IBM Support

PH49041: IBM Explorer for z/OS - RSEAPI PUT function fails due to security Passticket permission generation issue

A fix is available

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • In RSEAPI operation, with a delay of ~10 min after the
    connection is started, the first RSEAPI PUT function could fail
    with the following error returned from the "R_ticketserv" call.
    
    2022.08.11 09:10:52:648 EDT PID:50464945 THREAD:45D4C80000000048
    TCB:008B72B8 USER:USER123 ERROR: class
    com.ibm.rse.rest.adapters.dstore.RSEAPIZosClient: (R_ticketserv)
    2022.08.11 09:10:52:648 EDT PID:50464945 THREAD:45D4C80000000048
    TCB:008B72B8 USER:USER123 ERROR:
    com.ibm.eserver.zos.racf.IRRPassTicket.generate(IRRPassTicket.ja
    va:214)
    
    
    In the user's RSEAPI logs, it shows the sequence call leading up
    to the Passticket failure:
    
    
    2022.08.11 08:59:56:500 EDT PID:50464945 THREAD:45D4400000000046
    TCB:008B7450 USER:USER123 INFO: RSEAPI: Version '1.0.6'.
    Starting logging for user 'USER123'. Log directory:
    '/DEVSYS/USER123/.rseapi/6800.1/USER123/'. Debug level 3. Trace
    target 'ALL'.
    2022.08.11 08:59:56:500 EDT PID:50464945 THREAD:45D560000000004B
    TCB:008B7BE0 USER:USER123 DEBUG: class
    com.ibm.rse.rest.adapters.dstore.logger.RSEAPIZosServerLogger$Lo
    gWriterThread: calling getPassTicket for=USER123:FEKAPPL
    2022.08.11 08:59:56:500 EDT PID:50464945 THREAD:45D560000000004B
    TCB:008B7BE0 USER:USER123 DEBUG: class
    com.ibm.rse.rest.adapters.dstore.logger.RSEAPIZosServerLogger$Lo
    gWriterThread: calling pThreadSecurity for=USER123:FEKAPPL
    2022.08.11 08:59:56:500 EDT PID:50464945 THREAD:45D560000000004B
    TCB:008B7BE0 USER:USER123 DEBUG: class
    com.ibm.rse.rest.adapters.dstore.logger.RSEAPIZosServerLogger$Lo
    gWriterThread: APPLID=FEKAPPL
    2022.08.11 09:10:52:635 EDT PID:50464945 THREAD:45D4C80000000048
    TCB:008B72B8 USER:USER123 INFO: MVSFileSystemMiner: ENTER -
    extendSchema(): 9.1.1
    2022.08.11 09:10:52:644 EDT PID:50464945 THREAD:45D4C80000000048
    TCB:008B72B8 USER:USER123 INFO: MVSFileSystemMiner: EXIT -
    extendSchema()
    2022.08.11 09:10:52:644 EDT PID:50464945 THREAD:45D4C80000000048
    TCB:008B72B8 USER:USER123 INFO: MVSFileSystemMiner: ENTER -
    load(): 14.1
    2022.08.11 09:10:52:645 EDT PID:50464945 THREAD:45D4C80000000048
    TCB:008B72B8 USER:USER123 INFO: FFSServerImpl:
    search.server.limit.MaxFilterResults (no limit)
    2022.08.11 09:10:52:645 EDT PID:50464945 THREAD:45D4C80000000048
    TCB:008B72B8 USER:USER123 INFO: FFSServerImpl: initialize FFS
    server
    2022.08.11 09:10:52:646 EDT PID:50464945 THREAD:45D4C80000000048
    TCB:008B72B8 USER:USER123 INFO: FFSServerImpl: init
    logpath(/DEVSYS/USER123/.rseapi/6800.1/USER123/) logLevel(3
    target(16776960) TimeZone(EDT) ZoneOffset(-240) applid(FEKAPPL)
    2022.08.11 09:10:52:648 EDT PID:50464945 THREAD:45D4C80000000048
    TCB:008B72B8 USER:USER123 ERROR: class
    com.ibm.rse.rest.adapters.dstore.RSEAPIZosClient: (R_ticketserv)
    2022.08.11 09:10:52:648 EDT PID:50464945 THREAD:45D4C80000000048
    TCB:008B72B8 USER:USER123 ERROR:
    com.ibm.eserver.zos.racf.IRRPassTicket.generate(IRRPassTicket.ja
    va:214)
    

Local fix

Problem summary

  • ****************************************************************
    * USERS AFFECTED: 1. All RSEAPI users that issues an mvs       *
    *                 commands with a delay ~8-10 min after        *
    *                 starting a connection with a non-mvs         *
    *                 command..                                    *
    ****************************************************************
    * PROBLEM DESCRIPTION: 1. After the passticket life span       *
    *                      timeout is expired, during mvsminer     *
    *                      loading time, for the mvs files         *
    *                      system initialization and connection    *
    *                      operation, a request to generate a      *
    *                      new passticket will be issued and it    *
    *                      may fail as the user thread may lack    *
    *                      of the permission to generate the       *
    *                      pass ticket.                            *
    ****************************************************************
    1. Only server id is required to have the permission to
    generate passticket. A user thread may fail to generate a
    passticket and could fail to load and set up the mvsminer
    properly in the described scenario.
    

