DB2 for z/OS V8 - -922 auth failure (was package name)

Jim McAlpine

DB2 for z/OS V8 - -922 auth failure (was package name)
OK, continuing on from my earlier post, I've now got the CICS system set up
and working but I'm getting a -922 when trying to invoke the initial IMS
transaction. The CICS programs are bound with a version of VFG1. The IMS
programs are bound with a version of VFG2 like so -

18:15:01 FAAA bind
DSNT254I + DSNTBCM2 BIND OPTIONS FOR
PACKAGE = REMOTE_DB2B.CH30D.FAAA.(VFG2)
ACTION ADD
OWNER H30D
QUALIFIER H30D
VALIDATE BIND
EXPLAIN NO
ISOLATION CS
RELEASE COMMIT
COPY
DSNT255I + DSNTBCM2 BIND OPTIONS FOR
PACKAGE = REMOTE_DB2B.CH30D.FAAA.(VFG2)
SQLERROR NOPACKAGE
CURRENTDATA NO
DEGREE 1
DYNAMICRULES RUN
DEFER
NOREOPT VARS
KEEPDYNAMIC NO
IMMEDWRITE NO
DBPROTOCOL DRDA
OPTHINT
ENCODING EBCDIC(00285)
PATH
DSNT232I + SUCCESSFUL BIND FOR
PACKAGE = REMOTE_DB2B.CH30D.FAAA.(VFG2)


The plan used for both CICS and IMS is called H30DOLAS and is bound like so
-

BIND PLAN(H30DOLAS) PKLIST(CH30D.*) OWNER(H30D) ISOLATION(CS) ACQUIRE(USE)
ACTION(REP) RETAIN CACHESIZE(8) FLAG(I) VALIDATE(BIND)
DSNT252I + DSNTBCM1 BIND OPTIONS FOR PLAN H30DOLAS
ACTION REPLACE RETAIN
OWNER H30D
VALIDATE BIND
ISOLATION CS
ACQUIRE USE
RELEASE COMMIT
EXPLAIN NO
DYNAMICRULES RUN
DSNT253I + DSNTBCM1 BIND OPTIONS FOR PLAN H30DOLAS
NODEFER PREPARE
CACHESIZE 0256
QUALIFIER H30D
CURRENTSERVER
CURRENTDATA YES
DEGREE 1
SQLRULES DB2
DISCONNECT EXPLICIT
NOREOPT VARS
KEEPDYNAMIC NO
IMMEDWRITE NO
DBPROTOCOL DRDA
OPTHINT
ENCODING EBCDIC(00285)
PATH
DSNT200I + BIND FOR PLAN H30DOLAS SUCCESSFUL

and the IMS RTT has entries for the programs like so -

DSNMAPN APN=PAAAQ,PLAN=H30DOLAS

The IMS MPR region runs under the same userid as the CICS region so I don't
think it's a user authorization error but I can't see how it is a plan
access error either from the evidence above.

Any pointers would be much appreciated.

Jim McAlpine

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Roy Boxwell

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Jim McAlpine)
could you please post which of the five error types and with which
reason-code is being produced??

-922 AUTHORIZATION FAILURE: error-type ERROR. REASON reason-code

Explanation: Authorization failed because of the error indicated by
error-type

error-type
Types of authorization failure
v User authorization
v Plan access
v Duplicate exit requested
v Installation error
v Connect


Ta!


Roy Boxwell
SOFTWARE ENGINEERING GMBH
-Product Development-
Robert-Stolz-Straße 5
40470 Düsseldorf/Germany
Tel. +49 (0)211 96149-675
Fax +49 (0)211 96149-32
Email: [login to unmask email]
http://www.seg.de

Software Engineering GmbH
Amtsgericht Düsseldorf, HRB 37894
Geschäftsführung: Gerhard Schubert



Jim McAlpine <[login to unmask email]>
Gesendet von: IDUG DB2-L <[login to unmask email]>
20.01.2011 15:26
Bitte antworten an
IDUG DB2-L <[login to unmask email]>


An
[login to unmask email]
Kopie

Thema
[DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)






OK, continuing on from my earlier post, I've now got the CICS system set
up and working but I'm getting a -922 when trying to invoke the initial
IMS transaction. The CICS programs are bound with a version of VFG1. The
IMS programs are bound with a version of VFG2 like so -

18:15:01 FAAA bind
DSNT254I + DSNTBCM2 BIND OPTIONS FOR
PACKAGE = REMOTE_DB2B.CH30D.FAAA.(VFG2)
ACTION ADD
OWNER H30D
QUALIFIER H30D
VALIDATE BIND
EXPLAIN NO
ISOLATION CS
RELEASE COMMIT
COPY
DSNT255I + DSNTBCM2 BIND OPTIONS FOR
PACKAGE = REMOTE_DB2B.CH30D.FAAA.(VFG2)
SQLERROR NOPACKAGE
CURRENTDATA NO
DEGREE 1
DYNAMICRULES RUN
DEFER
NOREOPT VARS
KEEPDYNAMIC NO
IMMEDWRITE NO
DBPROTOCOL DRDA
OPTHINT
ENCODING EBCDIC(00285)
PATH
DSNT232I + SUCCESSFUL BIND FOR
PACKAGE = REMOTE_DB2B.CH30D.FAAA.(VFG2)


The plan used for both CICS and IMS is called H30DOLAS and is bound like
so -

BIND PLAN(H30DOLAS) PKLIST(CH30D.*) OWNER(H30D) ISOLATION(CS) ACQUIRE(USE)
ACTION(REP) RETAIN CACHESIZE(8) FLAG(I) VALIDATE(BIND)
DSNT252I + DSNTBCM1 BIND OPTIONS FOR PLAN H30DOLAS
ACTION REPLACE RETAIN
OWNER H30D
VALIDATE BIND
ISOLATION CS
ACQUIRE USE
RELEASE COMMIT
EXPLAIN NO
DYNAMICRULES RUN
DSNT253I + DSNTBCM1 BIND OPTIONS FOR PLAN H30DOLAS
NODEFER PREPARE
CACHESIZE 0256
QUALIFIER H30D
CURRENTSERVER
CURRENTDATA YES
DEGREE 1
SQLRULES DB2
DISCONNECT EXPLICIT
NOREOPT VARS
KEEPDYNAMIC NO
IMMEDWRITE NO
DBPROTOCOL DRDA
OPTHINT
ENCODING EBCDIC(00285)
PATH
DSNT200I + BIND FOR PLAN H30DOLAS SUCCESSFUL

and the IMS RTT has entries for the programs like so -

DSNMAPN APN=PAAAQ,PLAN=H30DOLAS

The IMS MPR region runs under the same userid as the CICS region so I
don't think it's a user authorization error but I can't see how it is a
plan access error either from the evidence above.

