Error TSS6029E or DFHUS0050 during CICS STC Startup with SURROGAT Violation

Products

• Top Secret for z/OS

Issue/Introduction

When starting a CICS Started Task (STC), the initialization fails with security violation errors related to the SURROGAT class.

This occurs when the region ACID does not have the necessary permissions to use a surrogate ACID (eg: CICSUSER).

Users may observe the following error messages in the job log or TSSUTIL report:

• TSS6029E - TSS/CICS SECURITY INITIALIZATION FAILURE

• DFHUS0050 regionacid THE DEFAULT USERID defaultacid CANNOT BE USED BY THIS CICS JOB

• TSSUTIL Violation: RESOURCE TYPE & NAME : SURROGAT [acid].DFHINSTL with FAIL 01 (READ violation).

Environment

Top Secret for z/OS

CICS Transaction Server

Cause

The SURROGAT resource (e.g., acid.DFHINSTL) is either not owned by a department or the CICS region ACID has not been granted READ access to it.

This is required on regions where XUSER=YES is specified.

Resolution

To resolve the violation, ensure the SURROGAT resource is owned and permitted to the region ACID.

1. Add the SURROGAT resource to a department if it is not already owned:

TSS ADD(owning_dept) SURROGAT(####.DFHINSTL)

(Note: Replace #### with the ACID reported in the violation snippet, such as CICSUSER).

2. Permit the CICS region ACID to the SURROGAT resource with READ access:

TSS PER(region_acid) SURROGAT(####.DFHINSTL) ACCESS(READ)