Message CPF9898 Authorization Error with Native JDBC or CLI

The behavior of the native JDBC driver and CLI connections will change after applying the following PTFs or their supersedes:

SI30130 and SI30134 for V5R3
SI30131 and SI30132 for V5R4
SI29733 for V6R1

After these PTFs are applied, the user ID and password that is used to connect through native JDBC or CLI must be valid if any user ID is specified. If an attempt is made to connect using an invalid user ID or an incorrect password, message CPF9898 will be logged in the job log. It will also be logged in the QSECOFR message queue. The text of the message is Authorization error: Refer to PTF 5722SS1 SI30132 for more information. At V6R1, the message will refer to the V6R1 equivalent PTFs. This change is documented in the Memo to Users for V6R1, and it is also described in the cover letters for the PTFs listed above. Note that at V5R3 and V5R4, there are two PTFs involved in the change. These PTFs update the native JDBC driver and the CLI components. However, because these are different products, the PTFs cannot be listed as co-requisites. Both PTFs must be applied for correct behavior.

Prior to this change, CLI and native JDBC connections allow connections using the current user of the job when no user ID or invalid information is specified. This behavior will be continued in present versions only if the user ID and password are set to null values. With Java, that means a null reference and, for CLI, a null pointer. The following examples demonstrate how this can be done:

JDBC connection as the current user

connection = DriverManager.getConnection("jdbc:db2:*local", null, null);

or

connection = DriverManager.getConnection("jdbc:db2:*local");

CLI connection as the current user

rc = SQLConnect(hdbc, "*LOCAL", SQL_NTS, NULL, SQL_NTS, NULL, SQL_NTS);

The PTFs also introduce a mechanism so that an application that is dependent on the previous behavior can still function without modification. The old behavior will work if the data area QSYS/QSQCLICON exists and contains the value "*PRVCHK." We recommend modifying the application so that it uses null values or provides a valid user ID and password rather than relying on the data area and previous behavior. If the previous behavior is required, it can be created by using the following command:

CRTDTAARA DTAARA(QSYS/QSQCLICON) TYPE(*CHAR) LEN(7) VALUE(*PRVCHK)
 

Important Note: Using the data area will not be supported in releases after V6R1.