OA44855: NEW FUNCTION- LOGON PREPROMPT

Obtain the fix for this APAR.

APAR status

• Closed as new function.

Error description

• New Function
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of z/OS TSO/E.                     *
  ****************************************************************
  * PROBLEM DESCRIPTION: This support provides the ability       *
  *                      to inhibit all user information prior   *
  *                      to the successful input of a valid      *
  *                      password.                               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Information regarding a TSO/E user may be presented via the
  logon panel prior to the password being entered.
  

Problem conclusion

Temporary fix

Comments

• A new option has been added to TSO/E Logon processing that
  an installation can activate which will require a user to
  successfully enter both a valid TSO/E User ID as well as
  the password before having any interaction with the system
  or access to any user information.
    By having PASSWORDPREPROMPT(ON) specified on the LOGON
  statement of IKJTSOxx the user will be prompted for the
  password, which must be correct, before the full panel (with
  user attributes visible) is presented.
  
  
  Documentation changes associated with this new function are:
  
  ****************************************************************
  * FUNCTION AFFECTED: TSO/E                           (OA44855) *
  *                      Commands                                *
  ****************************************************************
  * DESCRIPTION      : Documentation updates                     *
  ****************************************************************
  * TIMING           : As Needed                                 *
  ****************************************************************
  +==============================================+
  = z/OS MVS Initialization and Tuning Reference =
  +==============================================+
  - IKJTSOxx - add new system setting under the LOGON keyword
  | PASSWORDPREPROMPT(ON|OFF)
  |   Specifies whether the user will be prompted to enter both
  |   the User ID and password prior to the presentation of any
  |   other information.
  |   Warning: TSO/E Logon Exits may need to be updated before
  |   activating PASSWORDPREPROMPT.  Exit processing that affects
  |   the TSO/E User ID or password may not work as expected.
  
  +==============================+
  = z/OS TSO/E Command Reference =
  +==============================+
  - LOGON command, section Full-Screen LOGON versus line mode
  LOGON
    If you enter more parameters than user_id on the LOGON
    command, TSO/E accepts and processes them with the
  | exception of the new password field.
  
  - LOGON command, section Full-Screen LOGON processing
    After you have issued a LOGON command the full-screen logon
    command processing performs the following:
  | o If your installation has PasswordPreprompt active
  |   there will be a line mode prompt for password and if either
  |   User ID and password are incorrect the system responds with
  |   message Userid or Password not authorized and terminates.
    o It displays a menu with the previous session's logon param-
      eter values. Logon command parameters entered on the LOGON
      command override any default values from the previous
      session.
  | o If not previously entered, it requests a password.  If you
      enter a not valid password, the system will prompt you to
      re-enter it after you have pressed the Enter key.
  
  +==========================+
  = z/OS TSO/E Customization =
  +==========================+
  - Add a new section to Chapter 8. Customizing the logon and
   logoff process
  | Activating PasswordPrePrompt support
  |   To provide additional security to the installation by
  |   requiring the user to provide both the user ID and password
  |   before allowing any additional access, follow these steps:
  |   1. Set the PASSWORDPREPROMPT parameter on the LOGON state-
  |      ment in the SYS1.PARMLIB member IKJTSOxx to (ON).
  |   2. Use the MVS SET IKJTSO=xx or TSO/E PARMLIB UPDATE(xx)
  |      command to update the system setting.
  | This forces the user to provide both the user ID and the
  | password before further processing can occur.  If either item
  | is incorrect then message USERID OR PASSWORD NOT AUTHORIZED is
  | issued.
  |   Warning: TSO/E Logon Exits may need to be updated before
  |   activating PASSWORDPREPROMPT.  Exit processing that affects
  |   the TSO/E User ID or password may not work as expected.
  
  - Update Logon pre-display exit IKJEFLN1
    The pre-display exit, IKJEFLN1, receives control just before
  | the logon panel is displayed to the TSO/E user, and if
  | PasswordPrePrompt is active,just after the password has been
  | accepted.  This exit receives control each time the panel
  | is redisplayed to the TSO/E user.
  
  - Update the description of User ID under Parameter Descriptions
    for IKJEFLN1
    User ID
      This parameter contains the user ID that was specified by
      the user in the LOGON command.  You can change the user ID
      parameter using this exit.  The maximum length of the data
  |   is 7 bytes.  Note that if PasswordPrePrompt is active the
  |   User ID will already be validated and cannot be updated.
  
