IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  MFA 2.3 password reset function fails with AZF2612E

    Posted 11 days ago

    i tried to implement password reset function with z/OS MFA 2.3.  i have defined the required PTKTDATA profiles;  When i lauch the https://server-name:port/html/pwReset.html web page and enter my userid/CERT CTC/new password , i get a failure 'your password was not changed', and in the STC log i see message AZF2612E Passticket generatiion failure. This message is not documented in the MFA 2.3 IBM MFA doc

    IBM Z Multi-Factor Authentication
    Installation and Customization
    IBM
    SC27-8447-42

    i do have passticket working ok for other uses. 

    I also do not see any reference in the documentation  to the application name AZFAPPL. Is it a hardcoced name ?

    The documentation says to define the following profiles (which i did)

    RDEFINE PTKTDATA AZFAPPL SSIGNON(KEYENCRYPTED(0011223344556677))
    RDEFINE PTKTDATA IRRPTAUTH.AZFAPPL.* OWNER(userid or group-name) .
    PERMIT IRRPTAUTH.AZFAPPL.* ACCESS(UPDATE) CLASS(PTKTDATA) ID(AZFSTC)
    SETROPTS RACLIST(PTKTDATA) REFRESH

    the AZF STC trace level is 3 but i do not see any other error message except AZF2612E.

    My MFA level is 2.3.0.1 compiled dec 19 2023

    Passticket support AZFPTKT1 is 2.3.0 compiled Nov 30 2023.

    Any hint ?



    ------------------------------
    philippe richard
    ------------------------------


  • 2.  RE: MFA 2.3 password reset function fails with AZF2612E

    Posted 10 days ago

    in addition i want to bring to your attention  a typo in p223 "Chapter 29. Configuring user-driven fallback". It says 

    "3. Enter the following command to set the AZFFALBK registration state for the user to OPEN. (Case is sensitive for OPEN.)
    ALU [Login ID] ACTIVE MFA(FACTOR(AZFFALBK)
    TAGS(REGSTATE:OPEN))

    But in fact the ACTIVE parameter should be inside the MFA segment definition, not outside as it is shown. ACTIVE is not a segment.

    It should read:

    ALU [Login ID]  MFA(FACTOR(AZFFALBK)
    ACTIVE TAGS(REGSTATE:OPEN))



    ------------------------------
    philippe richard
    ------------------------------



  • 3.  RE: MFA 2.3 password reset function fails with AZF2612E

    Posted 8 days ago

    Hi Philippe! MFA uses Passtickets as part of the password reset workflow, and the "AZFAPPL " application name is indeed hard-coded. This is documented at https://www.ibm.com/docs/en/zma/2.3.0?topic=customization-resetting-user-password as part of the admin steps needed to implement the password reset functionality.

    The error you are seeing corresponds to a passticket generation failure , I will look into adding it to the documentation if its not already there. Can you confirm that the values you plugged into the PERMIT and RDEFINE calls are valid for you system? (AZFSTC is the ID for the started task, etc?)



    ------------------------------
    Hrithik Govardhan
    Senior Engineer
    Rocket Software
    MN
    ------------------------------



  • 4.  RE: MFA 2.3 password reset function fails with AZF2612E

    Posted 8 days ago

    Hi Hrithik . 

    In fact i just noticed that my command to define the passticket had failed with the following error message

     RDEFINE PTKTDATA AZFAPPL SSIGNON(KEYENCRYPTED(0000111122223333))              
    IRR52251I Cryptographic service CSNBCKI failed with return code 12, reason code
    The reason is that in my configuration i do not a crypto express card, and cannot have an AES mater key, so can't use KEYENCRYPTED.
    I think you should update the doc to mention this restriction.
    I changed the passticket definition to use a masked passticket (KEYMASKED)  with:
     
     RDEFINE PTKTDATA AZFAPPL SSIGNON(KEYMASKED(0000111122223333))  
    and now the password reset function works fine.
    Can you also add the message AZF2612E Passticket generatiion failure in the MFA documentation ? and at the same time correct the typo that i mentioned in my second post, just above.
    Thank you again very much .
    Your suggestion allowed me to see that my passticket had actually not been defined and after reruning the job i found the  error message "IRR52251I Cryptographic service CSNBCKI failed with return code 12, reason code"
    Have a good day


    ------------------------------
    philippe richard
    ------------------------------



  • 5.  RE: MFA 2.3 password reset function fails with AZF2612E

    Posted 8 days ago

    Great to hear Philippe! We have already updated/will soon update some of the documentation issues you pointed out, I will look into adding more language about KEYENCRYPTED.



    ------------------------------
    Hrithik Govardhan
    Senior Engineer
    Rocket Software
    MN
    ------------------------------