zowe zos-console command failed with authorization error
Article ID: 269681
Updated On:
Products
Issue/Introduction
Below error is encountered while issuing CLI command, same user can issue SETPROG command in TSO session without any error.
zowe zos-console issue command "SETPROG APF,ADD,DSN=iprfx.ZOWE.TEST.APF,SMS"
IEE345I SETPROG AUTHORITY INVALID, FAILED BY MVS
SYPG00CN 00000281 SETPROG APF,ADD,DSN=iprfx.ZOWE.TEST.APF,SMS
TSU32772 00000080 IEE345I SETPROG AUTHORITY INVALID, FAILED BY MVS
Environment
Release : 4.0
Cause
The IEE345I message specifically states that the console issuing the command does not have the authority to do so. When the command is issued from TSO, it is likely using a different console name that has the correct authorization.
Resolution
When user issue a console command from the CLI, it uses the console Rest API in zOSMF to execute the command. By default, zOSMF will create a console based on the username of the caller. The console name is made up of the first six characters of the userid, followed by CN. So if userid is ABCDEF, the console used will be named ABCDEFCN. Whenever user issue a command from the CLI, a TSO session will be spawned on the target system under the ID of the caller.
User can verify the console ID by issuing a console command from the CLI and then checking the JESMSGLG for the session:
11.12.29 TSU91716 $HASP373 ABCDEF STARTED
11.12.29 TSU91716 IEF125I ABCDEF - LOGGED ON - TIME=11.12.29
11.12.30 TSU91716 IEA630I OPERATOR ABCDEFCN NOW ACTIVE, SYSTEM=xxxx , LU=xxxxxxxx
11.12.30 TSU91716 D T
11.12.30 TSU91716 IEE136I LOCAL: TIME=11.12.30 DATE=2023.167 UTC: TIME=15.12.30 DATE=2023.167
11.12.30 TSU91716 D EMCS,F,CN= ABCDEFCN
11.12.30 TSU91716 D OMVS,O
Resolution:
Grant ZOSMF console that issue the SETPROG CLI command with UPDATE access to resource MVS.SETPROG.
Feedback