  - Update the description of Password under Parameter
    Descriptions for IKJEFLN1
    Password
  |   Upon initial invocation of IKJEFLN1 (and PasswordPrePrompt
  |   is not active), this parameter does not contain any data.
      . . .
  |   Note that if PasswordPrePrompt is active the Password will
  |   already be validated and cannot be updated.
  
  - Update the description of Re-prompt under Parameter
    Descriptions for IKJEFLN2
      If you wish to re-prompt a TSO/E user for a field, you must
      set this bit on. The Re-prompt Code parameter (parameter 15)
      describes the field for which the re-prompt is necessary.
  |   Note that requesting a re-prompt for an already validated
  |   field will cause a system ABEND.
  
  - Update the description of User ID under Parameter Descriptions
    for IKJEFLN2
    User ID
      This parameter contains the user ID that was specified by
      the user in the LOGON command.  You can change the user ID
      parameter using this parameter. The maximum length of the
  |   data is 7 bytes. Note that if PasswordPrePrompt is active
  |   the User ID will already be validated and cannot be updated.
  
  - Update the description of Password under Parameter
    Descriptions for IKJEFLN2
    Password
      . . .
  |   Note that if PasswordPrePrompt is active the Password will
  |   already be validated and cannot be updated.
  
  +=====================+
  = z/OS TSO/E Messages =
  +=====================+
    - new message IKJ56474I
  | IKJ56474I USERID OR PASSWORD IS INCORRECT OR NOT AUTHORIZED
  |   Explanation: The logon information that was provided was
  |                not valid.
  |   System action: The logon failed and the command is
  |                  terminated.
  |   User response: Reissue the command with valid logon      .
  |                  information for the user.
  |   Module: IKJEFLEA, IKJEFLE3
  |   Program: LOGON
  
  | IKJ56475I PRE-PROMPT PROCESSING FAILED
  |   Explanation: An error was encountered while verifying
  |                the userid and password.
  |   System action: The logon failed and the command is
  |                  terminated.
  |   User response: Reissue the command with valid logon      .
  |                  information for the user.  If the problem
  |                  recurs, contact your TSO/E administrator.
  |   Module: IKJEFLEA, IKJEFLE3
  |   Program: LOGON
  
  | IKJ56476I ENTER PASSWORD:
  |   Explanation: A password has not yet been entered.
  |   User response: Enter a valid password.                   .
  |   Module: IKJEFLEA
  |   Program: LOGON
  
  +=========================================+
  = z/OS TSO/E System Diagnosis: Data Areas =
  +=========================================+
  
  IKJTPVT Map - add TPVT_LGPC
   76 (4C) BITSTRING   TPVT_LOCAL_FLAGS
           1111 ....   *
           .... 1...   TPVT_PHRS
           .... .1..   TPVT_APPL
           .... ..1.   TPVT_LGNH
  |        .... ...1   TPVT_LGPC  PASSWORDPREPROMPT flag for
  |                               PARMLIB processing
  
    TPVT_LGNH         4C 02
  | TPVT_LGPC         4C 01
    TPVT_LOCAL_FLAGS0 4C
  
  IKJTSVT Map - add TSVTLGPC
   add to FLAG INDICATORS FOR TSVTFLG1
  |        .... ...1   TSVTLGPC  "X'01'" PASSWORDPREPROMPT support
  |                              is active
  
    TSVTLGNH        128 2
  | TSVTLGPC        128 1
    TPVTLMOD         67
  
  +=========================================+
  = z/OS TSO/E User's Guide                 =
  +=========================================+
  Section: Full-Screen Logon for a RACF-Defined User
  Add a Note:
   If PasswordPrePrompt is active, you will be prompted for your
   password prior to the display of the full-screen panel.
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UA78744 UA78745 UA78746

Modules/Macros

• IKJEFLE  IKJEFLEA IKJEFLE3 IKJEFLGN IKJEFLNL
  IKJEFLPL IKJEFLPU IKJEFRAF IKJEFXSR IKJMSP00 IKJPRMLB IKJPRMUP
  IKJTSVT
  

Fix information

• Fixed component name

  TSO/E SCHEDULAR

• Fixed component ID

  566528502

Applicable component levels

• R7A0 PSY UA78746

     UP15/09/09 P F509

• R780 PSY UA78744

     UP15/09/09 P F509

• R790 PSY UA78745

     UP15/09/09 P F509

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.