IBM Support

Password Validation Messages in db2diag.log

Technote (FAQ)


How do I troubleshoot the password validation messages that are written to the db2diag.log ?


DB2 makes calls to the OS API in order to delegate authentication to the operating system. The only exception to this rule is when security plug-ins are used with DB2, in which case the security plug-ins perform authentication. Though most authentication errors are actually due to a problem at the operating system or within the security plug-in code, DB2 will usually throw a SQL30082N error with a particular return code. Examining the db2diag.log can provide more information to better troubleshoot the problem. Messages similar to the following could be found in the db2diag.log file:
2012-11-01- I1687539A439 LEVEL: Warning
PID : 14483466 TID : 21275 PROC : db2sysc 0
INSTANCE: Instance NODE : 000 DB : Database
APPHDL : 0-26072
EDUID : 21275 EDUNAME: db2agent (Database) 0
FUNCTION: DB2 UDB, bsu security, sqlexLogPluginMessage, probe:20
DATA #1 : String with size, 67 bytes
Password validation for user db2user1 failed with rc = -2146500316

The following table outlines other such return codes, corresponding SQL30082N return codes, explanation as to what they mean, and action plans to potentially resolve the problem. If the table doesn't help in resolving the problem, please follow the instructions at the bottom of this page to collect the necessary diagnostics prior to engaging IBM Support for faster resolution.

    Corresponding SQL30082N rc
    Password has expired
    1. Check that DB2 user ID
    naming conventions are

    2. Check that password rules are followed.

    3. Check that user ID is not

    4. Check that password has not expired. Reset if it has expired.
    The password is not valid for the specified user id
    Password missing
    15, 24, 26, 36
    Password length is greater than the supported password length
    User ID missing
    Bad User
    User ID is revoked
    User ID suspended
    Invalid User ID or password
    Security protocol violation
    Collect diagnostics mentioned below.
    15, 24
    Encryption types do not match
    For DB2 v9.5 FP4 and above, only the following encryption algorithms are supported:


    Note that these are the encryption algorithms used by the OS to encrypt user passwords. See following link for details.
    Authentication types do not match
    Ensure that both client and server authentication types are same.
    Unsupported function
    The security mechanism specified by the client is invalid for this server. Some typical examples:

    1. The client sent a new password value to a server that does not support the change password function.

    2. The client sent SERVER_ENCRYPT authentication information to a server that does not support password encryption.

    3. Authentication type catalog information must be the same at the server and the client.

    4. The client sent a user ID (but no password) to a server that does not support authentication by user ID only.

    5. The client has not specified an authentication type, and the server has not responded with a supported type. This might include the server returning multiple types from which the client is unable to choose.
    Mutual authentication failed
    Kerberos Authentication: The server being contacted failed to pass a mutual authentication check. The server is either an imposter, or the ticket sent back was damaged.
    A trusted connection was not established, so switch user request is invalid
    The client is configured to request a trusted connection and switch user in the trusted connection. A trusted connection must be established prior to switching user.
    Root capability required
    1. db2stop

    2. Login as ROOT

    3. From the instance home directory, run:
    db2iupdt -k <instance name>

    4. Retry connection

    *For non-root installation, need to run db2rfe
    See following link for details.
    The specified node or server is not available
    The server where authentication takes place is unavailable. For example, domain controller could not be reached, or a communication failure may have occurred in an LDAP or Kerberos environment.
    Unable to authenticate because of system error
    Collect diagnostics mentioned below.
    The security plugin has disallowed the connection
    If the problem takes place with the IBM provided LDAP or Kerberos plugins, set diaglevel to 4 by running the following command in your DB2 command prompt:

    db2 update dbm cfg using DIAGLEVEL 4

    Thereafter, also collect the requested diagnostics as per instructions below.

    If you are using a non-IBM security plug-in and the root cause is determined to be within this plug-in code, you must contact your plug-in vendor for support.

    Please see the DB2 v9.7 Information Center for general information on security plug-ins.
    The server security plugin encountered an unexpected error
    The server security plugin encountered an invalid server credential
    The server security plugin encountered an expired server credential
    The server security plugin encountered an invalid security token sent by the client
    The client security plugin is missing a required API
    The client security plugin is of the wrong plugin type
    The client security plugin does not have a matching GSS-API security plugin available for connection to the database
    The client security plugin cannot be loaded
    The client security plugin name is invalid
    The client security plugin reports an API version that is incompatible with DB2
    The client security plugin encountered an unexpected error
    The server security plugin encountered an invalid principal name
    The client security plugin encountered an invalid client credential
    The client security plugin encountered an expired client credential
    The client security plugin encountered an invalid security token sent by the server

Prior to contacting IBM Support, please ensure that you've collected the following diagnostics:

1. DB2 Support

In your DB2 command prompt, execute the following command:

db2support . -s

A file will be dumped.

2. DB2 Trace

In your DB2 command prompt, execute the following commands at the database server to capture the problem:

db2trc on -t -f trace.dmp
<reproduce the problem from command line to hit SQL30082N>
db2trc off
db2trc fmt trace.dmp trace.fmt
db2trc flw -t trace.dmp trace.flw
db2trc fmt -c trace.dmp trace.fmtc

Please place the .flw, .fmt, and .fmtc files into a folder and zip it.

3. File Upload Instructions

Document information

More support for: DB2 for Linux, UNIX and Windows
DB2 Tools - db2diag.log

Software version: 9.5, 9.7, 9.8, 10.1

Operating system(s): AIX, HP-UX, Linux, Solaris, Windows

Reference #: 1623221

Modified date: 18 November 2015

Translate this page: