BCPII INSUFFICIENT SAF RESOURCE ACCESS AUTHORITY

Products

• Top Secret
• Top Secret - LDAP

Issue/Introduction

When trying to implement BCPII the following error occurs:

IXC104I SYSTEM STATUS DETECTION PARTITIONING PROTOCOL ELIGIBILITY:
SYSTEM CAN TARGET OTHER SYSTEMS.
SYSTEM IS NOT ELIGIBLE TO BE TARGETED BY OTHER SYSTEMS.
REASON: INSUFFICIENT SAF RESOURCE ACCESS AUTHORITY

Environment

Release: TOPSEC00200-15-Top Secret-Security
Component:

Resolution

PERMIT the ALL record the following:

TSS PER(ALL) IBMFAC(HWI.TARGET.netid.) APPLDATA(community-name) ACC(READ) 

The PERMIT must be on the ALL record because BCPII issues the FASTAUTH call in 'Cross Memory' Mode. The APPLDATA on the permit must match the community name in the product.

Because its in cross memory mode, TSS doesn't build an ACEE, so there is no acid associate for the call and failing it causing BCPII not to initialize.

Permitting it to the ALL record allows the security check to pass and BPCII to successfully initialize. There shouldn't be any security risk permitting this resource to the ALL record because of hierarchical security checking in BCPII.