The problem, I had a message
SSL Handshake Failed, ICSF error. Review ‘RACF CSFSERV Resource Requirements’ of the z/OS documentation.
Reason: The webservers userid does not have access to CSFSERV resource classes required for SSL.
But it does not tell me what it does not have access to.
When an application tries to access a resource, and the userid is not authorised to that resource, RACF can produce an error message, which tells you the resource name.
If the application asks “does this application have access to this resource”, then RACF produces no error message, and it is up to the application to provide a sensible and useful message.
Collecting a RACF trace
You can use a command
#SET TRACE(CLASS(CSFSERV),RACROUTE(ALL))
to turn on the trace for that class. You can also use USERID(…) and jobname(…) to further restrict what is traced.
The output goes to GTF.
s gtf,gtf
01 AHL125A RESPECIFY TRACE OPTIONS OR REPLY U
1,trace=usrp
IEE600I REPLY TO 01 IS;TRACE=USRP
09.53.19 STC00315 TRACE=USRP
02 AHL101A SPECIFY TRACE EVENT KEYWORDS --USR=
- 09.53.27 r 2,usr=(F44),end
09.53.27 STC00315 IEE600I REPLY TO 02 IS;USR=(F44),END
09.53.27 STC00315 USR=(F44),END
09.53.27 STC00315 AHL103I TRACE OPTIONS SELECTED --USR=(F44)
| 09.53.27 STC00315 *03 AHL125A RESPECIFY TRACE OPTIONS OR REPLY U
00- 09.53.30 r 3,u
09.53.30 STC00315 IEE600I REPLY TO 03 IS;U
09.53.30 STC00315 U
Run your work.
P GTF
AHL006I GTF ACKNOWLEDGES STOP COMMAND
AHL904I THE FOLLOWING TRACE DATASETS CONTAIN TRACE DATA :
SYS1.TRACE
if you do not get “THE FOLLOWING TRACE DATASETS CONTAIN TRACE DATA…” it means you did not collect any data.
Use IPCS to look at it
- =0 and specify the trace data set name
- if you change scope to both it will remember the data for next time
- =6 to get you to IPCS Subcommand Entry panel
- if this is the first time you have used this instance of the data set, you should issue the dropd command to get IPCS to forget about previous usage
- gtf usr(all) This displays the data
- You can process this
- type M and press PF8 to get to the bottom of the data
- report view will display the data in ISPF edit (view mode)
- You can now issue commands like
- x all
- f code all and look for non zero return codes.
- del all x
- sort 30 50 to display all return codes in numerical order. You need to look at the top and the bottom.
- make a note of the return code ( copy the line to your clipboard)
- quit
- report view
- find return code
To get rid of some of the forest of unhelpful data
- x all
- find ‘ ‘ 1 20 all
- find ‘+’ 1 2 all
- delete all nx
#SET TRACE(NOCLASS,RACROUTE(ALL))
ColinPaice 