You need to define the IRR.RDCERUID profile in the FACILITY class to control the use of the SAF R_dceruid callable service. This maps the DCE UUID to the RACF® user ID. Applications that use this service must have at least READ access to the resource IRR.RDCERUID.