MVS command not executed under the Solve region user ID

Products

• SOLVE:Operations Automation
• SOLVE:Access Session Management
• SOLVE:FTS
• SOLVE
• MAINFRAME CONNECTOR FOR LINUX ON MAINFRAME

Issue/Introduction

Some Solve:Operation Automation msgrules execute a REXX exec via the MODIFY AXR command (F AXR).

Sometimes the REXX is correctly executed under the user ID of the Solve region but sometimes it is executed without a user ID (bypass).

USERID() function in sysrexx returns either the user ID or * if no user.

The  N83205 message indicates I=+AAAAAA instead of I=BBBBBB (user ID of STC). 

N83205 S=ZCONS083 I=+AAAAAA A=ALLOW T=F AXR,.....
N83205 S=ZCONS090 I=BBBBBB A=ALLOW T= F AXR,.....    

Environment

Release : 11.9

Component : CA SOLVE:Operations Automation for z/OS

Cause

Solve region starts with SUB=MSTR before JES2 and Top Secret (which is started by Solve itself).

When a STC with SUB=MSTR is started before the External Security Manager (ESM), then the z/OS exit point, which will normally call ESM to get the correct STC userid from the program table, is not available.
z/OS will then assign a default user to that STC for the duration.

Resolution

There is no internal function of Solve that can affect this process.
So, there are two possible options:

1. Restart the Solve region when both JES2 and the ESM are up.
2. Start the ESM (with SUB=MSTR) before Solve (check if your ESM supports this)