II08948: TCP/IP FOR MVS: KERBEROS RELATED INFORMATION

APAR status

• INTRAN

Error description

• Kerberos Information APAR
  

Local fix

• ****************************************************************
  *          TCP/IP for MVS Kerberos related information         *
  *                                                              *
  *     Please refer to the PSP Bucket UPGRADE TCPIP310 and      *
  *     our Web site at www.raleigh.ibm.com/tcm/tcmprod.html     *
  *                for additional information.                   *
  *                                                              *
  ****************************************************************
  *                                                              *
  * Chapter 16. "Configuring the Kerberos Server" of the TCP/IP  *
  * for MVS Customization and Administration Guide (SC31-7134-00)*
  * the Web site to download that information. The following list*
  * gives some hints on verifying the Kerberos configuration.    *
  * Please use this in conjunction with the Customization and    *
  * Administration Guide and the update mentioned above:         *
  *                                                              *
  *                                                              *
  * 1. Verify that the host name can be resolved. From a TSO     *
  *    command line, issue an NSLOOKUP of the fully qualified    *
  *    TCP/IP host name of the MVS system. For example, if the   *
  *    host name is mvsa.tcp.raleigh.ibm.com, then issue:        *
  *                                                              *
  *                                                              *
  *    Example output:                                           *
  *                                                              *
  *    Server:  buzz.tcp.raleigh.ibm.com                         *
  *    ADDRESS:  9.67.96.4                                       *
  *                                                              *
  *    Name:    MVSA.TCP.RALEIGH.IBM.COM                         *
  *    ADDRESSES: 9.67.113.60, 9.67.116.11, 9.67.116.38          *
  *                                                              *
  * 2. Modify both the MVSKERB and ADM@SERV PROCs to specify the *
  *    -r option as a PARM, for example:                         *
  *    //MVSKERB PROC MODULE=KERBEROS,PARMS='-r your_domain_name'*
  *                                                              *
  *    where your_domain_name is the TCP/IP domain for the MVS   *
  *    Host as defined by the DomainOrigin statement in the      *
  *    TCPIP.DATA dataset.                                       *
  *                                                              *
  * 3. Verify that their KRB.CONF files are correct and in the   *
  *    correct places.                                           *
  *                                                              *
  *    For now, make sure there is an ADM@SRV.KRB.CONF file. You *
  *    should be able to specify a user_id.KRB.CONF file, but    *
  *    PN72513 applied.                                          *
  *                                                              *
  * 4. Use KDB@UTIL DUMP command to dump the Kerberos database to*
  *    a data set. Verify that there is an entry for the userid  *
  *    that is being used followed by an asterisk and another    *
  *    entry for sample followed by watson.                      *
  *                                                              *
  * 5. Issue a KLIST command under the userid running the client *
  *    to verify that a valid ticket exists. Example:            *
  *                                                              *
  *    TICKET FILE:    TMP.TKT0                                  *
  *                                                              *
  *    Issued           Expires          Principal               *
  *    Jun 19 18:45:29  Jun 20 02:45:29  krbtgt.tcp.ral.ibm.com  *
  *    @tcp.raleigh.ibm.com                                      *
  *    Jun 19 18:58:13  Jun 20 02:48:13  sample.watson           *
  *    @tcp.raleigh.ibm.com                                      *
  *                                                              *
  ****************************************************************
  

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels