IEE345I AUTHORITY INVALID, FAILED BY MVS when running console commands

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 for zVM
• ACF2 - z/OS
• ACF2 - MISC
• PanApt
• PanAudit

Issue/Introduction

With the operand LOGON(AUTO) in SYS1.PARMLIB(CONSOLxx) each console will automatically be logged on at IPL time with the userid which is the same as the console name.

The RACROUTE REQUEST=AUTH CLASS=OPERCMDS call for commands issued from these consoles will be against a userid of "+CONSOLE" and JOBNAME "CONSOLE" in the racroute header information, rather than the actual console logonid that was automatically logged on. The actual console userid is contained in the ACEE parameter of the call itself.

Environment

Release:
Component: ACF2MS

Resolution

Since the console userid is actually only specified in the ACEE parameter of the call itself for consoles automatically logged on with the SYS1.PARMLIB(CONSOLxx) LOGON=AUTO operand the ACF2 SECTRACE should be set as follows without the USERID parameter. The actual console userid that was logged on can be found if FORMAT=DUMP is specified in the SECTRACE command for jobname CONSOLE.

Example:

Issue this console command to turn on the SECTRACE

ST SET,ID=TEST,TYPE=SAFP,DEST=CONSOLE,FORMAT=DUMP,JOBNAME=CONSOLEnn 

Reply this following WTOR
CAS21A0I SPECIFY RACROUTE PARAMETERS, CANCEL, OR ENDR 

With
nn,request=auth,class=opercmds,endnn

Then
CAS2100I Continue SECTRACE specification, CANCEL, or ENDR

With
nn,end

After the SECTRACE is done, to delete and disable it, specify:

sectrace delete,id=test

The following sample SECTRACE output shows the actual console userid CONSOLEA in the ACEE:

The result of the SECTRACE will appear on the console. Here is an example of the output

SMFID= SYS1         TOD= 08:20:46.53    TRACEID= TEST       USERID= +CONSOLEJOBNAME= CONSOLE    ASID= 0009          PGM= IEECB92S       CURR RB= IEECB92SSFR/RFR= 0/0:0      MODE= TASK          APF= AUTHORIZED     LOCKS= NONESAFDEF= OPERCMD  GSO      MODE= GLOBAL  RACROUTE REQUEST=AUTH,REQSTOR='IEE3503D',SUBSYS='CONSOLE',         CLASS='OPERCMDS',RELEASE=1.9,STATUS=NONE,ACEE=,ATTR=READ,         DSTYPE=N,DECOUPL=YES,ENTITY=('MVS.DISPLAY.JOB'),FILESEQ=0,         GENERIC=ASIS,LOG=ASIS,LOGSTR='D A,L',MSGRTRN=YES,MSGSP=1,         MSGSUPP=YES,TAPELBL=STD,WORKA=ACEE     DATA AREA FOLLOWS00060550 +000  C1C3C5C5 FF0001D0 03000000 7F230830  *ACEE........"...*00060560 +010  00000000 08C3D6D5 E2D6D3C5 FC115C40  *.....CONSOLEA.* *00060570 +020  40404040 40400100 0009119F 00000000  *      ..........*