Learn it on Mainframe Path. Do it with MainframeKit.Learn on Mainframe Path ▸
MainframeKit

SAF-RC-8

SAF return code 8: request failedSAF / RACF RETURN CODE

RACF, the SAF router or its exit processed the request and refused it. For an authorization check, access was denied.

MOST LIKELY

The user ID has no or too little access on the resource profile.

FIRST CHECK

Find the ICH408I message for the user ID, resource and access level.

TRY IT ▸

Why was I denied?

What it means

SAF return code 8 means the request was handled and failed. The detail is in the RACF return and reason codes, which sit in the first two words of the RACROUTE parameter list, so a program must read them to say why.

On a denied resource access RACF normally also writes ICH408I to the job log or console.

Typical causes

  • The user ID has no or too little access on the resource profile.
  • The request was invalid (parameter errors give their own RACF reason codes).
  • The job ran under a different user ID than expected.

How to fix it

  1. Find the ICH408I message for the user ID, resource and access level.
  2. Check the program prints the RACF return and reason codes, not only SAF RC.
  3. Ask the security team for the right access through the normal request process.
  4. Check which user ID the job or server really runs under.
  5. Check for a typo in the resource name or class.

Example

Illustrative only; names and values are invented.

RACROUTE REQUEST=AUTH,CLASS='FACILITY',ENTITY=PAY.APP.UPDATE,ATTR=UPDATE
  -> R15 = 8   (access denied; RACF codes in parameter list)
ICH408I USER(USER01  ) GROUP(BATCH   )
  PAY.APP.UPDATE CL(FACILITY)
  INSUFFICIENT ACCESS AUTHORITY