IF you have:
- CA Top Secret? Security for z/OS - MVS Release: 15.0
- You install Computer Associates' recent change (RO63740)
- You use UID 0 for submitting jobs
- and you use unified login
THEN you may see this:
Quote
arsload: Using /products/ars/SYSTtmp for temporary files
arsload: Processing file >/products/ars/tmp/11211141 (DD:INPUT-FOO.DOC
Userid or password is invalid
Unified login user id(0) user name (*MSCA*)
arsload: Processing failed for file
>/products/ars/MVST/SYSTtmp/50790642 (DD:INP
Userid or password is invalid
Unified login user id(0) user name (*MSCA*)
arsload: Unable to log load information
arsload: Processing has stopped. The remaining files will NOT be processed.
We received this same error as we remediated some RACF security to make the ARSOCK and ARSLOAD STC's 'PROTECTED' (aka, NOPASSWORD). Using server configuration parameter "ARSMVS_ALTERNATE_UNIFIED_LOGIN=1", the utility job ARSLOAD started throwing the same failure messages. How to run ARSLOAD in a 'unified login' environment? Anyone have a solution to this?
Thank you for this forum!
Just guessing but I believe you'll need to move to a non-zero UID.
Hopefully you have a test environment where you can try this?
Ed
Thanks for your response. I just double checked and we did run the JOBTRAC (the userid the scheduling system runs under and submits work for ARSLOAD) and it was defined as a non-zero UID:
ARS1401I Unified login user id(123456794) user name(JOBTRAC)
Do you use 'stash' files to run your ARSLOAD?
Thanks!
Quote from: LynnG on October 20, 2015, 02:26:10 AM
Do you use 'stash' files to run your ARSLOAD?
(Sheepish look.)
Lynn - I'm one of your CMOD Level 2 reps, don't work in a "real" production shop.
However, yes, I do use the stash file for just about everything I do.
Ed
Ah-so! Thanks for your reply here. We've had to make some remediation to our CMOD RACF environment to cause OD to run NOTRUST,NOPASSWORD (aka, PROTECTED) to secure it based on STIG DISA PCI security standards. In doing so, we've created an anomaly in our JOBTRAC scheduling environment. A set of applications that run in our JOBTRAC scheduling environment submits these utility jobs for ARSLOAD from time to time and now they are failing.
--------------------------------------------------------------------------------------------
Scenario (A): job fails when JOBTRAC 'submits' the jcl with NO 'stash' file, no parameters (-u -p), and no //JOBCARD USER= PASSWORD= values. We get the following errors:
ARS1105E Userid or password is invalid
ARS1401I Unified login user id(123456794) user name(JOBTRAC)
ARS4318E Processing failed for file >/ars/tmp/915 (DD:INPUT-TEST.T
ARS1105E Userid or password is invalid
ARS1401I Unified login user id(123456794) user name(JOBTRAC)
--------------------------------------------------------------------------------------------
Scenario (B): job fails when JOBTRAC 'submits' the jcl with NO 'stash' file, no parameters (-u -p), and we DO include a //JOBCARD USER=ARSOCKDT (where ARSOCKDT is the CMOD server STC name on our zOS). We get these errors:
ICH408I USER(ARSOCKDT) GROUP(STCGROUP) NAME(ONDEMAND STC)
SUBMITTER(JOBTRAC )
LOGON/JOB INITIATION - SUBMITTER IS NOT AUTHORIZED BY USER
$HASP106 JOB DELETED BY JES2 OR CANCELLED BY OPERATOR BEFORE EXECUTION
We have NOT limited the JOBTRAC STC to a PROPCNTL Class in RACF, it (JOBTRAC) should be able to propagate authority to the submitted batch job with without USER= on the //JOBCARD (hence our puzzlement of Scenario (A) failure. Scenario (B) was a test to determine if SURROGAT Class may be required here (or not). I can't find any documentation on what ARSLOAD may require in a 'Unified Login Environment' within CMOD. Would you be able to test and determine in your lab?
Many thanks for your response!
Scenario (3): setup and use a 'stash' file. Would you have a sample of a working 'stash' file and the parameters to specify to the server task ARS.INI or ARS.CFG parameter files?
Many thanks!
Quote from: LynnG on October 20, 2015, 10:27:53 PM
Scenario (3): setup and use a 'stash' file. Would you have a sample of a working 'stash' file and the parameters to specify to the server task ARS.INI or ARS.CFG parameter files?
Lynn - I have to confess I don't. I'm always running things onesy-twosy so I just put the stash file right in the JCL.
Hopefully someone else will chime in.
Ed