PH53117: SURROGATE USERID CHECK GETS ICH408I INSUFFICIENT AUTHORITY FOR LOWERCASE USERID. USERID NOT UPPERCASED.

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• When CICS is acting as a web service provider, the PIPELINE is
  configured to use WS-Security and the trusted partner system has
  supplied a single userid to run the web service request under,
  a security violation occurs due to a correct, but lowercase
  userid.
  The following message occurred:
  ICH408I USER(XXXXXXXX) GROUP(XXXXXXXX) NAME(XXXXXX:XXX USR CTG)
  yyyyyyyy.DFHSTART CL(SURROGAT)
  WARNING: INSUFFICIENT AUTHORITY - TEMPORARY ACCESS ALLOWED
  FROM *.DFHSTART (G)
  ACCESS INTENT(READ   )  ACCESS ALLOWED(NONE   )
                                                                 .
  The incoming request to CICS is using WS-Security to pass a
  userid, and in this example, the userid is lowercase yyyyyyyy .
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: Lowercase userid supplied during a web  *
  *                      request with WS-Security enabled leads  *
  *                      to a security violation (ICH408I).      *
  ****************************************************************
  CICS receives a SOAP web service request which contains a
  WS-Security UsernameToken. The userid value is used as part of a
  surrogate check to see if the specified user is authorised to
  run the pipeline transaction. However the surrogate user
  checking is not folding the userid to uppercase. The invalid
  lowercase value is passed to the External Security Manager, in
  this instance RACF. This in turn causes the msgICH408I to be
  issued as uppercase is required.
  

Problem conclusion

• CICS has been updated to ensure that the userid is uppercased
  before performing the surrogate check.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PH52591

• APAR is sysrouted TO one or more of the following:

  UI91261

Modules/Macros

• DFHXSRC
  

Fix information

• Fixed component name

  CICS TS Z/OS V6

• Fixed component ID

  5655YA100

Applicable component levels

• R400 PSY UI91261

     UP23/04/05 P F304

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.