Any pointers would be much appreciated.

Jim McAlpine



The IDUG DB2-L Listserv is only part of your membership in IDUG. If you
are not already an IDUG member, please register here.

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Jim McAlpine

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Roy Boxwell)
On Thu, Jan 20, 2011 at 2:44 PM, Roy Boxwell <[login to unmask email]> wrote:

>
> could you please post which of the five error types and with which
> reason-code is being produced??
>
> -922 AUTHORIZATION FAILURE: error-type ERROR. REASON reason-code
>
> Explanation: Authorization failed because of the error indicated by
> error-type
>
> error-type
> Types of authorization failure
> v User authorization
> v Plan access
> v Duplicate exit requested
> v Installation error
> v Connect
>
>
> Ta!
>
> *
> Roy Boxwell*
> SOFTWARE ENGINEERING GMBH
> -Product Development-*
> Robert-Stolz-Straße 5
> 40470 Düsseldorf/Germany
> Tel. +49 (0)211 96149-675
> Fax +49 (0)211 96149-32
> Email: [login to unmask email]
> http://www.seg.de
>
> Software Engineering GmbH
> Amtsgericht Düsseldorf, HRB 37894
> Geschäftsführung: Gerhard Schubert*
>
> I'm getting -

DSNT408I SQLCODE = -922, ERROR: AUTHORIZATION FAILURE: PLAN ACCESS
ERROR. REASON 00F30034
DSNT418I SQLSTATE = 42505 SQLSTATE RETURN CODE
DSNT415I SQLERRP = DSNAET03 SQL PROCEDURE DETECTING ERROR
reason code is -

*00F30034*


*Explanation:*

The authorization ID associated with this connection is not authorized to
use the specified plan name or the specified plan name does not exist.

*System* *Action:*

The request to allocate a plan to the authorization ID is denied.

*User* *Response:*

Verify that the correct plan name was specified. If this plan exists, then
request execution authority to the plan from either the owner of the plan or
from another person given authority to grant execution authority to the
plan.

Jim McAlpine

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Roy Boxwell

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Jim McAlpine)
well, I hate to say it, but it looks like GRANT EXECUTE ON PLAN xxxx TO
yyyy is missing...

Roy Boxwell
SOFTWARE ENGINEERING GMBH
-Product Development-
Robert-Stolz-Straße 5
40470 Düsseldorf/Germany
Tel. +49 (0)211 96149-675
Fax +49 (0)211 96149-32
Email: [login to unmask email]
http://www.seg.de

Software Engineering GmbH
Amtsgericht Düsseldorf, HRB 37894
Geschäftsführung: Gerhard Schubert



Jim McAlpine <[login to unmask email]>
Gesendet von: IDUG DB2-L <[login to unmask email]>
20.01.2011 16:07
Bitte antworten an
IDUG DB2-L <[login to unmask email]>


An
[login to unmask email]
Kopie

Thema
Re: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)






On Thu, Jan 20, 2011 at 2:44 PM, Roy Boxwell <[login to unmask email]> wrote:

could you please post which of the five error types and with which
reason-code is being produced??

-922 AUTHORIZATION FAILURE: error-type ERROR. REASON reason-code

Explanation: Authorization failed because of the error indicated by
error-type

error-type
Types of authorization failure
v User authorization
v Plan access
v Duplicate exit requested
v Installation error
v Connect


Ta!


Roy Boxwell
SOFTWARE ENGINEERING GMBH
-Product Development-
Robert-Stolz-Straße 5
40470 Düsseldorf/Germany
Tel. +49 (0)211 96149-675
Fax +49 (0)211 96149-32
Email: [login to unmask email]
http://www.seg.de

Software Engineering GmbH
Amtsgericht Düsseldorf, HRB 37894
Geschäftsführung: Gerhard Schubert

I'm getting -

DSNT408I SQLCODE = -922, ERROR: AUTHORIZATION FAILURE: PLAN ACCESS
ERROR. REASON 00F30034
DSNT418I SQLSTATE = 42505 SQLSTATE RETURN CODE
DSNT415I SQLERRP = DSNAET03 SQL PROCEDURE DETECTING ERROR
reason code is -

00F30034

Explanation:
The authorization ID associated with this connection is not authorized to
use the specified plan name or the specified plan name does not exist.
System Action:
The request to allocate a plan to the authorization ID is denied.
User Response:
Verify that the correct plan name was specified. If this plan exists, then
request execution authority to the plan from either the owner of the plan
or from another person given authority to grant execution authority to the
plan.
Jim McAlpine




The IDUG DB2-L Listserv is only part of your membership in IDUG. If you
are not already an IDUG member, please register here.

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Raymond Bell

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Roy Boxwell)
...or the plan doesn't actually exist.

Sorry, but didn't see if you said you'd bound the plan used.

Cheers,


Raymond
________________________________________
Raymond Bell
Senior Software Consultant
BMC Software

Phone: +44 (0) 1784 478 558
Mobile: +44 (0) 7894 608 214
Fax: +44 (0) 1784 478 753

Assurance House
Vicarage Road, Egham
Surrey TW20 9JY, United Kingdom

From: Roy Boxwell [mailto:[login to unmask email]
Sent: Thursday, January 20, 2011 09:16 AM
To: [login to unmask email] <[login to unmask email]>
Subject: Re: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)


well, I hate to say it, but it looks like GRANT EXECUTE ON PLAN xxxx TO yyyy is missing...

Roy Boxwell
SOFTWARE ENGINEERING GMBH
-Product Development-
Robert-Stolz-Straße 5
40470 Düsseldorf/Germany
Tel. +49 (0)211 96149-675
Fax +49 (0)211 96149-32
Email: [login to unmask email]
http://www.seg.de

Software Engineering GmbH
Amtsgericht Düsseldorf, HRB 37894
Geschäftsführung: Gerhard Schubert


Jim McAlpine <[login to unmask email]>
Gesendet von: IDUG DB2-L <[login to unmask email]>

20.01.2011 16:07
Bitte antworten an
IDUG DB2-L <[login to unmask email]>

An
[login to unmask email]
Kopie
Thema
Re: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)





On Thu, Jan 20, 2011 at 2:44 PM, Roy Boxwell <[login to unmask email]<mailto:[login to unmask email]>> wrote:

could you please post which of the five error types and with which reason-code is being produced??

-922 AUTHORIZATION FAILURE: error-type ERROR. REASON reason-code

Explanation: Authorization failed because of the error indicated by error-type

error-type
Types of authorization failure
v User authorization
v Plan access
v Duplicate exit requested
v Installation error
v Connect


Ta!


