CPF22E2: Password not correct for user profile

What it means

CPF1107 is what a person sees on the sign-on display. CPF22E2 is the matching message from the programming side. The Get Profile Handle API (QSYGETPH) and related security APIs verify a user ID and password before a program or server job switches to that user. When the password is wrong, the API ends with CPF22E2.

Each failure raises the profile's count of password attempts that weren't valid, just like a failed sign-on. When the count reaches QMAXSIGN, the system acts on QMAXSGNACN and may disable the profile. A successful check resets the count to zero.

On IBM i 7.5 IBM made the APIs return CPF22E2 for an unknown user ID as well, when both a user ID and password are supplied. Earlier releases returned CPF2204 or CPF9801 for a missing profile. So on current systems CPF22E2 means "this user ID and password don't work together", not always "wrong password".

Common causes

• A user typed the wrong password into a PC client, web application or other program that signs on through the APIs.
• A saved password in a data source, script, file transfer job or application configuration is out of date after a password change.
• Passwords are case-sensitive at QPWDLVL 2 or 3, and the client sends a different case.
• On IBM i 7.5, the user ID itself is wrong or the profile doesn't exist on this system.
• A program builds the password parameter incorrectly, for example with the wrong length or CCSID.

How to find the problem

1. If your own program called the API, look in its job log with DSPJOBLOG. The message names the profile.
2. Run DSPUSRPRF USRPRF(name) and check Sign-on attempts not valid. A rising count with no interactive failures points to a client retrying.
3. If *AUTFAIL auditing is on, QAUDJRN PW entries show each failure and the job or address it came from.
4. Watch QSYSOPR and QSYSMSG for CPF1393, which means the failures disabled the profile.

How to fix it

• Correct the password in the client or configuration that is failing. Then test once before re-enabling anything.
• If the user has forgotten the password, reset it with CHGUSRPRF USRPRF(name) PASSWORD(temp) PWDEXP(*YES) and have them sign on interactively to set a new one.
• If the profile was disabled by the failures, enable it with CHGUSRPRF USRPRF(name) STATUS(*ENABLED) after fixing the client.
• In your own code, check the password length and CCSID parameters you pass to QSYGETPH, and handle CPF22E2 as a normal failure rather than a crash.

DSPMSGD MSGID(CPF22E2) MSGF(QSYS/QCPFMSG)

Technical reviewer: Albert Joseph, WND Software.

Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s documentation for your IBM i release.