TSS7143E: "INACTIVE TOO LONG" after applying CARS2509 maintenance

Products

• Top Secret

Issue/Introduction

After Top Secret CARS2509 maintenance was deployed, a problem occurred for a subset of users on the system.  

These users authenticate with Multi-Factor Authentication (MFA) or Passtickets and not the legacy "user/password" validation. These ACIDs have a password with a very old expiration date. After the maintenance, these users receive “TSS7143E Inactive Too Long” the next signon and are then PSUSPENDed for inactivity. What caused this change?

Cause

The issue is due to PTF LU17317. A change was made to perform the inactive user check when using a passticket.

Resolution

If modern authentication methods are primarily being used, it is recommended to update the INACTIVE control option to include LASTONLY.
Example: INACTIVE(##,LASTONLY)

Using LASTONLY, a user will be suspended as inactive based solely on the date last used and not the password expiration date.