribute. The password
is required when RACF
is used to verify the sign-on.

Group

An optional keyword indicating a group name of eight characters
or less that is associated with the user ID.

New Password

An optional keyword indicating a new user password of
eight characters or less (or, if supported, a password phrase of 100 characters or less) that
replaces the current user password specified in the password field. This field will have a
non-display attribute.

Condition	3270	FIN	SLU1	SLU2	SLU4	SLU P	LU6	NTO
Session initiation (simple)	Y		Y	Y	Y			Y
Session initiation-NOTERM specified, static terminal	N		N	N	N			N
Session initiation-NOTERM specified, ETO terminal, without user data¹	Y		Y	Y	Y			Y
Session initiation with sign-on data	3650		3650	3650	3650			3650
Session initiation (unattached mode)			N		N
Session initiation (autologged on)	N		N	N	N			N
Session initiation with bad sign-on data	Y	Y	Y	Y	Y			Y
/SIGN ON failure, static terminal, sign-on not required	Y	2467	Y	Y	Y	2467	2467	Y
/SIGN ON failure, static terminal, sign-on required	Y	Y	Y	Y	Y	Y		Y
/SIGN ON failure, dynamic terminal	Y	2469	Y	Y	Y	2469	2469	Y
Tran or command entered before sign-on when sign-on required-static terminal	Y	Y	Y	Y	Y	Y		Y
Tran or command entered before sign-on when sign-on required-dynamic terminal	Y	165 2469 064 3662	Y	Y	Y	165 2469 064 3662	165 2469 064 3662	Y
/SIGN OFF, static terminal, sign-on not required	058	058	058	058	058	058	058	058
/SIGN OFF, static terminal, sign-on required	Y	Y	Y	Y	Y	Y		Y
/SIGN OFF, dynamic terminal	Y	058	Y	Y	Y	058	058	Y
Remember: ¹ OPTION=NOTERM does not affect the issuance of the DFS3649 message for dynamic terminals because NOTERM is specified on the USER descriptor. DFS3649 is not suppressed when NOTERM is specified on the USER descriptor because NOTERM is not reflected in the blocks for the node until after sign-on.