Roy Boxwell
SOFTWARE ENGINEERING GMBH
-Product Development-
Robert-Stolz-Straße 5
40470 Düsseldorf/Germany
Tel. +49 (0)211 96149-675
Fax +49 (0)211 96149-32
Email: [login to unmask email]<mailto:[login to unmask email]>
http://www.seg.de < http://www.seg.de/ >

Software Engineering GmbH
Amtsgericht Düsseldorf, HRB 37894
Geschäftsführung: Gerhard Schubert

I'm getting -

DSNT408I SQLCODE = -922, ERROR: AUTHORIZATION FAILURE: PLAN ACCESS
ERROR. REASON 00F30034
DSNT418I SQLSTATE = 42505 SQLSTATE RETURN CODE
DSNT415I SQLERRP = DSNAET03 SQL PROCEDURE DETECTING ERROR
reason code is -

00F30034

Explanation:

The authorization ID associated with this connection is not authorized to use the specified plan name or the specified plan name does not exist.

System Action:

The request to allocate a plan to the authorization ID is denied.

User Response:

Verify that the correct plan name was specified. If this plan exists, then request execution authority to the plan from either the owner of the plan or from another person given authority to grant execution authority to the plan.

Jim McAlpine



________________________________

< http://www-01.ibm.com/software/data/db2/zos/db2-10/ >

The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here. < http://www.idug.org/register >

________________________________

[ http://www.idug.org/images/stories/db2/db2_10_savings.jpg ] < http://www-01.ibm.com/software/data/db2/zos/db2-10/ >

The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here. < http://www.idug.org/register >

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Lynne Flatley

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Raymond Bell)
Also, usually plans which run under CICS are granted execute to PUBLIC, not
sure about IMS...

On Thu, Jan 20, 2011 at 10:19 AM, Bell, Raymond <[login to unmask email]>wrote:

> ...or the plan doesn't actually exist.
>
> Sorry, but didn't see if you said you'd bound the plan used.
>
> Cheers,
>
>
> Raymond
> ________________________________________
> Raymond Bell
> Senior Software Consultant
> BMC Software
>
> Phone: +44 (0) 1784 478 558
> Mobile: +44 (0) 7894 608 214
> Fax: +44 (0) 1784 478 753
>
> Assurance House
> Vicarage Road, Egham
> Surrey TW20 9JY, United Kingdom
>
> *From*: Roy Boxwell [mailto:[login to unmask email]
> *Sent*: Thursday, January 20, 2011 09:16 AM
> *To*: [login to unmask email] <[login to unmask email]>
> *Subject*: Re: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package
> name)
>
>
> well, I hate to say it, but it looks like GRANT EXECUTE ON PLAN xxxx TO
> yyyy is missing...
> *
> Roy Boxwell*
> SOFTWARE ENGINEERING GMBH
> -Product Development-*
> Robert-Stolz-Straße 5
> 40470 Düsseldorf/Germany
> Tel. +49 (0)211 96149-675
> Fax +49 (0)211 96149-32
> Email: [login to unmask email]
> http://www.seg.de
>
> Software Engineering GmbH
> Amtsgericht Düsseldorf, HRB 37894
> Geschäftsführung: Gerhard Schubert*
>
>
> *Jim McAlpine <[login to unmask email]>*
> Gesendet von: IDUG DB2-L <[login to unmask email]>
>
> 20.01.2011 16:07
> Bitte antworten an
> IDUG DB2-L <[login to unmask email]>
>
> An
> [login to unmask email]
> Kopie
> Thema
> Re: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)
>
>
>
>
> On Thu, Jan 20, 2011 at 2:44 PM, Roy Boxwell <*[login to unmask email]*<[login to unmask email]>>
> wrote:
>
> could you please post which of the five error types and with which
> reason-code is being produced??
>
> -922 AUTHORIZATION FAILURE: error-type ERROR. REASON reason-code
>
> Explanation: Authorization failed because of the error indicated by
> error-type
>
> error-type
> Types of authorization failure
> v User authorization
> v Plan access
> v Duplicate exit requested
> v Installation error
> v Connect
>
>
> Ta!
> *
>
> Roy Boxwell*
> SOFTWARE ENGINEERING GMBH
> -Product Development-*
> Robert-Stolz-Straße 5
> 40470 Düsseldorf/Germany
> Tel. +49 (0)211 96149-675
> Fax +49 (0)211 96149-32
> Email: **[login to unmask email]* <[login to unmask email]>*
> **http://www.seg.de* < http://www.seg.de/ > *
>
> Software Engineering GmbH
> Amtsgericht Düsseldorf, HRB 37894
> Geschäftsführung: Gerhard Schubert*
>
> I'm getting -
>
> DSNT408I SQLCODE = -922, ERROR: AUTHORIZATION FAILURE: PLAN ACCESS
> ERROR. REASON 00F30034
> DSNT418I SQLSTATE = 42505 SQLSTATE RETURN CODE
> DSNT415I SQLERRP = DSNAET03 SQL PROCEDURE DETECTING ERROR
> reason code is -
>
> *00F30034*
>
> *Explanation:*
>
> The authorization ID associated with this connection is not authorized to
> use the specified plan name or the specified plan name does not exist.
>
> *System* *Action:*
>
> The request to allocate a plan to the authorization ID is denied.
>
> *User* *Response:*
>
> Verify that the correct plan name was specified. If this plan exists, then
> request execution authority to the plan from either the owner of the plan or
> from another person given authority to grant execution authority to the
> plan.
>
> Jim McAlpine
>
>
>
>
> ------------------------------
>
> < http://www-01.ibm.com/software/data/db2/zos/db2-10/ >
>
> The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are
> not already an IDUG member, *please register here.* < http://www.idug.org/register >
>
>
> ------------------------------
>
> [image: Introducing IBM® DB2® 10 for z/OS ] < http://www-01.ibm.com/software/data/db2/zos/db2-10/ >
>
> The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are
> not already an IDUG member, please register here. < http://www.idug.org/register >
>
> ------------------------------
>
> [image: Introducing IBM® DB2® 10 for z/OS ] < http://www-01.ibm.com/software/data/db2/zos/db2-10/ >
>
> The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are
> not already an IDUG member, please register here. < http://www.idug.org/register >
>

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Jim McAlpine

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Lynne Flatley)
On Thu, Jan 20, 2011 at 3:16 PM, Roy Boxwell <[login to unmask email]> wrote:

>
> well, I hate to say it, but it looks like GRANT EXECUTE ON PLAN xxxx TO
> yyyy is missing...
> *
> Roy Boxwell*
> SOFTWARE ENGINEERING GMBH
> -Product Development-*
> Robert-Stolz-Straße 5
> 40470 Düsseldorf/Germany
> Tel. +49 (0)211 96149-675
> Fax +49 (0)211 96149-32
> Email: [login to unmask email]
> http://www.seg.de
>
> Software Engineering GmbH
> Amtsgericht Düsseldorf, HRB 37894
> Geschäftsführung: Gerhard Schubert*
>
> That's what it would seem but the plan used for both CICS and IMS is the
same (H30DOLAS) and the userid assigned to the CICS region and the IMS MPR
is the same (H30DUSR). CICS works fine but IMS gets -922.

very strange.