Problem conclusion

  • 1. Have passticket generation call used by the mvs Files
    System initialization and connection operation to run in a
    newly generated thread to inherit the process server id to be
    able to generate the passticket.
    Connection should be done with the newly generated ticket for
    the mvsminer's lock manager to work with proper security
    profile as the user.
    

Temporary fix

Comments

APAR Information

  • APAR number

    PH49041

  • Reported component name

    EXP FOR Z/OS HO

  • Reported component ID

    5655EXP23

  • Reported release

    311

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2022-08-26

  • Closed date

    2022-11-10

  • Last modified date

    2022-12-01

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Modules/Macros

  • FEJENF70 FEJJCNFG FEJJJCL  FEJJMON  FEJTSO   FEK1SMPE FEK2RCVE
    FEK3ALOC FEK4ZFS  FEK5MKD  FEK6DDEF FEK7APLY FEK8ACPT FEK@CERR
    FEK@CONE FEK@CONF FEK@CUST FEK@DEB  FEK@DESC FEK@FLOW FEK@GEN
    FEK@GENW FEK@ISPF FEK@IVP  FEK@IVPD FEK@IVPW FEK@JCN1 FEK@JCNE
    FEK@JESJ FEK@MAIN FEK@MIGO FEK@OPTE FEK@OPTG FEK@OPTN FEK@PRIM
    FEK@RSE1 FEK@RSEO FEK@STRT FEK@TAB1 FEK@TAB2 FEK@TAB3 FEK@WRK1
    FEK@WRK2 FEK@WRK3 FEK@WRK4 FEK@WRK5 FEKAPPCC FEKAPPCL FEKAPPCX
    FEKATTR  FEKDSI   FEKEESX0 FEKFASIZ FEKFATT1 FEKFBLD  FEKFCIPH
    FEKFCLIE FEKFCMOD FEKFCMPR FEKFCMSG FEKFCOMM FEKFCOPY FEKFCOR6
    FEKFCORE FEKFDBG  FEKFDBG6 FEKFDBGM FEKFDIR  FEKFDIR6 FEKFDIVP
    FEKFDST0 FEKFDST1 FEKFDST2 FEKFENVF FEKFENVI FEKFENVP FEKFENVR
    FEKFENVS FEKFEPL  FEKFERRF FEKFGDGE FEKFICUL FEKFISPF FEKFIVP0
    FEKFIVPA FEKFIVPD FEKFIVPI FEKFIVPJ FEKFIVPT FEKFJESM FEKFJESU
    FEKFJLIC FEKFJSON FEKFJVM  FEKFLATR FEKFLDSI FEKFLDSL FEKFLEOP
    FEKFLOGS FEKFLPTH FEKFMAI6 FEKFMAIN FEKFMINE FEKFMNTL FEKFNTCE
    FEKFOMVS FEKFPATT FEKFPLUG FEKFPTC  FEKFRIVP FEKFRMSG FEKFRSES
    FEKFRSRV FEKFSCMD FEKFSEND FEKFSSL  FEKFSTUP FEKFT000 FEKFT001
    FEKFT002 FEKFT003 FEKFT004 FEKFT005 FEKFT006 FEKFT007 FEKFT008
    FEKFT009 FEKFT010 FEKFT011 FEKFT012 FEKFT013 FEKFT014 FEKFT015
    FEKFT016 FEKFT017 FEKFT018 FEKFT019 FEKFT020 FEKFT021 FEKFT022
    FEKFT023 FEKFT024 FEKFT025 FEKFTIVP FEKFTSO  FEKFUTIL FEKFVERS
    FEKFXITA FEKFXITL FEKFZOS  FEKHCONF FEKHCUST FEKHDEB  FEKHDESC
    FEKHFLOW FEKHGEN  FEKHISPF FEKHIVP  FEKHIVPD FEKHJESJ FEKHMAIN
    FEKHMIGO FEKHOPTE FEKHOPTN FEKHPRIM FEKHRSE1 FEKHRSEO FEKHSTRT
    FEKHTAB1 FEKHTAB2 FEKINIT  FEKKEYS  FEKLOCKA FEKLOGR  FEKLOGS
    FEKM00   FEKM01   FEKM02   FEKMKDIR FEKMOUNT FEKMSGC  FEKMSGS
    FEKRACF  FEKRSED  FEKSAPF  FEKSAPPL FEKSBPX  FEKSCLAS FEKSCLOG
    FEKSCMD  FEKSCPYM FEKSCPYU FEKSDSN  FEKSENV  FEKSETUP FEKSISPF
    FEKSJCFG FEKSJCMD FEKSJMON FEKSLPA  FEKSPROG FEKSPTKT FEKSRSED
    FEKSSERV FEKSSTC  FEKSSU   FEKSUSER FEKXCFGE FEKXCFGI FEKXCFGM
    FEKXCFGT FEKXMAIN FEKXML   HUHFCOR6 HUHFCORE
    

Fix information

  • Fixed component name

    EXP FOR Z/OS HO

  • Fixed component ID

    5655EXP23

Applicable component levels

  • R320 PSY UI83251

       UP22/11/22 P F211

Fix is available

  • Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSBDYH","label":"IBM Explorer for z\/OS"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"311","Line of Business":{"code":"LOB35","label":"Mainframe SW"}}]

Document Information

Modified date:
01 December 2022