OA41023: AT Z/OS V1R12 AND UP GENERIC DATASET PROFILES, THAT SPAN 2 OR MORE SPLITS IN A RACF DB, MAY NOT ALL BE LOADED TO BE USED.

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• Similar to RACF APAR OA37949 (was taken for GENERAL Resource and
  non RACLISTED profiles).
  
  
  Customer upgraded from 1.11 to 1.13 (iow, passed thru 1.12) and
  as shown via RVARY LIST has a SPLIT RACF DB.
  
  He has (verifiably) above apar applied: SMP/E zones say applied
  and browsing IRRMNGR in SYS1.LPALIB of 1.13 respack show:
  
        (when doing a FIND for IRRMDR00)
  
  .....IRRMDR00 11341 UA63485....
  
  
  His external symptoms were:
  
  
  < from AUTH requests >
  ICH408I USER(uuuuuuu ) GROUP(gggggg    ) NAME(
    hlq.nextq.DB2TMSTR.JOB CL(DATASET ) VOL(vvvvvv)
    RESOURCE NOT PROTECTED
    ACCESS INTENT(READ   )  ACCESS ALLOWED(READ   )
  
  and   (using LD to FIND covering profile )
  
  LD DA('hlq.nextq.DB2TMSTR.JOB') GEN
  
  shows
  
  
  ICH35003I NO RACF DESCRIPTION FOUND FOR
                  hlq.nextq.DB2TMSTR.JOB
  
  
  
  yet
  a) if searched
     SR MASK(hlq.nextq.DB2TM)
  
     you would see
  
     hlq.nextq.DB2TM*.J*
  
  
  b) when listing IT (profile from search) specifically
  
     LD DA('hlq.nextq.DB2TM*.J*') GEN
  
     it SHOWS the correct profile
  
  Initially I loaded all his generics (523 with that hlq)  on my
  test lpar (1.13) and did not see problem. (single segment RACF
  DB).
  
  When we gave him a SLIP to generate dump on seen ICH408Is the
  profile list chained off ACEE (acee-->gate-->pr64 (or GPRFL from
  RACF data areas) looked wrong.  There were not enough profiles
  in only PR64 and none (more) were chained to it.
  
  
  Then I used his range table, split the DB into two segments and
  noted the split took some of the HLQ into split1 and the rest
  into split2,  His IRRUT200 also showed them split up.  His range
  consciously splits that dataset hlq up.  Then recreated issue..
  

Local fix

• apply ++apar when available
  or
  consider a GLOBAL entry to grant access
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: RACF installations that have split their     *
  *                 RACF database into ranges where generic      *
  *                 profiles are placed in 2 or more splits.     *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  
  The covering profile may not be found when it
  is in the last range but not in the last split.
  

Problem conclusion

• Added code to handle ICHEINTY NEXT processing
  with INDEX=MULTIPLE, for the case that RACF
  installations have split their RACF database
  into ranges where generic profiles are placed
  in 2 or more splits.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UA67927 UA67928

Modules/Macros

• IRRMDR00
  

Fix information

• Fixed component name

  RACF

• Fixed component ID

  5752XXH00

Applicable component levels

• R770 PSY UA67927

     UP13/02/20 P F302

• R780 PSY UA67928

     UP13/02/20 P F302

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.