Jim McAlpine

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Mike Vaughan

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Michael Turner)
This might just come down to understanding which security is being checked, which will get into your RDO entries. In a previous message you mentioned that the IMS and CICS regions are running under the same authorization id. This may be the case, but the authorization id that DB2 is looking at for the thread is based on the AUTHTYPE specified in the RDO entry. Check out your RDO entry and see what you have for AUTHTYPE (I believe it defaults to USERID, which would be the userid running the transaction).

________________________________
From: IDUG DB2-L [mailto:[login to unmask email] On Behalf Of Roy Boxwell
Sent: Thursday, January 20, 2011 9:16 AM
To: [login to unmask email]
Subject: Re: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)


well, I hate to say it, but it looks like GRANT EXECUTE ON PLAN xxxx TO yyyy is missing...

Roy Boxwell
SOFTWARE ENGINEERING GMBH
-Product Development-
Robert-Stolz-Straße 5
40470 Düsseldorf/Germany
Tel. +49 (0)211 96149-675
Fax +49 (0)211 96149-32
Email: [login to unmask email]
http://www.seg.de

Software Engineering GmbH
Amtsgericht Düsseldorf, HRB 37894
Geschäftsführung: Gerhard Schubert


Jim McAlpine <[login to unmask email]>
Gesendet von: IDUG DB2-L <[login to unmask email]>

20.01.2011 16:07
Bitte antworten an
IDUG DB2-L <[login to unmask email]>


An
[login to unmask email]
Kopie
Thema
Re: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)





On Thu, Jan 20, 2011 at 2:44 PM, Roy Boxwell <[login to unmask email]<mailto:[login to unmask email]>> wrote:

could you please post which of the five error types and with which reason-code is being produced??

-922 AUTHORIZATION FAILURE: error-type ERROR. REASON reason-code

Explanation: Authorization failed because of the error indicated by error-type

error-type
Types of authorization failure
v User authorization
v Plan access
v Duplicate exit requested
v Installation error
v Connect


Ta!


Roy Boxwell
SOFTWARE ENGINEERING GMBH
-Product Development-
Robert-Stolz-Straße 5
40470 Düsseldorf/Germany
Tel. +49 (0)211 96149-675
Fax +49 (0)211 96149-32
Email: [login to unmask email]<mailto:[login to unmask email]>
http://www.seg.de < http://www.seg.de/ >

Software Engineering GmbH
Amtsgericht Düsseldorf, HRB 37894
Geschäftsführung: Gerhard Schubert

I'm getting -

DSNT408I SQLCODE = -922, ERROR: AUTHORIZATION FAILURE: PLAN ACCESS
ERROR. REASON 00F30034
DSNT418I SQLSTATE = 42505 SQLSTATE RETURN CODE
DSNT415I SQLERRP = DSNAET03 SQL PROCEDURE DETECTING ERROR
reason code is -

00F30034

Explanation:

The authorization ID associated with this connection is not authorized to use the specified plan name or the specified plan name does not exist.

System Action:

The request to allocate a plan to the authorization ID is denied.

User Response:

Verify that the correct plan name was specified. If this plan exists, then request execution authority to the plan from either the owner of the plan or from another person given authority to grant execution authority to the plan.

Jim McAlpine

________________________________

< http://www-01.ibm.com/software/data/db2/zos/db2-10/ >

The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here. < http://www.idug.org/register >

________________________________

[ http://www.idug.org/images/stories/db2/db2_10_savings.jpg ] < http://www-01.ibm.com/software/data/db2/zos/db2-10/ >

The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here. < http://www.idug.org/register >
</pre><br>-----Message Disclaimer-----<br><br>This e-mail message is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended recipient, any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by reply email to [login to unmask email] and delete or destroy all copies of the original message and attachments thereto. Email sent to or from the Principal Financial Group or any of its member companies may be retained as required by law or regulation.<br><br> Nothing in this message is intended to constitute an Electronic signature for purposes of the Uniform Electronic Transactions Act (UETA) or the Electronic Signatures in Global and National Commerce Act ("E-Sign") unless a specific statement to the contrary is included in this message.<br><br>While this communication may be used to promote or market a transaction or an idea that is discussed in the publication, it is intended to provide general information about the subject matter covered and is provided with the understanding that The Principal is not rendering legal, accounting, or tax advice. It is not a marketed opinion and may not be used to avoid penalties under the Internal Revenue Code. You should consult with appropriate counsel or other advisors on all matters pertaining to legal, tax, or accounting obligations and requirements.<br><pre>

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Raymond Bell

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Mike Vaughan)
You could try granting to Public At All Locations, verifying it works and working backwards from there.


Raymond
________________________________________
Raymond Bell
Senior Software Consultant
BMC Software

Phone: +44 (0) 1784 478 558
Mobile: +44 (0) 7894 608 214
Fax: +44 (0) 1784 478 753

Assurance House
Vicarage Road, Egham
Surrey TW20 9JY, United Kingdom

From: Lynne Flatley [mailto:[login to unmask email]
Sent: Thursday, January 20, 2011 09:22 AM
To: [login to unmask email] <[login to unmask email]>
Subject: Re: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)

Also, usually plans which run under CICS are granted execute to PUBLIC, not sure about IMS...

On Thu, Jan 20, 2011 at 10:19 AM, Bell, Raymond <[login to unmask email]<mailto:[login to unmask email]>> wrote:
...or the plan doesn't actually exist.

Sorry, but didn't see if you said you'd bound the plan used.

Cheers,


Raymond
________________________________________
Raymond Bell
Senior Software Consultant
BMC Software

Phone: +44 (0) 1784 478 558
Mobile: +44 (0) 7894 608 214
Fax: +44 (0) 1784 478 753

Assurance House
Vicarage Road, Egham
Surrey TW20 9JY, United Kingdom

From: Roy Boxwell [mailto:[login to unmask email]<mailto:[login to unmask email]>]
Sent: Thursday, January 20, 2011 09:16 AM
To: [login to unmask email]<mailto:[login to unmask email]> <[login to unmask email]<mailto:[login to unmask email]>>
Subject: Re: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)


well, I hate to say it, but it looks like GRANT EXECUTE ON PLAN xxxx TO yyyy is missing...

