PH36717: Invoking an IMS service with PassTicket failed with PASSWORD/PASSWORD PHRASE NOT AUTHORIZED.

APAR status

• Closed as unreproducible in next release.

Error description

• Invoking an IMS service with a PassTicket returns the following
  error message:
  IMS Connect returned an error: RETCODE=[8],REASONCODE=[SECFAIL],
   RACFRETURNCODE=[8]. [Password/password phrase not authorized]
  
  The z/OS Connect EE messages.log shows following error messages:
  [4/16/21 17:27:27:394 GMT] 00000025 com.ibm.ejs.j2c.ConnectionEv
  entListener                         A J2CA0056I: The Connection
  Manager received a fatal connection error from the Resource
  Adapter for resource null. The exception is: javax.resource.spi.
  EISSystemException: ICO0001E_RACF: com.ibm.connector2.ims.ico.
  IMSTCPIPManagedConnection@3a1c00ec.processOutputOTMAMsg(
  Connection, InteractionSpec, Record, Record) error.
  IMS Connect returned an error: RETCODE=[8],
  REASONCODE=[SECFAIL ], RACFRETURNCODE=[8].
  [Password/password phrase not authorized]
  
  [4/16/21 17:27:27:396 GMT] 00000025 com.ibm.j2ca.RAIMSTM      E
  javax.resource.spi.EISSystemException: ICO0001E_RACF:
  com.ibm.connector2.ims.ico.IMSTCPIPManagedConnection@3a1c00ec.pr
  ocessOutputOTMAMsg(Connection, InteractionSpec, Record, Record)
  error. IMS Connect returned an error:
  RETCODE=[8], REASONCODE=[SECFAIL ], RACFRETURNCODE=[8].
  [Password/password phrase not authorized]
      at com.ibm.connector2.ims.ico.IMSManagedConnection.processOu
      tputOTMAMsg(IMSManagedConnection.java:4042)
      at com.ibm.connector2.ims.ico.IMSTCPIPManagedConnection.call
      SendRecv(IMSTCPIPManagedConnection.java:241)
      at com.ibm.connector2.ims.ico.IMSManagedConnection.call(IMSM
      anagedConnection.java:1625)
      at com.ibm.connector2.ims.ico.IMSConnection.call(IMSConnecti
      on.java:213)
      at com.ibm.connector2.ims.ico.IMSInteraction.execute(IMSInte
      raction.java:586)
  
  Additional search words: SECFAIL J2CA0056I msgJ2CA0056I J2CA0056
  msgJ2CA0056
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of z/OS Connect EE V3.0 using      *
  *                 PassTicket support for IMS services.         *
  ****************************************************************
  * PROBLEM DESCRIPTION: Invoking an IMS service with PassTicket *
  *                      failed with PASSWORD/PASSWORD PHRASE    *
  *                      NOT AUTHORIZED.                         *
  ****************************************************************
  UserIDs used to generate PassTickets are treated as case
  sensitive. When the user ID was specified in lower or camel case
  the generated PassTickets resulted in failures during
  authorization in IMS Connect and caused the reported
  "Password/password phrase not authorized" message being issued
  from IMS Connect.
  

Problem conclusion

Temporary fix

Comments

• The z/OS Connect EE IMS service provider has been changed to
  process the user IDs in upper case while generating the
  PassTickets to avoid the authorization failures of identify
  propagation in IMS Connect.
  
  The fix for this APAR is expected to be delivered by the PTF for
  z/OS Connect EE V3.0.45.0 (PH36068).
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  Z/OS CONNECT EE

• Fixed component ID

  5655CE300

Applicable component levels