AAI Connection to CA7 Fails with Security Violation Errors CAS9034E and CAL2C950E

Products

• Automation Analytics & Intelligence

Issue/Introduction

After adding a new CA7 instance and starting the Started Task (STC), the connection fails. The standard error logs (STDEER) indicate a terminal session failure with security-related errors.

AI7.CV05S: CCITERM signon verification failed - Check CCITERM output 12026.145/14:41 
JOB: XXXX( ) CA-7 CCI BATCH INTERFACE NODE: CA-7:  PAGE 1

 

Environment

 

Automation Analytics Intelligence (AAI) v24.x

AAI CA7 Integration

 

Cause

The AAI started task  successfully passed the logon command to CA-7, but the mainframe's External Security Manager (such as RACF, ACF2, or Top Secret) explicitly blocked the access.

The breakdown of the log errors confirms this security blockage:

• AI7.CV05S: CCITERM signon verification failed: The verification utility failed because the incoming logon request was rejected.

• CAL2C950E BATCH SUBMIT SECURITY VIOLATION: CA-7 rejected the incoming terminal session due to a security policy block.

• CAS9034E - FUNCTION(RESCHECK) ACCESS TO RESOURCE HAS BEEN DENIED: A critical CA-Common Services message indicating the security package denied the job access to a protected mainframe resource.

• JOB=,ID=XXXX * SECURITY VIOLATION *: The security system explicitly flagged user ID XXXX (the context running the AAI started task) as unauthorized.

Resolution

Troubleshooting Steps

Action Items for the Security Team

1. Review Security Logs: Check the mainframe security system logs (e.g., RACF spool, ACF2 violations, or Top Secret alerts) for User ID / Job XXXX around the timestamp of the failure (14:41:14). This will pinpoint the exact resource profile or class name that triggered the denial.

2. Permit Resource Access: Ensure the user ID XXXX is authorized to use the CA-7 CCI batch terminal interface. This typically requires granting READ access to the specific profile inside the resource class governing CA-7 or CA-CCI (frequently the FACILITY class or a specialized CA-7 security class).

3. Verify Surrogate/User Configuration: Verify that user ID =XXXXX has the authority to log on or act as a surrogate for the defined CA7USER=XXXXX specified in your SRVRSCFG configuration file, per your corporate security policies.