TSS7251E CSFSERV(CSFDSG) security violation for CA LDAP started task acid

Products

• LDAP SERVER FOR Z/OS
• Top Secret - LDAP

Issue/Introduction

CA LDAP started task acid receives a:

TSS7251E Access Denied to CSFSERV <CSFDSG>

Resolution

Per IBM documentation, CSFSERV(CSFDSG) authority is required for:
1. RSA Digital Signature Generation
2. ECC Digital Signature Generation

Since CA LDAP uses these services, the following PERMIT is needed:

TSS PER(caldap_started_task_acid)  CSFSERV(CSFDSG) ACCESS(ALL)