IBM Support

PI93303: CICS_REGION_BUT_API_DISALLOWED SURFACES USING OAUTH-2.0 FEATURE

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • A Liberty server running with the oauth-2.0 feature may
    
    experience the following exception:
    
    
    [jcc][50053][12310][4.22.37] T2zOS exception:
    
    [jcc][T2zos]T2zosCicsApi.checkApiStatus: Thread is not
    CICS-DB2
    compatible: CICS_REGION_BUT_API_DISALLOWED ERRORCODE=-4228,
    
    SQLSTATE=null DSRA0010E: SQL State = null, Error Code =
    -4,228
    com.ibm.db2.jcc.am.ld.a(ld.java:794)
    
    com.ibm.db2.jcc.am.ld.a(ld.java:66)
    
    com.ibm.db2.jcc.am.ld.a(ld.java:116)
    
    com.ibm.db2.jcc.t2zos.cb.a(cb.java:370)
    
    com.ibm.db2.jcc.t2zos.cb.a(cb.java:414)
    
    com.ibm.db2.jcc.t2zos.cb.a(cb.java:482)
    
    com.ibm.db2.jcc.t2zos.j.c(j.java:488)
    
    com.ibm.db2.jcc.t2zos.T2zosConnection.a(T2zosConnection.java
    :173
    6)
    
    ...
    
    com.ibm.ws.security.oauth20.plugins.db.OAuthJDBCImpl.getDBCo
    nnec
    tion(OAuthJDBCImpl.java:117)
    
    com.ibm.ws.security.oauth20.plugins.db.DBConsentCache$Cleanu
    pThr
    ead.run(DBConsentCache.java:272)
    

Local fix

Problem summary

  • ****************************************************************
    * USERS AFFECTED:  All users of IBM WebSphere Application      *
    *                  Server Liberty running in a CICS address    *
    *                  space on z/OS and using OAuth 2.0           *
    ****************************************************************
    * PROBLEM DESCRIPTION: CICS_REGION_BUT_API_DISALLOWED error    *
    *                      may occur with OAuth 2.0 when Liberty   *
    *                      is running in a CICS address space on   *
    *                      z/OS                                    *
    ****************************************************************
    * RECOMMENDATION:                                              *
    ****************************************************************
    When Liberty is running inside a CICS address space on z/OS,
    threads that interact with DB2 using the Type 2 driver require
    additional CICS-specific initialization.  When using OAuth 2.0
    persistent services, the OAuth 2.0 token cache cleanup thread
    comes from a thread pool that CICS is unaware of, and therefore
    threads from this pool do not receive the additional
    initialization.  This leads to the following error:
    
    [jcc][50053][12310][4.22.37] T2zOS exception:
    [jcc][T2zos]T2zosCicsApi.checkApiStatus: Thread is not CICS-DB2
    compatible: CICS_REGION_BUT_API_DISALLOWED ERRORCODE=-4228,
    SQLSTATE=null DSRA0010E: SQL State = null, Error Code = -4,228
    com.ibm.db2.jcc.am.ld.a(ld.java:794)
    com.ibm.db2.jcc.am.ld.a(ld.java:66)
    com.ibm.db2.jcc.am.ld.a(ld.java:116)
    com.ibm.db2.jcc.t2zos.cb.a(cb.java:370)
    com.ibm.db2.jcc.t2zos.cb.a(cb.java:414)
    com.ibm.db2.jcc.t2zos.cb.a(cb.java:482)
    com.ibm.db2.jcc.t2zos.j.c(j.java:488)
    com.ibm.db2.jcc.t2zos.T2zosConnection.a(T2zosConnection.java:173
    6)
    ...
    com.ibm.ws.security.oauth20.plugins.db.OAuthJDBCImpl.getDBConnec
    tion(OAuthJDBCImpl.java:117)
    com.ibm.ws.security.oauth20.plugins.db.DBConsentCache$CleanupThr
    ead.run(DBConsentCache.java:272)
    

Problem conclusion

  • The Liberty OAuth 2.0 feature was updated so that its token
    cache cleanup threads come from the Liberty default executor,
    which is a thread pool that CICS is aware of.
    
    The fix for this APAR is currently targeted for inclusion in fix
    pack 18.0.0.1.  Please refer to the Recommended Updates page for
    delivery information:
    http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
    

Temporary fix

Comments

APAR Information

  • APAR number

    PI93303

  • Reported component name

    LIBERTY PROF -

  • Reported component ID

    5655W6514

  • Reported release

    CD0

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2018-02-02

  • Closed date

    2018-03-23

  • Last modified date

    2018-03-23

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    LIBERTY PROF -

  • Fixed component ID

    5655W6514

Applicable component levels

  • RCD0 PSY

       UP

[{"Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"SG19M"},"Platform":[{"code":"PF054","label":"z\/OS"}],"Version":"CD0"}]

Document Information

Modified date:
07 September 2021