TAMz Elevation Fails with 401 Unauthorized (TAM0012E) After z/OS Upgrade to v3.1 or Migration to Java 21

Products

• Trusted Access Manager for Z

Issue/Introduction

After upgrading to z/OS v3.1 or migrating to a Java 21 environment, users are unable to perform role elevations. The TAMJVM logs display the following errors:

ERROR c.c.s.s.r.ServiceDeskRestClient ServiceDeskRestClient.java:206- Request returned a failure code: 401
ERROR c.c.s.s.r.ServiceDeskRestClient ServiceDeskRestClient.java:208- Error details: {"Error":{"ErrorCode":139,"ErrorMessage":"Request unauthorized","HTTPResponseCode":"UNAUTHORIZED","HTTPResponseCodeValue":401}
ERROR c.c.s.s.akka.actors.ServiceDeskActor ServiceDeskActor.java:171- TAM0012E: Could not successfully call Service Desk server. REST request failed

Environment

Trusted Access Manager for Z 1.1.0

Java 21

Cause

The issue is caused by a change in default URL parsing behavior introduced in Java 21.

1. URL Parsing: Java 21 aggressively encodes special characters in URLs (such as the # character often found in keyring names) into their hex equivalents (e.g., %23) before the connection is established. This results in a credential or ticket mismatch, triggering the 401 Unauthorized error during REST calls between SJVSTC and TAMSTC.
   
   
2. Encoding: Setting file.encoding=COMPAT in the environment variables prevents proper rendering of characters within the TAMz UI.

Resolution

To resolve this issue, the environment configuration must be updated to restore pre-Java 21 URL parsing behavior and maintain UTF8 encoding.

Step 1: Update TAMENV

In your TAMENV data set member, ensure the file encoding is set to UTF8 and add the JDK delay parsing parameter:

1. Ensure the encoding line reads: IJO="$IJO -Dfile.encoding=UTF8 -Xms512m -Xmx1024m"
2. Add the following line to bypass Java 21 URL encoding: IJO="$IJO -Djdk.net.url.delayParsing=true"

Step 2: Update SJVENV

The JDK parameter must be applied symmetrically to the client side. In your SJVENV member, add: IJO="$IJO -Djdk.net.url.delayParsing=true"

Step 3: Restart Services

Restart the following started tasks on all affected LPARs to apply the changes:

• SJVSTC
• TAMSTC

Additional Information

Migrate to Java 21