Hello,

Recently we have notice a incorrect situation for MFA user reports :

select class=user s=base

sortlist key mfa_factor_tag_value factor_active

for two or more factors it gives the factor_active values one by another in column - not in correct row - "retain" does not work.

USER AZFCERT1 REGSTATE APPROVED Yes

          AZFCERT1 SUBJECT CN=user   No.    <<<< why 'No' here ?

         .....

        AZFMETAS             POLFAILCT   0          <<<< I would expect 'No' on this row ?

        ............

Could you advice how to have the right for mfa factor list with right info which is active and which no...

Thank you.

Hi Slawomir,

In general repeated fields are not related to each other, but the various values in each particular field are listed one per line.
There is a "repeat group" concept for fields that are grouped, either directly in the RACF database, or as generated in CARLa.
Mixing fields from different repeat groups as if they were in the same repeat group almost never works.

For fields in the RACF database, you can look at the TEMPLATE report to see which belong together.
For example,
                  RACF template definitions                    Line 502 of 1658 
 Command ===> _________________________________________________ Scroll===> CSR  
                                                 17 Jun 2026 23:45              
    Complex  Timestamp         Template Custom                                  
    NMPIPL87 17 Jun 2026 23:45      601   1057                                  
    Entity   Segment  Field     Id Alias-of Group     Bytes Dflt Format   Outlen
 __ USER     BASE     FACTORN  110                        4 00   Num           2
 __ USER     BASE     FACTOR   111          FACTORN  Varies 00   Char         20
 __ USER     BASE     FACACDT  112          FACTORN       8 FF   Hex          16
 __ USER     BASE     FACTAGS  113          FACTORN  Varies 00   Char         72

This is a repeat group in the RACF database where FACTORN has the number of entries.
Note that FACTAGS has information on multiple tags in one entry.

FACTOR_ACTIVE is an interpretation of FACACDT and thus has the same multiplicity (one value per factor).

MFA_FACTOR_TAG_VALUE on the other hand has one value per factor/tag combination, so has a different multiplicity.
So printing those values next to each other generally means that they will not line up.

Note that the MFA_TAG_* fields are documented to be a repeat group, even one that can be FLATTENed. (That is, the separate values in each repeat group entry can be split into independent records.) 
Unfortunately, this group does not show the factor-active setting.

If all you want is to see which factors are active, then you can use FACTOR instead of MFA_FACTOR_TAG_VALUE next to FACTOR_ACTIVE.

Regards,

------------------------------
Jeroen Tiggelman
IBM - Software Development Manager IBM zSecure
Delft
------------------------------

Hi Jeroen,

OK, thank you.

Hi Slawomir,
on top of what Jeroen wrote, you can also use summaries on the userid and factor name level to keep things together.
That does not give you nice single lines with everything repeated, but will be easy to read or process.

newlist type=racf                                                   
 select class=user segment=base factorn>0                            
 sortlist mfa_factor_tag_value                                       
 summary key('UserId',8) count(nd) * mfa_factor_active_date count(nd)

Hi Roland,

Thank you for help - unfortunately we have still 3.1 - seems ' mfa_factor_active_date' is a part of 3.2 - I will check as soon as we'll get it.

newlist type=racf                                                    select class=user segment=base factorn>0                             sortlist mfa_factor_tag_value                                        summary key('UserId',8) count(nd) * mfa_factor_active_date count(nd)