What it means
A RACROUTE REQUEST=VERIFY call checks a user ID and password, or a phrase, when a job or session signs on. Two levels of code come back. The SAF return code is in register 15 and says, broadly, whether the request succeeded, was not decided, or failed. The RACF return and reason codes sit in the first two words of the RACROUTE parameter list, and they name the specific cause. A program that checks only register 15 cannot tell a wrong password from an expired one.
SAF 0 means the verify succeeded. SAF 4 means no RACF decision was made, which usually points to RACF not being active, the user not being defined, or the router not calling RACF. SAF 8 means the request failed, and the RACF code tells you which failure. Codes are shown in hexadecimal.
Typical causes
- RACF RC 08: password or phrase not authorized
- RACF RC 0C: password or phrase has expired
- RACF RC 1C: user access has been revoked
- SAF RC 4, reason 00: RACF was not called (not installed, skipped by the router table, or DECOUPL=YES with a RELEASE higher than this z/OS supports)
- SAF RC 4, reason 04: user ID not defined to RACF
- SAF RC 4, reason 20: RACF is not active
- SAF RC 4, reason 58: RJE or NJE operator has no FACILITY class profile
- SAF RC 0 with RACF RC 04: verify token information problem (reason 0C TOKNIN length too large, 10 STOKEN length too large)
- RACF RC 04: user ID not defined to RACF
- RACF RC 10: new password or phrase not accepted (invalid, mixed with the wrong kind of current credential, PassTicket without the needed PWCHANGE permission, or changed before the minimum interval)
- RACF RC 14: user not defined to the group
- RACF RC 18: failed by an installation exit
- RACF RC 24: user access to the group has been revoked
- RACF RC 28: operator ID card required but not supplied
- RACF RC 2C: operator ID card not valid for this user
- RACF RC 30: not allowed at this port (reason 00 no access, 04 wrong day or time, 08 port closed at this time)
- RACF RC 34: user not authorized to this application
- RACF RC 38: security label check failed (04 label required but none given, 08 not authorized to the label, 0C dominance check failed in multilevel-secure mode, 10 labels disjoint, 14 client and server labels not equivalent)
- RACF RC 44: a default token was passed in as input
- RACF RC 48: unprivileged user verified while the system was in the tranquil (MLQUIET) state
- RACF RC 4C: node check failed for a network job (reasons 00 to 14)
- RACF RC 50: surrogate submit failed (reasons 04 SURROGAT inactive, 08 not permitted, 0C label not allowed)
- RACF RC 54: JESJOBS check failed
- RACF RC 5C: error reading the RACF database (reason holds the RACF manager return code)
- RACF RC 68: multi-factor authentication request failed
- RACF RC 6C: identity token (IDT) validation failed; the caller should sign on again
- RACF RC 70: identity token generation failed
- RACF RC 74: multi-factor authentication not completed, more information needed (only when IDTA is given and the IDTDATA class is active; otherwise 8/8/0 comes back)
- SAF RC 64: RELEASE keyword mismatch between execute and list forms; macro stops
How to fix it
- Read the RACF return and reason codes from the parameter list, not only register 15.
- Match the code with the IRR message in the job log or console, such as IRR013I for a bad password or IRR014I for an expired one.
- Ask the RACF security administrator to review the user ID through the normal process.
- Do not retry a password repeatedly; too many failures can revoke the user ID.
- For identity token (IDT) and multi-factor (MFA) codes, check with the application owner, since the fix is usually in the application or its setup.
Example
Illustrative only; names and values are invented.
Illustrative only, with an invented user ID:
program checks sign-on: SAF RC=8 (R15=8)
RACF RC=0C (password or phrase has expired) for user ID USER07
IRR014I VERIFICATION FAILED. EXPIRED PASSWORD GIVEN.