CHECK(IBMJES,JES_NJE_SECURITY) failing after last TSS maintenance

Products

• Top Secret
• Top Secret - LDAP
• WEB ADMINISTRATOR FOR TOP SECRET

Issue/Introduction

z/OS Health check JES_NJE_SECURITY is failing after applying some Top Secret maintenance:

CHECK(IBMJES,JES_NJE_SECURITY)                               
SYSPLEX:    PRDPLX1   SYSTEM: TST1                           
START TIME: 09/24/2020 14:08:54.194347                       
CHECK DATE: 20170201  CHECK SEVERITY: LOW-DYNAMIC            
CHECK PARM: NJEEXEC(TTSSNJE)                                 
                                                             
                           Trusted Nodes List                
Node Name  Reason                                            
---------  --------------------------------------------------
zzAV1      Node zzAV1 is trusted                             
xwyzSML1   Node xwyzSML1 is trusted                          
wxyzSMU1   Node wxyzSMU1 is trusted                          
.
.
  Check Reason:  Verify primary JES NJE security settings    
                                                             
END TIME: 09/24/2020 14:09:24.982231  STATUS: EXCEPTION-HIGH 


and this is what I do have after IPL TST1 with z/OS and TSS maintenance:

CHECK(IBMJES,JES_NJE_SECURITY)                                          
SYSPLEX:    PRDPLX1   SYSTEM: TST1                                      
START TIME: 09/24/2020 14:25:29.792869                                  
CHECK DATE: 20170201  CHECK SEVERITY: LOW-DYNAMIC                       
CHECK PARM: NJEEXEC(TTSSNJE)                                            
                                                                        
                                                                        
IAZH403I Error encountered trying to determine the list of trusted      
nodes, TTSSNJE RC=8                                                     
                                                                        
IAZH104I Error messages issued by TTSSNJE                               
                                                                        
IAZH105I Caller lacks IRRSEQ00 R_admin authority                        
                                                                        
               --- Information for Non-Trusted Nodes ---                
Node      Issue                                                Message  
--------  ---------------------------------------------------  -------- 
wxyz      NODE has no PASSWORD and specified SIGNON=COMPAT     IAZH121E 
.
.
HZS1002E CHECK(IBMJES,JES_NJE_SECURITY):                       
AN ERROR OCCURRED, DIAG: 00000400_00000403                     
                                                               
END TIME: 09/24/2020 14:25:30.055548  STATUS: UNEXP ERROR      



The following fixes were applied:

RO85669
SO03829
SO08772
SO09836
SO10618
SO10757
SO11656
SO11889
SO11937
SO11984
SO12039
SO12162
SO12319
SO12332
SO12408
SO12413
SO12436
SO12531
SO12533
SO12752
SO12830
SO12923
SO12931
SO12940
SO12947
SO12965
SO12989
SO13060
SO13099
SO13110
SO13290
SO13311
SO13382
SO13389
SO13405
SO13469
SO13510
SO13533
SO13542
SO13600
SO14000
SO14340
SO14341

Environment

Release : 16.0

Component : CA Top Secret for z/OS

Resolution

SO10757  introduces a RACROUTE r_admin call that requires the Health Checker HZSPROC Started Task acid to be an a TYPE(SCA) admin acid and not a regular TYPE(USER) acid.

To change from a TYPE(USER) to TYPE(SCA) us the following TSS MOVE command.

TSS MOVE(HZSPROC_started_task_acid) TYPE(SCA)