I applied IBM maintenance (OA49905) NEW FUNCTION - HONOR CHKAUTH=NO ON RACROUTE REQUEST=DEFINE,TYPE=ADDVOL and now I get acf2 violations against garbage dataset names.

Document ID:  TEC1492153
Last Modified Date:  06/12/2017
{{active ? 'Hide' : 'Show'}} Technical Document Details

Products

  • CA ACF2 for z/OS

Releases

  • CA ACF2 for z/OS:Release:15
  • CA ACF2 for z/OS:Release:16

Components

  • CA ACF2 for z/OS:ACF2MS
Problem:

After implementing relatively current z/OS maintenance, we have several jobs that fail.

Jobs that worked for years, start failing with spurious or unpredictable security violations. 

This ACF2 HIPER - RO91013, was identified as the Fix for this condition. However, there is no information what this APAR 'fixes'. 

 

What is broken that needs fixing ?

 

Racroute 'define' calls to SAF are getting a not authorized message to do the define and the dataset name showing up in the violation is garbage.

 

                     ACF99913 ACF2 VIOLATION-08,06,logonid,VOL123,VOL456hsjns........¬@..¬ 

or: 

                     ACF99058 INVALID DSN SLRG0G....... .........@...@.........3K\E..\ OR LIB

 

Message ACF99058 may be issued instead of ACF99913.

 

Since there are no rules to authenticate the 'garbage' dataset name, ACF2 generates a violation.

Resolution:

IBM APAR OA49905 changed the IBM code during a SAF REQUEST=DEFINE,TYPE=ADDVOL to change the CHKAUTH= from a NO to a YES. 

This ACF2 HIPER, RO91013 was introduced to address this IBM change. 

IBM Problem summary
APAR / OA49905: NEW FUNCTION - HONOR CHKAUTH=NO ON RACROUTE REQUEST=DEFINE,TYPE=ADDVOL

    ****************************************************************
   * USERS AFFECTED: Users of the RACROUTE REQUEST=DEFINE,                        
   *                 TYPE=ADDVOL who wish to suppress the                                        
   *                 authorization check that is performed.                                                
   ****************************************************************

    * PROBLEM DESCRIPTION: Users of a RACROUTE REQUEST=DEFINE,  
    *                      TYPE=ADDVOL cannot suppress the                                              
    *                      authorization check that is performed.                                          
    ****************************************************************

    * RECOMMENDATION:                                                                                           

    ****************************************************************

    CHKAUTH=NO is now honored on a RACROUTE

    REQUEST=DEFINE,TYPE=ADDVOL.

 

Additional Notes:

For ACF2 R15.0 - HIPER is RO91013

For ACF2 R16.0 - HIPER is RO91270

Please help us improve!

Will this information enable you to resolve your issue?

Please tell us what we can do better.

{{feedbackText.length ? feedbackText.length : '0'}}/255

{{status}}

Not what you were looking for?

Search Again >

Product Information

Support by Product >

Communities

Join a Community >

Chat with CA

Just give us some brief information and we'll connect you to the right CA ExpertCA sales representative.

Our hours of availability are 8AM - 5PM CST.

All Fields Required

connecting

We're matching your request.

Unfortunately, we can't connect you to an agent. If you are not automatically redirected please click here.

  • {{message.agentProfile.name}} will be helping you today.

    View Profile


  • Transfered to {{message.agentProfile.name}}

    {{message.agentProfile.name}} joined the conversation

    {{message.agentProfile.name}} left the conversation

  • Your chat with {{$storage.chatSession.messages[$index - 1].agentProfile.name}} has ended.
    Thank you for your interest in CA.


    Rate Your Chat Experience.

    {{chat.statusMsg}}

agent is typing