Great to hear Philippe! We have already updated/will soon update some of the documentation issues you pointed out, I will look into adding more language about KEYENCRYPTED.
Original Message:
Sent: Mon August 11, 2025 01:25 PM
From: philippe richard
Subject: MFA 2.3 password reset function fails with AZF2612E
Hi Hrithik .
In fact i just noticed that my command to define the passticket had failed with the following error message
RDEFINE PTKTDATA AZFAPPL SSIGNON(KEYENCRYPTED(0000111122223333))
IRR52251I Cryptographic service CSNBCKI failed with return code 12, reason code
The reason is that in my configuration i do not a crypto express card, and cannot have an AES mater key, so can't use KEYENCRYPTED.
I think you should update the doc to mention this restriction.
I changed the passticket definition to use a masked passticket (KEYMASKED) with:
RDEFINE PTKTDATA AZFAPPL SSIGNON(KEYMASKED(0000111122223333))
and now the password reset function works fine.
Can you also add the message AZF2612E Passticket generatiion failure in the MFA documentation ? and at the same time correct the typo that i mentioned in my second post, just above.
Thank you again very much .
Your suggestion allowed me to see that my passticket had actually not been defined and after reruning the job i found the error message "IRR52251I Cryptographic service CSNBCKI failed with return code 12, reason code"
Have a good day
------------------------------
philippe richard
Original Message:
Sent: Mon August 11, 2025 12:13 PM
From: Hrithik Govardhan
Subject: MFA 2.3 password reset function fails with AZF2612E
Hi Philippe! MFA uses Passtickets as part of the password reset workflow, and the "AZFAPPL " application name is indeed hard-coded. This is documented at https://www.ibm.com/docs/en/zma/2.3.0?topic=customization-resetting-user-password as part of the admin steps needed to implement the password reset functionality.
The error you are seeing corresponds to a passticket generation failure , I will look into adding it to the documentation if its not already there. Can you confirm that the values you plugged into the PERMIT and RDEFINE calls are valid for you system? (AZFSTC is the ID for the started task, etc?)
------------------------------
Hrithik Govardhan
Senior Engineer
Rocket Software
MN
Original Message:
Sent: Fri August 08, 2025 07:47 AM
From: philippe richard
Subject: MFA 2.3 password reset function fails with AZF2612E
i tried to implement password reset function with z/OS MFA 2.3. i have defined the required PTKTDATA profiles; When i lauch the https://server-name:port/html/pwReset.html web page and enter my userid/CERT CTC/new password , i get a failure 'your password was not changed', and in the STC log i see message AZF2612E Passticket generatiion failure. This message is not documented in the MFA 2.3 IBM MFA doc
IBM Z Multi-Factor Authentication
Installation and Customization
IBM
SC27-8447-42
i do have passticket working ok for other uses.
I also do not see any reference in the documentation to the application name AZFAPPL. Is it a hardcoced name ?
The documentation says to define the following profiles (which i did)
RDEFINE PTKTDATA AZFAPPL SSIGNON(KEYENCRYPTED(0011223344556677))
RDEFINE PTKTDATA IRRPTAUTH.AZFAPPL.* OWNER(userid or group-name) .
PERMIT IRRPTAUTH.AZFAPPL.* ACCESS(UPDATE) CLASS(PTKTDATA) ID(AZFSTC)
SETROPTS RACLIST(PTKTDATA) REFRESH
the AZF STC trace level is 3 but i do not see any other error message except AZF2612E.
My MFA level is 2.3.0.1 compiled dec 19 2023
Passticket support AZFPTKT1 is 2.3.0 compiled Nov 30 2023.
Any hint ?
------------------------------
philippe richard
------------------------------