PH45550: DRDA CONVERSATIONAL PROTOCOL ERROR REASON: 0X1245. ERRORCODE=-4499, SQLSTATE=58009 WHEN CLIENTAUTHTYPE = REQUIRED

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• When using ClientAuthType Required in AT-TLS, the following
  error is received:
  .
  A DRDA Conversational Protocol Error was detected.
  Reason: 0x1245. ERRORCODE=-4499, SQLSTATE=58009
  .
  jcc trace shows DSNLTSECTLSCCASEC INVALID W/NON SECURE CONN
  
  
  Another failure seen when using DRDA SECMEC=18:
  SQL30082N Security processing failed with reason "17"
  ("UNSUPPORTED FUNCTION"). SQLSTATE=08001
  Server is not configured to support Client Certificate
  Authentication Security mechanism
  
  DRDA trace will show SECMEC code point below
  SECMEC 11A2 +0000  0012
  and PRCCNVRM is returned to the client
  
  
  
  
  
  Additional keywords and symptoms:
  **********************************
  DB2 DDF ACCSEC TLSCCASEC 11A2
  TLS_CLIENT_CERTIFICATE_SECURITY
  SQL30082N PRCCNVRM
  Db2REST DDFREST
  .
  Note: after applying PH45550, if a REST client passes both a
  valid Client certificate associated with a valid SAF/RACF
  userid and HTTP Basic Authentication (header authentication),
  message DSNL030I DSNLJTIN with REASON=00D30051 error condition
  may occur.
  .
  The options to address this symptom would be to implement one
  of the following:
   - Change the REST client to pass EITHER a SAF/RACF validated
     client certificate userid, *OR* HTTP Basic Authentication,
     BUT NOT BOTH.
   - If the user wants to continue to pass/use BOTH SAF/RACF
     validated client certificate userid and HTTP Basic
     Authentication, they the user would need to define the
     required Trusted Context definitions at the Db2 server.
  

Local fix

• No local workaround
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All Distributed Data Facility (DDF) users.                   *
  * Specifically where a Db2 for z/OS server is                  *
  * accessed by remote clients using TLS client                  *
  * (mutual) authentication.                                     *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * Remote client receives reason 0x1245                         *
  * and ERRORCODE -4499 when accessing a                         *
  * Db2 for z/OS using TLS client                                *
  * authentication security method.                              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply corrective PTF when available                          *
  ****************************************************************
  Remote clients using TLS client (mutual) authentication to
  access a Db2 for z/OS server receives a DRDA conversational
  protocol error with reason 0x1245 and ERRORCODE -4499.
  This connection failure occurs because at the Db2 server, the
  AT-TLS security policy specifies a client certificate
  validation method of ClientAuthType=Required. This method of
  client certificate validation is not currently allowed by Db2
  and as a result, Db2 returns a DRDA conversational protocol
  error back to the remote client.
  

Problem conclusion

• Db2 for z/OS remote connection authentication processing has
  been changed to support the AT-TLS client certificate
  validation method, ClientAuthType=Required if and only if, a
  valid user ID is associated with the client certificate when
  client (mutual) certificate authentication is requested by the
  client.
  Note: If AT-TLS ClientAuthType=Required client certificate
   validation is specified and the client certificate does not
   resolve to a valid user ID, Db2 will continue to return a
   DRDA conversation protocol error with reason 0x1245 and
   ERRORCODE -4499 to the client.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI80861 PH47411

Modules/Macros

• DSNLIRCA DSNLJTIN DSNLTSEC
  

Fix information

• Fixed component name

  DB2 OS/390 & Z/

• Fixed component ID

  5740XYR00

Applicable component levels

• RC10 PSY UI80861

     UP22/06/10 P F206

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.