z/VSE 6.2 CICS/TS 2.2 CA Top Secret not initiated

Document ID : KB000100646
Last Modified Date : 12/06/2018
Show Technical Document Details
Introduction:
Running z/VSE 6.2 and CICS/TS 2.2 with all compatibility ptfs applied.
When CICS starts up, it looks like Top Secret is not hooking in and it's falling back to VSE security :
 
F2 0109 DFHXS1100I DEVICCF Security initialization has started.F2 0109 DFHWB0109I DEVICCF Web domain initialization has started. 
F2 0109 DFHSO0100I DEVICCF Sockets domain initialization has started. 
F2 0109 DFHDH0100I DEVICCF Document domain initialization has started. 
F2 0109 DFHSI1500 DEVICCF CICS startup is in progress for CICS Transaction 
Server Version 2.2.0 
F2 0109 DFHXS1105 DEVICCF Resource profiles for class TCICSTRN have been 
built. 
F2 0109 DFHXS1103I DEVICCF Default security for userid DFLTTEST has been 
established. 
F2 0109 DFHUS0070 DEVICCF 
Security check for CICS region userid (DEVICCF) has failed. SAF codes 
are (X'00000008',X'00000000'). ESM codes are 
(X'0000001C',X'00000000'). USAD reason code is (41). 
F2 0109 DFHME0116 DEVICCF 
(Module:DFHMEME) CICS symptom string for message DFHUS0070 is 
PIDS/564805400 LVLS/430 MS/DFHUS0070 RIDS/DFHUSDM PTFS/zVSE430. (Module:DFHMEME) CICS symptom string for message DFHUS0070 is 
PIDS/564805400 LVLS/430 MS/DFHUS0070 RIDS/DFHUSDM PTFS/zVSE43 
F2 0109 DFHDM0105 DEVICCF Unsuccessful initialization of DFHUS dom 
will terminate. 
F2 0109 DFHME0116 DEVICCF 
(Module:DFHMEME) CICS symptom string for message DFHDM0105 is 
PIDS/564805400 LVLS/430 MS/DFHDM0105 RIDS/DFHDMDS PTFS/zVSE43 
PCSS/DFHUS. 
F2 0002 DFHKE1800 DEVICCF ABNORMAL TERMINATION OF CICS IS COMPLETE.  
Question:
On z/VSE 6.2 with CICS/TS 2.2, I never see these TSS messages at startup time:

F2 0002 DFHPA1101 DEVICCF DFHSITIC IS BEING LOADED.
F2 0002 TSS6093I - TSS/CICS Initialization Phase 0 started.
F2 0002 TSS6094I - TSS/CICS Initialization Phase 0 complete.
F2 0002 DFHPA1108 DEVICCF DFHSITIC HAS BEEN LOADED. (GENERATED AT: MM/DD=
03/06 HH:MM= 11:37).

 
What is missing ? 
Answer:
The phase 0 messages are issued by phase CAKSCINT, which belongs to the ESI/VSE component. ESI is delivered with CA Top Secret, so the phase should be in the CA Top Secret library. CAKSCINT is called from CASECPRM which belongs to the ENF/VSE component. ENF is delivered with CA CIS for VSE so should be in the library where CA CIS for VSE is installed. 

When CASAUTIL runs during IPL do you start all products automatically (UPSI 00) or do you have a START command for each component? If the latter, make sure you also start ENF/VSE and ESI/VSE. 

To check the components are correctly started during IPL enter the
CA?
command on the console, and check if you see the following entries: 

CA ESI/VSE 1.0 09 0610 B6N 
CA ENF/VSE 1.0 12 0801 B6O