Roy Boxwell
SOFTWARE ENGINEERING GMBH
-Product Development-
Robert-Stolz-Straße 5
40470 Düsseldorf/Germany
Tel. +49 (0)211 96149-675
Fax +49 (0)211 96149-32
Email: [login to unmask email]<mailto:[login to unmask email]>
http://www.seg.de

Software Engineering GmbH
Amtsgericht Düsseldorf, HRB 37894
Geschäftsführung: Gerhard Schubert


Jim McAlpine <[login to unmask email]<mailto:[login to unmask email]>>
Gesendet von: IDUG DB2-L <[login to unmask email]<mailto:[login to unmask email]>>

20.01.2011 16:07

Bitte antworten an
IDUG DB2-L <[login to unmask email]<mailto:[login to unmask email]>>



An
[login to unmask email]<mailto:[login to unmask email]>
Kopie

Thema
Re: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)







On Thu, Jan 20, 2011 at 2:44 PM, Roy Boxwell <[login to unmask email]<mailto:[login to unmask email]>> wrote:

could you please post which of the five error types and with which reason-code is being produced??

-922 AUTHORIZATION FAILURE: error-type ERROR. REASON reason-code

Explanation: Authorization failed because of the error indicated by error-type

error-type
Types of authorization failure
v User authorization
v Plan access
v Duplicate exit requested
v Installation error
v Connect


Ta!


Roy Boxwell
SOFTWARE ENGINEERING GMBH
-Product Development-
Robert-Stolz-Straße 5
40470 Düsseldorf/Germany
Tel. +49 (0)211 96149-675
Fax +49 (0)211 96149-32
Email: [login to unmask email]<mailto:[login to unmask email]>
http://www.seg.de < http://www.seg.de/ >

Software Engineering GmbH
Amtsgericht Düsseldorf, HRB 37894
Geschäftsführung: Gerhard Schubert

I'm getting -

DSNT408I SQLCODE = -922, ERROR: AUTHORIZATION FAILURE: PLAN ACCESS
ERROR. REASON 00F30034
DSNT418I SQLSTATE = 42505 SQLSTATE RETURN CODE
DSNT415I SQLERRP = DSNAET03 SQL PROCEDURE DETECTING ERROR
reason code is -

00F30034

Explanation:

The authorization ID associated with this connection is not authorized to use the specified plan name or the specified plan name does not exist.

System Action:

The request to allocate a plan to the authorization ID is denied.

User Response:

Verify that the correct plan name was specified. If this plan exists, then request execution authority to the plan from either the owner of the plan or from another person given authority to grant execution authority to the plan.

Jim McAlpine




________________________________

< http://www-01.ibm.com/software/data/db2/zos/db2-10/ >

The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here. < http://www.idug.org/register >


________________________________

< http://www-01.ibm.com/software/data/db2/zos/db2-10/ >

The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here. < http://www.idug.org/register >

________________________________

< http://www-01.ibm.com/software/data/db2/zos/db2-10/ >

The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here. < http://www.idug.org/register >


________________________________

[ http://www.idug.org/images/stories/db2/db2_10_savings.jpg ] < http://www-01.ibm.com/software/data/db2/zos/db2-10/ >

The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here. < http://www.idug.org/register >

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Michael Turner

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Mike Vaughan)
Hi Jim

Since IMS is using the same plan as CICS, then it must not be using the same DB2 authorization ID. In your original post you said that the IMS MPR runs under the same user ID as the CICS region. Under CICS a transaction does not usually run under the CICS region user ID but under one determined by the CICS/DB2 interface definition. Often the user ID of the person logged onto CICS is used, but other options are possible. You need to check your CICS/DB2 definitions to find out which user ID is passed to DB2. If it is not the same as the IMS MPR user ID then you need to grant execute on the plan to the IMS MPR user ID.

Regards
Mike Turner
Email: [login to unmask email]
Tel: +44 (0)1565-873702
Web: www.michael-turner.ltd.uk
Michael Turner Ltd. Registered in England & Wales No. 1433722. Registered Office: 131 King Street, Knutsford, Cheshire, WA16 6EJ. VAT No. GB 338 4159 44.
----- Original Message -----
From: Jim McAlpine
Newsgroups: bit.listserv.db2-l
To: [login to unmask email]
Sent: Thursday, January 20, 2011 3:07 PM
Subject: Re: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)


On Thu, Jan 20, 2011 at 2:44 PM, Roy Boxwell <[login to unmask email]> wrote:


could you please post which of the five error types and with which reason-code is being produced??

-922 AUTHORIZATION FAILURE: error-type ERROR. REASON reason-code

Explanation: Authorization failed because of the error indicated by error-type

error-type
Types of authorization failure
v User authorization
v Plan access
v Duplicate exit requested
v Installation error
v Connect


Ta!


Roy Boxwell
SOFTWARE ENGINEERING GMBH
-Product Development-
Robert-Stolz-Straße 5
40470 Düsseldorf/Germany
Tel. +49 (0)211 96149-675
Fax +49 (0)211 96149-32
Email: [login to unmask email]
http://www.seg.de

Software Engineering GmbH
Amtsgericht Düsseldorf, HRB 37894
Geschäftsführung: Gerhard Schubert


I'm getting -

DSNT408I SQLCODE = -922, ERROR: AUTHORIZATION FAILURE: PLAN ACCESS
ERROR. REASON 00F30034
DSNT418I SQLSTATE = 42505 SQLSTATE RETURN CODE
DSNT415I SQLERRP = DSNAET03 SQL PROCEDURE DETECTING ERROR

reason code is -

00F30034




Explanation:
The authorization ID associated with this connection is not authorized to use the specified plan name or the specified plan name does not exist.

System Action:

The request to allocate a plan to the authorization ID is denied.

User Response:

Verify that the correct plan name was specified. If this plan exists, then request execution authority to the plan from either the owner of the plan or from another person given authority to grant execution authority to the plan.

Jim McAlpine









------------------------------------------------------------------------------



The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here.

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Adrian Collett

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Raymond Bell)
Jim,

are you sure your IMS is connecting to the same DB2 subsystem where your plan was bound ????

Just a thought....as surprisingly have "been there, done that" :-)

Ciao,
Adrian



Il 20/01/2011 4:07 PM, Jim McAlpine ha scritto:
On Thu, Jan 20, 2011 at 2:44 PM, Roy Boxwell <[login to unmask email]> wrote:

could you please post which of the five error types and with which reason-code is being produced??

-922 AUTHORIZATION FAILURE: error-type ERROR. REASON reason-code

Explanation: Authorization failed because of the error indicated by error-type

error-type
Types of authorization failure
v User authorization
v Plan access
v Duplicate exit requested
v Installation error
v Connect


Ta!


