Question & Answer
Question
I am starting a new z/OS Connect Enterprise Edition (zCEE) V3 server and during startup we get messages:
BPXP015I HFS PROGRAM <path>/libzosconnect.so IS NOT MARKED PROGRAM CONTROLLED. BPXP014I ENVIRONMENT MUST BE CONTROLLED FOR DAEMON (BPX.DAEMON) PROCESSING.
I determined on my own that we were missing a RACF permit for resource profile BBG.SERVER.BBGZSAFM. Once we permitted the userid for our zCEE server to that profile with READ access our server initialized successfully.
Why was no ICH408I RACF message for BBGZSAFM issued for this security error during z/OS Connect EE server startup?
Answer
I discussed this with the WebSphere Liberty team and this occurs very early during Liberty startup and it is not yet known if SAF services are required so the RACROUTE is issued without logging.
The message.log for the server should also have issued a CWWKB0115I message which clearly states that the zCEE server userid does not have permission to BBOGSAFM:
CWWKB0115I: This server is not authorized to load module bbgzsafm. No authorized services will be loaded.
Explanation: The user ID which that started this server does not have access to the BBG.AUTHMOD.BBGZSAFM profile of the SAF server class. Read access to this profile is required to connect to the angel process and load authorized services.
Action: If no authorized services are required by this server, then no action is required. If the server requires authorized services, give the user ID that starts the server read access to the BBG.AUTHMOD.BBGZSAFM profile of the SAF server class.
This message is considered to keep the user informed even in lieu of the ICH408I message.
Also see APAR PI56385: Message CWWKB0101I does not provide enough information to diagnose problems connecting to an Angel process.
Bill Bulfin
IBM zCEE L2 Support
Product Synonym
zCEE
Was this topic helpful?
Document Information
Modified date:
14 February 2023
UID
dwa1428252