Changing your password with an identity token

If your administrator has configured your account to use identity tokens, you can easily change your RACF® password, change a PIN, or change both during an in-band logon to TSO. Identity tokens are configured on your behalf, and are not something you directly use.

About this task

Consider the following TSO login scenario:
  • You are configured for LDAP with compound in-band authentication.
  • Your RACF password has expired.
  • The administrator has configured your account to require your RACF credential first.


  1. Enter you current RACF password, the separator character, and your LDAP password.
    If successful, you receive the following message:
    ICH70008I IBM MFA Message:                       
  2. Press Enter to continue.
  3. You are prompted to change your RACF password.