Roy Boxwell

SOFTWARE ENGINEERING GMBH
-Product Development-
Robert-Stolz-Straße 5
40470 Düsseldorf/Germany
Tel. +49 (0)211 96149-675
Fax +49 (0)211 96149-32
Email: [login to unmask email]
http://www.seg.de

Software Engineering GmbH
Amtsgericht Düsseldorf, HRB 37894
Geschäftsführung: Gerhard Schubert


I'm getting -
 
DSNT408I SQLCODE = -922, ERROR:  AUTHORIZATION FAILURE: PLAN ACCESS
         ERROR. REASON 00F30034
DSNT418I SQLSTATE   = 42505 SQLSTATE RETURN CODE
DSNT415I SQLERRP    = DSNAET03 SQL PROCEDURE DETECTING ERROR
reason code is -
 
   00F30034


Explanation:

The authorization ID associated with this connection is not authorized to use the specified plan name or the specified plan name does not exist.

System Action:

The request to allocate a plan to the authorization ID is denied.

User Response:

Verify that the correct plan name was specified. If this plan exists, then request execution authority to the plan from either the owner of the plan or from another person given authority to grant execution authority to the plan.

Jim McAlpine

 



The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here.



The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here.

Mike Vaughan

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Jim McAlpine)
Sorry -- just realized I mis-read the issue. I thought you were taking the -922 from CICS but in re-reading it appears that you are taking the error from IMS. Regardless, this might explain why one works and the other doesn't, but I can't say how IMS does it's thing...

________________________________
From: Vaughan, Mike
Sent: Thursday, January 20, 2011 9:25 AM
To: IDUG DB2-L
Subject: RE: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)

This might just come down to understanding which security is being checked, which will get into your RDO entries. In a previous message you mentioned that the IMS and CICS regions are running under the same authorization id. This may be the case, but the authorization id that DB2 is looking at for the thread is based on the AUTHTYPE specified in the RDO entry. Check out your RDO entry and see what you have for AUTHTYPE (I believe it defaults to USERID, which would be the userid running the transaction).

________________________________
From: IDUG DB2-L [mailto:[login to unmask email] On Behalf Of Roy Boxwell
Sent: Thursday, January 20, 2011 9:16 AM
To: [login to unmask email]
Subject: Re: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)


well, I hate to say it, but it looks like GRANT EXECUTE ON PLAN xxxx TO yyyy is missing...

Roy Boxwell
SOFTWARE ENGINEERING GMBH
-Product Development-
Robert-Stolz-Straße 5
40470 Düsseldorf/Germany
Tel. +49 (0)211 96149-675
Fax +49 (0)211 96149-32
Email: [login to unmask email]
http://www.seg.de

Software Engineering GmbH
Amtsgericht Düsseldorf, HRB 37894
Geschäftsführung: Gerhard Schubert


Jim McAlpine <[login to unmask email]>
Gesendet von: IDUG DB2-L <[login to unmask email]>

20.01.2011 16:07
Bitte antworten an
IDUG DB2-L <[login to unmask email]>



An
[login to unmask email]
Kopie
Thema
Re: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)







On Thu, Jan 20, 2011 at 2:44 PM, Roy Boxwell <[login to unmask email]<mailto:[login to unmask email]>> wrote:

could you please post which of the five error types and with which reason-code is being produced??

-922 AUTHORIZATION FAILURE: error-type ERROR. REASON reason-code

Explanation: Authorization failed because of the error indicated by error-type

error-type
Types of authorization failure
v User authorization
v Plan access
v Duplicate exit requested
v Installation error
v Connect


Ta!


Roy Boxwell
SOFTWARE ENGINEERING GMBH
-Product Development-
Robert-Stolz-Straße 5
40470 Düsseldorf/Germany
Tel. +49 (0)211 96149-675
Fax +49 (0)211 96149-32
Email: [login to unmask email]<mailto:[login to unmask email]>
http://www.seg.de < http://www.seg.de/ >

Software Engineering GmbH
Amtsgericht Düsseldorf, HRB 37894
Geschäftsführung: Gerhard Schubert

I'm getting -

DSNT408I SQLCODE = -922, ERROR: AUTHORIZATION FAILURE: PLAN ACCESS
ERROR. REASON 00F30034
DSNT418I SQLSTATE = 42505 SQLSTATE RETURN CODE
DSNT415I SQLERRP = DSNAET03 SQL PROCEDURE DETECTING ERROR
reason code is -

00F30034

Explanation:

The authorization ID associated with this connection is not authorized to use the specified plan name or the specified plan name does not exist.

System Action:

The request to allocate a plan to the authorization ID is denied.

User Response:

Verify that the correct plan name was specified. If this plan exists, then request execution authority to the plan from either the owner of the plan or from another person given authority to grant execution authority to the plan.

Jim McAlpine

________________________________

< http://www-01.ibm.com/software/data/db2/zos/db2-10/ >

The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here. < http://www.idug.org/register >

________________________________

[ http://www.idug.org/images/stories/db2/db2_10_savings.jpg ] < http://www-01.ibm.com/software/data/db2/zos/db2-10/ >

The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here. < http://www.idug.org/register >
</pre><br>-----Message Disclaimer-----<br><br>This e-mail message is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended recipient, any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by reply email to [login to unmask email] and delete or destroy all copies of the original message and attachments thereto. Email sent to or from the Principal Financial Group or any of its member companies may be retained as required by law or regulation.<br><br> Nothing in this message is intended to constitute an Electronic signature for purposes of the Uniform Electronic Transactions Act (UETA) or the Electronic Signatures in Global and National Commerce Act ("E-Sign") unless a specific statement to the contrary is included in this message.<br><br>While this communication may be used to promote or market a transaction or an idea that is discussed in the publication, it is intended to provide general information about the subject matter covered and is provided with the understanding that The Principal is not rendering legal, accounting, or tax advice. It is not a marketed opinion and may not be used to avoid penalties under the Internal Revenue Code. You should consult with appropriate counsel or other advisors on all matters pertaining to legal, tax, or accounting obligations and requirements.<br><pre>

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Mark M2 Doyle

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Adrian Collett)
Jim,

You may just need ENABLE(*) on the IMS bind. If that didn't work, then you may need to specify the imsid and whether you're using IMSBMP or IMSMPP (or both). Or not.



| >>__ ______________________________________________________________________________ __________>< |

| | _ENABLE(*)_________________________ | |

| | | <_,__________ | <___________________________________ | |

| |_|_ _ENABLE__ __(___ _BATCH____ |__)_|___ _________________________________ |_| |

| |_DISABLE_| |_DLIBATCH_| | <_,_______________ | |

| |_DB2CALL__| |_DLIBATCH(___connection-name_|_)_| |

| |_CICS_____| | <_,______ | |

| |_IMS______| |_CICS(___applid_|_)______________| |

| |_IMSBMP___| | <_,_____ | |

| |_IMSMPP___| |_IMSBMP(___imsid_|_)_____________| |

| |_REMOTE___| | <_,_____ | |

| |_RRSAF____| |_IMSMPP(___imsid_|_)_____________| |

| | <_,_________________ | |

| |_REMOTE(___ _location-name_ _|_)_| |

| |_<luname>______| |

| |



Grasping at straws here.



