Single Sign-On May Not Work After User Changes Windows NT Password

ID: Q237573

The information in this article applies to:

Microsoft SNA Server, versions 3.0, 3.0 SP1, 3.0 SP2, 3.0 SP3, 3.0 SP4, 4.0, 4.0 SP1, 4.0 SP2

SYMPTOMS

An environment that successfully uses SNA Server Host Security features to allow Single Sign-On (SSO) to a host may start experiencing a problem where the APPC or 3270 Application does not work. This is caused by a security violation because an invalid password is being sent to the host system.

An APPC application, such as COM Transaction Integrator for CICS and IMS (COMTI), may receive the following return codes after issuing an ALLOCATE to establish a conversation with the host when this problem occurs:

Primary Return Code = 0003 (AP_ALLOCATION_ERROR)
Secondary Return Code = 080F6051 (AP_SECURITY_NOT_VALID)

Sample Scenario

The host application (for example, COMTI) successfully connects to the host using current user credentials that are cached in the Host Account Database.
The user changes his or her Windows NT password.
The host account password for this user is also changed to match the new Windows NT password.
The host application does not connect to the host because the previous Windows NT password is passed to the host because the Host Account Cache does not get updated to reflect the new password.

CAUSE

The password change DLL (Snapwchg.dll) does not make any additional attempts to connect to the Windows NT Password Synchronization Service (SNAPMP) if its first attempt to connect to the SNAPMP service doesn't work. The first attempt of the password change DLL to connect to the SNAPMP service occurs after it intercepts the first password change notification since the DLL was initialized.

When this occurs, the Host Account Cache is not updated with the new passwords; therefore, the passwords passed to the host when the SNA application starts are the user's previous Windows NT passwords. If the previous passwords are no longer valid on the host, security errors are returned to the application.

RESOLUTION

A supported fix that corrects this problem is now available from Microsoft, but it has not been fully regression tested and should be applied only to systems experiencing this specific problem. If you are not severely affected by this specific problem, Microsoft recommends that you wait for the next Microsoft SNA Server version 4.0 service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web:

http://www.microsoft.com/support/supportnet/overview/overview.asp

The English version of this fix should have the following file attributes or later:

File name	Date	Time
Snapwchg.dll	xx/xx/xx	xx:xx
Snahsmsg.dll	xx/xx/xx	xx:xx

NOTE: Date and time information will be provided as soon as it becomes available.

NOTE: Because of file dependencies, the most recent fix that contains the above files may also contain additional files.

NOTE: If this product was already installed on your computer when you purchased it from the Original Equipment Manufacturer (OEM) and you need this fix, please call the Pay Per Incident number listed on the above Web site. If you contact Microsoft to obtain this fix, and if it is determined that you only require the fix you requested, no fee will be charged. However, if you request additional technical support, and if your no-charge technical support period has expired, or if you are not eligible for standard no-charge technical support, you may be charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the following article in the Microsoft Knowledge Base:

Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS

Microsoft has confirmed this to be a problem in the Microsoft products listed at the beginning of this article.

MORE INFORMATION

The password change DLL has been updated to include a retry mechanism in those cases where it is unable to connect to the SNAPMP service after receiving the first password change notification.

The password change DLL has also been updated to implement a retry mechanism in those instances where it loses an existing connection to the SNAPMP service. For additional information about this particular issue, please see the following article in the Microsoft Knowledge Base:

Q236135 Password Change Lost if Password Change DLL Can't Contact SNAPMP

For additional information about SNA Server Host Security Architecture, please see the following article in the Microsoft Knowledge Base:

Q175063 Host Security Integration Setup and Architectural Overview

Additional query words:


Keywords          : sna3 sna3sp1 sna3sp2 sna3sp3 sna3sp4 sna4 sna4sp1 sna4sp2 
Version           : WINDOWS:3.0,3.0 SP1,3.0 SP2,3.0 SP3,3.0 SP4,4.0,4.0 SP1,4.0 SP2
Platform          : WINDOWS 
Issue type        : kbbug

Last Reviewed: July 20, 1999