OA50707: NEW FUNCTION - COEXISTENCE SUPPORT FOR HCR77C0

Obtain the fix for this APAR.

APAR status

• Closed as new function.

Error description

• New Function
  Coexistence support for HCR77C0.
  
  If key lifecycle auditing (introduced in HCR77C0) is enabled
  for KDSR formatted KDSs that are being shared where
  HCR77B1 or earlier is also running, if a KDS record
  contains a key fingerprint and its token is updated on a
  system running HCR77B1 or earlier, the key fingerprint
  will be removed from the record.
  
  The DISPLAY ICSF command, when issued with SYSPLEX=YES from
  a system running HCR77B1, will display the actual FMID of
  later systems in the sysplex.
  ZOS0205C/K
  ZOS0204C/K
  ICSF7C0C/K
  ZOS0203C/K
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: Users on a system running ICSF HCR77B1       *
  *                 or earlier along with HCR77C0 where          *
  *                 key lifecycle auditing option:               *
  *                   AUDITKEYLIFECKDS(LABEL(YES)) or            *
  *                   AUDITKEYLIFEPKDS(LABEL(YES))               *
  *                 (both introduced in HCR77C0) is enabled      *
  *                 and KDSR formatted KDSs are being            *
  *                 shared.                                      *
  *                                                              *
  *                 Users on a system running ICSF HCR77B1       *
  *                 issuing a DISPLAY ICSF command with          *
  *                 SYSPLEX=YES when there are other systems     *
  *                 in the sysplex running ICSF HCR77C0.         *
  ****************************************************************
  * PROBLEM DESCRIPTION: Without this APAR applied:              *
  *                       - When running with HCR77C0 with       *
  *                         key lifecycle auditing enabled,      *
  *                         an update of a token (CKDS           *
  *                         or PKDS) on a system running         *
  *                         HCR77B1 or earlier may cause the     *
  *                         key value and its key fingerprint    *
  *                         to be inconsistent. New SMF Type 82  *
  *                         subtypes 40, 41, 44, and 45 records  *
  *                         created on HCR77C0 may also contain  *
  *                         an inconsistent key fingerprint      *
  *                         value for those tokens.              *
  *                                                              *
  *                       - When issued from HCR77B1 in a        *
  *                         sysplex where HCR77C0 is running,    *
  *                         the output from a DISPLAY ICSF       *
  *                         command with SYSPLEX=YES will        *
  *                         display the FMID as 'UNKNOWN' for    *
  *                         the systems running HCR77C0.         *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Problem Summary
  ---------------------------------------------------------------
  An update of the token in a KDSR formatted CKDS or PKDS shared
  between systems running HCR77B1 or earlier and HCR77C0, where
  key lifecycle auditing is enabled, may cause the key value and
  its key fingerprint to be inconsistent.
  New SMF Type 82 subtypes 40, 41, 44 and 45 created on HCR77C0
  for these tokens may also contain an inconsistent key
  fingerprint value.
  
  The DISPLAY ICSF command issued from HCR77B1 displays
  'UNKNOWN' for the FMID of HCR77C0 remote systems
  on a DISPLAY ICSF command with SYSPLEX=YES.
  

Problem conclusion

Temporary fix

Comments

• If a CKDS or PKDS record contains a key fingerprint and its
  token is updated on a system running HCR77B1
  or earlier, the key fingerprint will be removed from the record.
  
  The DISPLAY ICSF command issued with SYSPLEX=YES from a system
  running HCR77B1, will display the actual FMID of later
  systems in the sysplex.
  
  At HCR77A1, the ICSF System Programmer's Guide SC14-7507-00
  in Chapter 3 Migration in section System Abend Codes the
  following '18F'x abend reason code has been added as part of
  this APAR for enhanced error handling:
  
  Code
  Hex (Dec)  Meaning
  ---------------------------------------------------
  478 (1144) Damaged variable metadata detected.
  
  At HCR77A1, the ICSF Messages SC14-7509-00 in
  Chapter 8. CSFMnnnn Messages (ICSF Address Space)
  the following message has been added as part of this
  APAR for enhanced error handling:
  
  CSFM645I INCORRECT METADATA DETECTED IN kds-type RECORD label.
  Explanation: A kds-type KDS record in storage was detected as
  having damage in the KDSR metadata area.
  
  kds-type is one of CKDS, PKDS, or TKDS.
  label is the label name (for CKDS or PKDS) or handle (for TKDS).
  
  System action: ICSF will ABEND the unit of work.
  Operator response: None.
  System programmer response: Notify the ICSF administrator.
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UA83036 UA83037 UA83038

Modules/Macros

•    CSFKG400 CSFKSIPD CSFMIDS  CSFMIMGM CSFVCKRW
  CSFVCKW2
  

Fix information

• Fixed component name

  ICSF/MVS

• Fixed component ID

  568505101

Applicable component levels

• R7A1 PSY UA83036

     UP16/10/14 P F610

• R7B0 PSY UA83037

     UP16/10/14 P F610

• R7B1 PSY UA83038

     UP16/10/14 P F610

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.