Mark


From: IDUG DB2-L [mailto:[login to unmask email] On Behalf Of Jim McAlpine
Sent: Thursday, January 20, 2011 9:27 AM
To: [login to unmask email]
Subject: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)

OK, continuing on from my earlier post, I've now got the CICS system set up and working but I'm getting a -922 when trying to invoke the initial IMS transaction. The CICS programs are bound with a version of VFG1. The IMS programs are bound with a version of VFG2 like so -

18:15:01 FAAA bind
DSNT254I + DSNTBCM2 BIND OPTIONS FOR
PACKAGE = REMOTE_DB2B.CH30D.FAAA.(VFG2)
ACTION ADD
OWNER H30D
QUALIFIER H30D
VALIDATE BIND
EXPLAIN NO
ISOLATION CS
RELEASE COMMIT
COPY
DSNT255I + DSNTBCM2 BIND OPTIONS FOR
PACKAGE = REMOTE_DB2B.CH30D.FAAA.(VFG2)
SQLERROR NOPACKAGE
CURRENTDATA NO
DEGREE 1
DYNAMICRULES RUN
DEFER
NOREOPT VARS
KEEPDYNAMIC NO
IMMEDWRITE NO
DBPROTOCOL DRDA
OPTHINT
ENCODING EBCDIC(00285)
PATH
DSNT232I + SUCCESSFUL BIND FOR
PACKAGE = REMOTE_DB2B.CH30D.FAAA.(VFG2)


The plan used for both CICS and IMS is called H30DOLAS and is bound like so -

BIND PLAN(H30DOLAS) PKLIST(CH30D.*) OWNER(H30D) ISOLATION(CS) ACQUIRE(USE) ACTION(REP) RETAIN CACHESIZE(8) FLAG(I) VALIDATE(BIND)
DSNT252I + DSNTBCM1 BIND OPTIONS FOR PLAN H30DOLAS
ACTION REPLACE RETAIN
OWNER H30D
VALIDATE BIND
ISOLATION CS
ACQUIRE USE
RELEASE COMMIT
EXPLAIN NO
DYNAMICRULES RUN
DSNT253I + DSNTBCM1 BIND OPTIONS FOR PLAN H30DOLAS
NODEFER PREPARE
CACHESIZE 0256
QUALIFIER H30D
CURRENTSERVER
CURRENTDATA YES
DEGREE 1
SQLRULES DB2
DISCONNECT EXPLICIT
NOREOPT VARS
KEEPDYNAMIC NO
IMMEDWRITE NO
DBPROTOCOL DRDA
OPTHINT
ENCODING EBCDIC(00285)
PATH
DSNT200I + BIND FOR PLAN H30DOLAS SUCCESSFUL

and the IMS RTT has entries for the programs like so -

DSNMAPN APN=PAAAQ,PLAN=H30DOLAS

The IMS MPR region runs under the same userid as the CICS region so I don't think it's a user authorization error but I can't see how it is a plan access error either from the evidence above.

Any pointers would be much appreciated.

Jim McAlpine


This transmission may contain information that is privileged,
confidential, legally privileged, and/or exempt from disclosure
under applicable law. If you are not the intended recipient, you
are hereby notified that any disclosure, copying, distribution, or
use of the information contained herein (including any reliance
thereon) is STRICTLY PROHIBITED. Although this transmission and
any attachments are believed to be free of any virus or other
defect that might affect any computer system into which it is
received and opened, it is the responsibility of the recipient to
ensure that it is virus free and no responsibility is accepted by
JPMorgan Chase & Co., its subsidiaries and affiliates, as
applicable, for any loss or damage arising in any way from its use.
If you received this transmission in error, please immediately
contact the sender and destroy the material in its entirety,
whether in electronic or hard copy format. Thank you.

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Jim McAlpine

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Mark M2 Doyle)
On Thu, Jan 20, 2011 at 3:27 PM, Adrian <[login to unmask email]> wrote:

> Jim,
>
> are you sure your IMS is connecting to the same DB2 subsystem where your
> plan was bound ????
>
> Just a thought....as surprisingly have "been there, done that" :-)
>
> Ciao,
> Adrian
>
>
>
Great catch Adrian. I had copied the jcl for the MPR and forgot to change
the SSM parameter to point to the correct DB2 subsystem. When I now do dis
subsys all, I can see the MPR connected to the correct DB2.

HOWEVER, I'm still getting exactly the same error. I'll check some of the
other suggestions.

It's a long time since I have done this stuff and I'd forgotten just how
many pieces have to fit together.

Jim McAlpine

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Adrian Collett

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Jim McAlpine)
Jim,

GTHH :-)

as others have suggested, now you just need to ensure that your IMS MPR user ID has EXECUTE authority on this plan....either explicitly or via PUBLIC....depending on your site's security policy of course... :-)

Ciao 4 now,
Adrian




Il 20/01/2011 4:57 PM, Jim McAlpine ha scritto:
On Thu, Jan 20, 2011 at 3:27 PM, Adrian <[login to unmask email]> wrote:
Jim,

are you sure your IMS is connecting to the same DB2 subsystem where your plan was bound ????

Just a thought....as surprisingly have "been there, done that" :-)

Ciao,
Adrian


 
Great catch Adrian. I had copied the jcl for the MPR and forgot to change the SSM parameter to point to the correct DB2 subsystem.  When I now do dis subsys all, I can see the MPR connected to the correct DB2.
 
HOWEVER, I'm still getting exactly the same error.  I'll check some of the other suggestions.
 
It's a long time since I have done this stuff and I'd forgotten just how many pieces have to fit together.
 
Jim McAlpine    


The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here.



The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here.

Jim McAlpine

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Adrian Collett)
On Thu, Jan 20, 2011 at 3:27 PM, Mike Turner <[login to unmask email]> wrote:

> Hi Jim
>
> Since IMS is using the same plan as CICS, then it must not be using the
> same DB2 authorization ID. In your original post you said that the IMS MPR
> runs under the same user ID as the CICS region. Under CICS a transaction
> does not usually run under the CICS region user ID but under one determined
> by the CICS/DB2 interface definition. Often the user ID of the person logged
> onto CICS is used, but other options are possible. You need to check your
> CICS/DB2 definitions to find out which user ID is passed to DB2. If it is
> not the same as the IMS MPR user ID then you need to grant execute on the
> plan to the IMS MPR user ID.
>
> Regards
> Mike Turner
> Email: [login to unmask email]
> Tel: +44 (0)1565-873702
>


Hi Mike, good points. However the userid specified in the RCT is the same
one specified for CICS and the IMS MPR and I've verified with CEDF that the
primary authid is correct, like so -

STATUS: COMMAND EXECUTION COMPLETE
CALL TO RESOURCE MANAGER DSNCSQL
EXEC SQL SELECT P.AUTH=H30DUSR , S.AUTH=
PLAN=H30DOLAS, DBRM=GZAB, STMT=03391, SECT=00003

Unfortunately no such CEDF facility with IMS

I'm presuming that DB2 gets the authid for IMS from the userid of the MPR
region as it isn't specified in the RTT. Can someone confirm or deny this.

