PI14291: z/OSMF V2R1 generates spurious ICH408I messages on user login

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• When users log into z/OS Management Facility V2R1 the system may
  generate security audit messages such as ICH408I from RACF or
  equivalent message from 3rd party security products.
  
  The messages will describe that a certain user has insufficient
  authority to access one or more of the ZOSMF resources in class
  ZMFAPLA.
  
  These messages do not affect the operation of the z/OS
  Management Facility. All functions should operate normally.
  These represent interrogations for access and should not be
  audit-logged as access attempts.
   EXTERNAL SYMPTOMS:
   Messages include:
  
   ICH408I USER(xxxx) GROUP(yyyy) NAME(####################)
     IZUDFLT.ZOSMF.ADMINTASKS.LINKSTASK CL(ZMFAPLA )
     INSUFFICIENT ACCESS AUTHORITY
     FROM IZUDFLT.ZOSMF.ADMINTASKS.** (G)
     ACCESS INTENT(READ   )  ACCESS ALLOWED(NONE   )
  
   Depending on the logging and audit configuration of the
   system's security product, successful checks may also generate
   messages when users login.
   ANALYSIS:
   The z/OSMF Logon routines attempt to verify the user's access
   to different z/OSMF features by probing the system's SAF
   security product. The results of these probes are used to
   generate the z/OSMF Navigation Tree for that user. The requests
   are being sent to the security product with a LOG value of ASIS
   leading to messages when a given system is configured to
   audit/log access attempts.
  
   Note that actual attempts to access and use the various
   protected z/OSMF resources undergo another actual security
   check, so these first probes are not actually for access
   control.
   KNOWN IMPACT:
   No impact to z/OS Management Facility Fuction.
  
   The messages are spurious and can be ignored.
   ADDITIONAL SYMPTOMS:
   MSGTSS7250E
  

Local fix

• BYPASS/CIRCUMVENTION:
   The messages can be ignored.
   Alternately, in RACF, logging can be disabled for the ZMFAPLA
   class to suppress the messages. (Access attempts occur with
   LOG=ASIS, meaning that system configuration determines whether
   messages are generated.)
  
   NOTE: Suppressing messages via the security product may also
   hide actual access failures/attempts. Consult your security
   product documentation for more details.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of IBM z/OS Management             *
  *                 Facility Version 2 Release 1.                *
  ****************************************************************
  * PROBLEM DESCRIPTION: z/OSMF generates spurious ICH408I       *
  *                      messages on user login.                 *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When users log into z/OSMF, the RACF profile will be checked
  to get authorized tasks list and generate the navigation tree.
  If the user has no authority for a special task, the ICH408I
  message will show on the system console, which indicates the
  user has insufficient authority to access the ZOSMF resources:
  
  ICH408I USER(NEILSX) GROUP(DEPTD60) NAME(####################)
   IZUDFLT.ZOSMF.ADMINTASKS.APPLINKING CL(ZMFAPLA)
   INSUFFICIENT ACCESS AUTHORITY
   FROM IZUDFLT.ZOSMF.ADMINTASKS.** (G)
   ACCESS INTENT(READ)  ACCESS ALLOWED(NONE)
  
  This is a normal application procedure so the ICH408I messages
  are not expected.
  

Problem conclusion

• The Websphere Liberty component provides a new security
  interface with an LOG parameter to its exploiters. The new LOG
  parameter is specified if the access is recorded in the SMF data
  set. The exploiters can use this new interface to ignore ICH408I
  messages based on their logic.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PI07001

• APAR is sysrouted TO one or more of the following:

  PI14841 UI18093

Modules/Macros

• IZUGNBAF
  

Fix information

• Fixed component name

  WAS LIBERTY PRO

• Fixed component ID

  5655S28WL

Applicable component levels

• R210 PSY UI18093

     UP14/05/25 P F405

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.