CPF1110: Not authorized to work station

What it means

Every 5250 session runs on a display device, which has a device description object (type *DEVD) in QSYS. Like any object, a device description has authorities. To sign on at a display, a user needs *CHANGE authority to its device description.

Most devices give *PUBLIC *CHANGE, so ordinary users never notice the check. Two situations make it bite. A site may secure certain devices, such as the console or a named device in a secure area, by setting *PUBLIC to *EXCLUDE. More often, the system value QLMTSECOFR is set to 1. Then *PUBLIC authority to a device doesn't count for any user with *ALLOBJ or *SERVICE special authority. Those users need their own explicit authority to the device. That's why security officers and administrators see CPF1110 on a new emulator session while ordinary users sign on fine.

The failure counts as a sign-on attempt that wasn't valid. Repeated tries add toward the QMAXSIGN limit.

Common causes

• QLMTSECOFR is 1 and the user has *ALLOBJ or *SERVICE special authority but no private authority to this device.
• The device description has *PUBLIC *EXCLUDE, and the user hasn't been granted authority to it.
• The emulator connects with a specific device name (a named session) that has been secured, instead of an automatically created QPADEV device.

How to find the problem

1. Note the device name shown in the top right of the sign-on display, or in the emulator's session settings.
2. An administrator can run DSPOBJAUT OBJ(device) OBJTYPE(*DEVD) to see who has authority to it, including *PUBLIC.
3. Check WRKSYSVAL QLMTSECOFR. If it's 1, compare with the user's special authorities from DSPUSRPRF USRPRF(name).
4. Look for CPF1397 or CPF1393 in QSYSOPR if the user kept trying, because these failures count toward the sign-on limit.

How to fix it

• Grant the user authority to the device with GRTOBJAUT OBJ(device) OBJTYPE(*DEVD) USER(name) AUT(*CHANGE). Some sites grant *ALL to their security officers.
• For administrators who sign on from many virtual devices, grant authority to the devices they use, or give them a named device in the emulator that has been authorized.
• Setting QLMTSECOFR to 0 removes the check for powerful users, but IBM recommends keeping it at 1. Make that a security decision, not a quick fix.
• Use a different, authorized display in the meantime.

DSPMSGD MSGID(CPF1110) MSGF(QSYS/QCPFMSG)

Technical reviewer: Albert Joseph, WND Software.

Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s documentation for your IBM i release.