Jim McAlpine

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Michael Turner

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Jim McAlpine)
Hi Jim

My IMS is rusty, but maybe this extract from the Admin Guide will help:

DB2 determines the initial primary ID as follows:

For IMS sign-ons from message-driven regions, if the user has signed on, the initial primary authorization ID is the user's sign-on ID.

IMS passes to DB2 the IMS sign-on ID and the associated RACF connected group name, if one exists.

If the user has not signed on, the primary ID is the LTERM name, or if that is not available, the PSB name.

For a batch-oriented region, the primary ID is the value of the USER parameter on the job statement, if that is available. If that is not available, the primary ID is the program's PSB name.


Regards
Mike Turner
Email: [login to unmask email]
Tel: +44 (0)1565-873702
Web: www.michael-turner.ltd.uk
Michael Turner Ltd. Registered in England & Wales No. 1433722. Registered Office: 131 King Street, Knutsford, Cheshire, WA16 6EJ. VAT No. GB 338 4159 44.
----- Original Message -----
From: Jim McAlpine
Newsgroups: bit.listserv.db2-l
To: [login to unmask email]
Sent: Thursday, January 20, 2011 4:19 PM
Subject: Re: [DB2-L] DB2 for z/OS V8 - -922 auth failure (was package name)


On Thu, Jan 20, 2011 at 3:27 PM, Mike Turner <[login to unmask email]> wrote:

Hi Jim

Since IMS is using the same plan as CICS, then it must not be using the same DB2 authorization ID. In your original post you said that the IMS MPR runs under the same user ID as the CICS region. Under CICS a transaction does not usually run under the CICS region user ID but under one determined by the CICS/DB2 interface definition. Often the user ID of the person logged onto CICS is used, but other options are possible. You need to check your CICS/DB2 definitions to find out which user ID is passed to DB2. If it is not the same as the IMS MPR user ID then you need to grant execute on the plan to the IMS MPR user ID.

Regards
Mike Turner
Email: [login to unmask email]
Tel: +44 (0)1565-873702



Hi Mike, good points. However the userid specified in the RCT is the same one specified for CICS and the IMS MPR and I've verified with CEDF that the primary authid is correct, like so -

STATUS: COMMAND EXECUTION COMPLETE
CALL TO RESOURCE MANAGER DSNCSQL
EXEC SQL SELECT P.AUTH=H30DUSR , S.AUTH=
PLAN=H30DOLAS, DBRM=GZAB, STMT=03391, SECT=00003

Unfortunately no such CEDF facility with IMS

I'm presuming that DB2 gets the authid for IMS from the userid of the MPR region as it isn't specified in the RTT. Can someone confirm or deny this.

Jim McAlpine



------------------------------------------------------------------------------



The IDUG DB2-L Listserv is only part of your membership in IDUG. If you are not already an IDUG member, please register here.

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Jim McAlpine

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Michael Turner)
On Thu, Jan 20, 2011 at 4:36 PM, Mike Turner <[login to unmask email]> wrote:

> Hi Jim
>
> My IMS is rusty, but maybe this extract from the Admin Guide will help:
>
>
> DB2 determines the initial primary ID as follows:
> *
>
> For IMS sign-ons
> *from message-driven regions, if the user has signed on, the initial
> primary authorization ID is the user's sign-on ID.
>
> IMS passes to DB2 the IMS sign-on ID and the associated RACF connected
> group name, if one exists.
>
> If the user has not signed on, the primary ID is the LTERM name, or if that
> is not available, the PSB name.
>
> For a batch-oriented region, the primary ID is the value of the USER
> parameter on the job statement, if that is available. If that is not
> available, the primary ID is the program's PSB name.
>
> Regards
> Mike Turner
> Email: [login to unmask email]
> Tel: +44 (0)1565-873702
> Web: www.michael-turner.ltd.uk
>
>
>
<sheepish look>
In which case it looks like a grant to public on the plan is required as a
few have already mentioned. I'll give that a go and report back.
</sheepish look)

I was sure that the userid of the MPR was the authid. So much for my
memory.

Jim McAlpine

Jim McAlpine

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Jim McAlpine

Re: DB2 for z/OS V8 - -922 auth failure (was package name)
(in response to Jim McAlpine)
On Thu, Jan 20, 2011 at 4:53 PM, Jim McAlpine <[login to unmask email]>wrote:

> On Thu, Jan 20, 2011 at 4:36 PM, Mike Turner <[login to unmask email]> wrote:
>
>> Hi Jim
>>
>> My IMS is rusty, but maybe this extract from the Admin Guide will help:
>>
>>
>> DB2 determines the initial primary ID as follows:
>> *
>>
>> For IMS sign-ons
>> *from message-driven regions, if the user has signed on, the initial
>> primary authorization ID is the user's sign-on ID.
>>
>> IMS passes to DB2 the IMS sign-on ID and the associated RACF connected
>> group name, if one exists.
>>
>> If the user has not signed on, the primary ID is the LTERM name, or if
>> that is not available, the PSB name.
>>
>> For a batch-oriented region, the primary ID is the value of the USER
>> parameter on the job statement, if that is available. If that is not
>> available, the primary ID is the program's PSB name.
>>
>> Regards
>> Mike Turner
>> Email: [login to unmask email]
>> Tel: +44 (0)1565-873702
>> Web: www.michael-turner.ltd.uk
>>
>>
>>
> <sheepish look>
> In which case it looks like a grant to public on the plan is required as a
> few have already mentioned. I'll give that a go and report back.
> </sheepish look)
>
> I was sure that the userid of the MPR was the authid. So much for my
> memory.
>
> Jim McAlpine
>
> Jim McAlpine
>

Bingo that was it, well apart from a couple of other small issues. Well I
now have my CICS and IMS systems pointing at the same DB2 subsystem and
using the same set of databases/tables using package versioning.

Thanks to all that helped out, it is much appreciated.

I'll try not to forget this stuff for next time.

Jim McAlpine

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
Mentoring should be a rewarding experience for everyone...
IDUG is offering up to 80% off when you both come to the conference!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv