Hope this helps: From the IBM manual on RACF:
[https://www.ibm.com/docs/en/zos/2.1.0?topic=data-tape-protection-bypass-label-processing-blp
]
Tape data protection and bypass label processing (BLP)
z/OS Security Server RACF System Programmer's Guide
SA23-2287-00
You can use RACF® to control the use of bypass label processing
(BLP). If an installation specifies BLP at system generation or
JES initialization, and the user specifies BLP on the LABEL
parameter of the DD statement or on the dynamic allocation text
unit, RACF issues a RACROUTE REQUEST=AUTH to the FACILITY class,
resource ICHBLP, to determine if the user's BLP request can be
honored. To activate this additional RACF protection,
installations must do the following:
* Define the profile ICHBLP to RACF using the RDEFINE command
* Activate the TAPEVOL class (it is not necessary to define
tape volumes to the TAPEVOL class).
An installation can add users or groups or both to the profile
access list using the PERMIT command.
If BLP is specified on the LABEL parameter and the system does
not support BLP, the tape is treated as a nonlabeled (NL) tape.
Regards,
Steve Thompson
On 1/30/2026 10:59 AM, Jousma, David wrote:
Since you are coding BLP, you might try coding a DSN= on the DD that you know
you have access to. You are failing on dataset class.
_______________________________
Dave Jousma
Vice President | Director, Platform Engineering
Fifth Third Bank | 1830 East Paris Ave, SE | Grand Rapids, MI 49546
From: IBM Mainframe Discussion List <[email protected]> on behalf of Jason Cai
<[email protected]>
Date: Thursday, January 29, 2026 at 5:01 AM
To: [email protected] <[email protected]>
Subject: DITTO EVL fails with IEC150I 913-38
CAUTION EXTERNAL EMAIL
This message came from outside your organization.
DO NOT open attachments or click on links from unknown senders or unexpected
emails.
Report
Suspicious<https://us-phishalarm-ewt.proofpoint.com/EWT/v1/MwwqYLOC6b6whF7V!rNOK-X4IriChcYQZTBgOt2Q1PCS_d6w2d7ezcCVx5l3_CwnlM0NFo8AfG9gaNaqrMLtC5wRYp133ODXlVmMugvwqs58kJAvrZ1J_opCbUK9WQg$>
Hi everyone,
I am attempting to use DITTO to inspect a tape volume (J53277) using
LABEL=(,BLP).
The job fails with a 913-38 security violation, and RACF reports "INSUFFICIENT
ACCESS AUTHORITY" for the specific volume.
My JCL:
//EVL JOB (ACCT),'ESV LIST'
//DITEVL EXEC PGM=DITTO
//STEPLIB DD DSN=YOUR.DITTO.LOADLIB,DISP=SHR
//SYSPRINT DD SYSOUT=*
//TAPE DD UNIT=3590L,VOL=SER=J53277,DISP=SHR,LABEL=(,BLP)
//SYSIN DD *
$$DITTO EVL INPUT=TAPE,LABEL=BLP
$$DITTO EOJ
The Error Output:
ICH408I USER(PRDSUP2 ) GROUP(#USER) NAME(HEZIXIAN171103 ) 714
SYS26029.T164804.RA000.DITTO2.R0127153 CL(DATASET ) VOL(J53277)
INSUFFICIENT ACCESS AUTHORITY
ACCESS INTENT(READ ) ACCESS ALLOWED(NONE )
IEC518I SOFTWARE ERRSTAT: RACFPROT D114,J53277,,DITTO2,DITTO1
IEC150I 913-38, IFG0194F,DITTO2,DITTO1,TAPI1,D114,, 717
My Question:
Q1 How to solve this issue？
Q2 Why is there no profile for **CL(DATASET)**, but **VOL(J53277)** is shown?
How do I define a profile for this class?
Any suggestions are highly appreciated.
Jason Cai
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
This e-mail transmission contains information that is confidential and may be
privileged. It is intended only for the addressee(s) named above. If you
receive this e-mail in error, please do not read, copy or disseminate it in any
manner. If you are not the intended recipient, any disclosure, copying,
distribution or use of the contents of this information is prohibited. Please
reply to the message immediately by informing the sender that the message was
misdirected. After replying, please erase it from your computer system. Your
assistance in correcting this error is appreciated.
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
