i tried to implement password reset function with z/OS MFA 2.3.  i have defined the required PTKTDATA profiles;  When i lauch the https://server-name:port/html/pwReset.html web page and enter my userid/CERT CTC/new password , i get a failure 'your password was not changed', and in the STC log i see message AZF2612E Passticket generatiion failure. This message is not documented in the MFA 2.3 IBM MFA doc

IBM Z Multi-Factor Authentication
Installation and Customization
IBM
SC27-8447-42

i do have passticket working ok for other uses. 

I also do not see any reference in the documentation  to the application name AZFAPPL. Is it a hardcoced name ?

The documentation says to define the following profiles (which i did)

RDEFINE PTKTDATA AZFAPPL SSIGNON(KEYENCRYPTED(0011223344556677))
RDEFINE PTKTDATA IRRPTAUTH.AZFAPPL.* OWNER(userid or group-name) .
PERMIT IRRPTAUTH.AZFAPPL.* ACCESS(UPDATE) CLASS(PTKTDATA) ID(AZFSTC)
SETROPTS RACLIST(PTKTDATA) REFRESH

the AZF STC trace level is 3 but i do not see any other error message except AZF2612E.

My MFA level is 2.3.0.1 compiled dec 19 2023

Passticket support AZFPTKT1 is 2.3.0 compiled Nov 30 2023.

Any hint ?

------------------------------
philippe richard
------------------------------

in addition i want to bring to your attention  a typo in p223 "Chapter 29. Configuring user-driven fallback". It says 

"3. Enter the following command to set the AZFFALBK registration state for the user to OPEN. (Case is sensitive for OPEN.)
ALU [Login ID] ACTIVE MFA(FACTOR(AZFFALBK)
TAGS(REGSTATE:OPEN))

But in fact the ACTIVE parameter should be inside the MFA segment definition, not outside as it is shown. ACTIVE is not a segment.

It should read:

ALU [Login ID]  MFA(FACTOR(AZFFALBK)
ACTIVE TAGS(REGSTATE:OPEN))

------------------------------
philippe richard
------------------------------

Hi Philippe! MFA uses Passtickets as part of the password reset workflow, and the "AZFAPPL " application name is indeed hard-coded. This is documented at https://www.ibm.com/docs/en/zma/2.3.0?topic=customization-resetting-user-password as part of the admin steps needed to implement the password reset functionality.

The error you are seeing corresponds to a passticket generation failure , I will look into adding it to the documentation if its not already there. Can you confirm that the values you plugged into the PERMIT and RDEFINE calls are valid for you system? (AZFSTC is the ID for the started task, etc?)

------------------------------
Hrithik Govardhan
Senior Engineer
Rocket Software
MN
------------------------------

Hi Hrithik . 

In fact i just noticed that my command to define the passticket had failed with the following error message

------------------------------
philippe richard
------------------------------

Original Message:
Sent: Mon August 11, 2025 12:13 PM
From: Hrithik Govardhan
Subject: MFA 2.3 password reset function fails with AZF2612E

Hi Philippe! MFA uses Passtickets as part of the password reset workflow, and the "AZFAPPL " application name is indeed hard-coded. This is documented at https://www.ibm.com/docs/en/zma/2.3.0?topic=customization-resetting-user-password as part of the admin steps needed to implement the password reset functionality.

The error you are seeing corresponds to a passticket generation failure , I will look into adding it to the documentation if its not already there. Can you confirm that the values you plugged into the PERMIT and RDEFINE calls are valid for you system? (AZFSTC is the ID for the started task, etc?)

------------------------------
Hrithik Govardhan
Senior Engineer
Rocket Software
MN
------------------------------

Great to hear Philippe! We have already updated/will soon update some of the documentation issues you pointed out, I will look into adding more language about KEYENCRYPTED.

------------------------------
Hrithik Govardhan
Senior Engineer
Rocket Software
MN
------------------------------

Original Message:
Sent: Mon August 11, 2025 01:25 PM
From: philippe richard
Subject: MFA 2.3 password reset function fails with AZF2612E

Hi Hrithik . 

In fact i just noticed that my command to define the passticket had failed with the following error message

 RDEFINE PTKTDATA AZFAPPL SSIGNON(KEYENCRYPTED(0000111122223333))              

IRR52251I Cryptographic service CSNBCKI failed with return code 12, reason code

The reason is that in my configuration i do not a crypto express card, and cannot have an AES mater key, so can't use KEYENCRYPTED.

I think you should update the doc to mention this restriction.

I changed the passticket definition to use a masked passticket (KEYMASKED)  with:

 

 RDEFINE PTKTDATA AZFAPPL SSIGNON(KEYMASKED(0000111122223333))  

and now the password reset function works fine.

Can you also add the message AZF2612E Passticket generatiion failure in the MFA documentation ? and at the same time correct the typo that i mentioned in my second post, just above.

Thank you again very much .

Your suggestion allowed me to see that my passticket had actually not been defined and after reruning the job i found the  error message "IRR52251I Cryptographic service CSNBCKI failed with return code 12, reason code"

Have a good day

------------------------------
philippe richard
------------------------------


Original Message:
Sent: Mon August 11, 2025 12:13 PM
From: Hrithik Govardhan
Subject: MFA 2.3 password reset function fails with AZF2612E

Hi Philippe! MFA uses Passtickets as part of the password reset workflow, and the "AZFAPPL " application name is indeed hard-coded. This is documented at https://www.ibm.com/docs/en/zma/2.3.0?topic=customization-resetting-user-password as part of the admin steps needed to implement the password reset functionality.

The error you are seeing corresponds to a passticket generation failure , I will look into adding it to the documentation if its not already there. Can you confirm that the values you plugged into the PERMIT and RDEFINE calls are valid for you system? (AZFSTC is the ID for the started task, etc?)

------------------------------
Hrithik Govardhan
Senior Engineer
Rocket Software
MN