VM66906: Z/VM 7.4 RACF FIX PACK - FEATURE 02 FIX 01

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• RACF invocation by the server fails with return code 28 (command
  issuer has been revoked) when logged on using LOGONBY.
  
  Once this occurs, the server's connection with RACF continues
  to fail until the BYUSER is resumed, another non-revoked user
  logs on to the server using LOGONBY, or the server logs off and
  logs back on using XAUTOLOG (or logs on without using LOGONBY).
  The RACF module's return code 28 causes the server to treat the
  RACF interaction as failed.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: Users of z/VM RACF who run with DirMaint     *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  ****************************************************************
  * RECOMMENDATION: APPLY PTF                                    *
  ****************************************************************
  This is the APAR for z/VM 7.4 RACF Fix pack 0201. It contains
  the following fix :
  Server fails to recover RACF interaction after RC=28 (issuer
  revoked) when logged on using LOGONBY.
  
  When server is logged on using LOGONBY and BYUSERID is revoked
  RACF invocations from server start failing with RC=28
  All subsequent RACF requests continue to fail afterward
  even if the BYUSERID is later resumed
  Failure persists until another non-revoked user logs on
  or server logs off and logs on using XAUTOLOG
  Server treats RC=28 as fatal and does not recover
  the RACF interaction context
  

Problem conclusion

• Server fails to recover RACF interaction after RC=28 (issuer
  revoked) when logged on using LOGONBY.
  
  The fix updates user token generation and ACINOPAS handling to
  correctly resolve BYUSER and surrogate identities and adds
  recovery logic to rebuild the RACF issuer context when RC=28
  occurs so RACF processing can resume normally.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UV99460

Modules/Macros

• RPIMRCF  7VMRAC40
  

Fix information

• Fixed component name

  RACF/VM SUPPORT

• Fixed component ID

  576700201

Applicable component levels

• R740 PSY UV99460

     UP26/02/24 P 7404

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.