PI56743: CANCEL THREAD FAILS WITH SECONDARY AUTHIDS WHEN DSN3SSGN MODIFIED

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• OMEGAMON DB2 uses RRSAF to sign on to DB2 to issue a DB2 cancel
  thread. The default DSN3SSGN will typically provide the list of
  RACF / SAF groups to which the logged on user belongs. The
  logged on user's authority to cancel a DB2 thread is obtained
  through one of these secondary authids.
  
  Some shops have modified the DSN3SSGN to not provide the list of
  groups / secondary authids unless the sign on is coming in as it
  would for a CICS signon with AUTH=GROUP.
  

Local fix

• apply PTF
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: OMEGAMON XE for DB2 PE/DB2PM                 *
  *                 users of component                           *
  *                 - PE Server subtask                          *
  ****************************************************************
  * PROBLEM DESCRIPTION: When a cancel thread command is issued  *
  *                      from PE Server on behalf of a logon     *
  *                      user ID which has not the privilege to  *
  *                      cancel threads but is assigned to a     *
  *                      group with this privilege and the DB2   *
  *                      signon exit DSN3@SGN has been modified  *
  *                      to skip the group name processing in    *
  *                      case the passed group name has been     *
  *                      left blank, the cancel thread command   *
  *                      fails.                                  *
  ****************************************************************
  * RECOMMENDATION: Apply this PTF.                              *
  ****************************************************************
  PROBLEM SUMMARY:
  When the DB2 signon exit DSN3@SGN has been modified to skip the
  group name processing in case the passed group name has been
  left blank, the call of PE Server to authorized signon and the
  consecutive processing of the cancel thread command through IFI
  are performed with the authorization of the logon user ID
  because PE Server does not set a group name.
  
  PROBLEM CONCLUSION:
  The code has been corrected accordingly to pass a group name
  in addition to the logon user ID and created ACEE to the
  authorized signon function call.
  
  KEYWORDS:
  CANCEL THREAD DSN3@SGN
  

Problem conclusion

• The code has been corrected accordingly to pass a group name
  in addition to the logon user ID and created ACEE to the
  authorized signon function call.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI35620 UI35621

Modules/Macros

• DGOVMSTR FPEVDB22
  

Fix information

• Fixed component name

  OM XE DB2PE/PM

• Fixed component ID

  5655OPE00

Applicable component levels

• R520 PSY UI35620

     UP16/02/26 P F602

• R530 PSY UI35621

     UP16/02/26 P F602

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.