N96011 LOGON FAILED FOR USER=xxxxxxxx following z/os 1.13 to 2.2 upgrade

Document ID : KB000072662
Last Modified Date : 08/03/2018
Show Technical Document Details
Issue:
Following a z/OS 1.13 to 2.2 upgrade, all NMBCI logons fail as following:

+BCILOGON SOLVZOSD
=N96011 LOGON FAILED FOR USER=xxxxxxxx

Message in SYSLOG :

ICH408I USER(xxxxxxxx) GROUP(SYS ) NAME(Batch SOLVE  user)
 LOGON/JOB INITIATION - INVALID PASSWORD ENTERED AT TERMINAL SBCID001
 IRR013I VERIFICATION FAILED. INVALID PASSWORD GIVEN.

The RACF database is shared with the production LPAR running z/OS 1.13
 
Cause:
Unable to execute NMBCI

The error N96011 has the following cause:
       The userid and/or password are not known to the SOLVE system identified by the applid in the BCILOGON command.

Possible explanations are:
       - incorrect (or expired password),
       - incorrect userid, or not added to SOLVE
       - wrong applid/userid combination.
 
       This message is also produced after message N96016 PASSWORD HAS EXPIRED AND MUST BE CHANGED.


 
Resolution:
Access Solve or Netmaster from a 3270 terminal to set manually a new password for this user before the BCI can be invoked.
 
Additional Information:
IBM APAR OA49109:
Z/OS V2R2 MIGRATION GUIDE MISSING RACF ACTIONS FOR DEFAULT PASSWORD AND ICHDEX01 EXIT CHANGES".

Exerpt from the text of the APAR :

For a customer that never implemented a new ICHDEX01, unchanged passwords are still masked. In z/OS 2.2, password evaluation
without the exit will ONLY attempt DES. This means users with these very old passwords will no longer be able to logon.