ACF2CICS - Trans CESL does not recognize passphrase active.

Products

• ACF2 - z/OS
• ACF2 - MISC
• Advanced Authentication Mainframe
• ACF2

Issue/Introduction

Multiple CICS (TS 5.5) regions, all using same code (maintenance level) and shared libraries.
Using same common ACF2 database and all regions using the same ACF2CICS parameter library.
Using the default assemblies for the ACFAEUCC signon  module and have no customized changes.

However, unexpected behavior observed on two CICS regions.  All other CICS regions present expected behavior. 

Two CICS regions display unexplained behavior : 
 **  PASSWORD PHRASE AUTHENTICATION ENABLED . .NO 

while all other CICS regions display expected behavior : 
  ** PASSWORD PHRASE AUTHENTICATION ENABLED . .YES 

What can be causing this anomaly ?

Environment

Release :16.0

Component : ACF2CICS for Z/OS

Resolution

If AAM or MFA is implemented, this is a timing issue. Initialize AAM/MFA before starting the CICS regions or apply PTF LU05898.

For PWPHRASE or MFA signons, the CESL tran code must be used in order to support the input of passwords greater than 8 characters. During CICS initialization, ACF2 CICS will determine if either password phrases or MFA is in use, and set the LONGPW option to YES if MFA is active regardless of the GSO PWPHRASE setting. If password phrases are not active, and MFA not yet active, LONGPW will be set to NO.

PTF LU05898 overrides this behavior.

OPTION LONGPW=(YES|NO) has been added to force the setting.  

To use the option, add the OPTION LONGPW=(YES|NO) line to the ACF2PARM DD with the desired setting. This setting can then be changed later via the ACFM OM O transaction.

NOTE: OPTION LONGPW=YES must be active to perform an MFA logon.