IKJ56421I: Password not authorized

What it means

When you log on, TSO passes your user ID and password to the security system, usually RACF. RACF compares the password with the one stored for that ID. If they don't match, TSO shows IKJ56421I and doesn't start the session. RACF also writes an ICH408I message to the system log with the words INVALID PASSWORD ENTERED AT TERMINAL, which tells the security team where the attempt came from.

RACF counts failed attempts in a row. When the count reaches a limit your site sets, RACF revokes the ID. From then on nobody can log on with it, even with the right password, until a security administrator resumes it. A successful logon resets the count to zero.

The I at the end of the message number stands for informational. TSO isn't waiting for a reply. It's telling you the attempt failed.

Common causes

• A typing mistake. The password field doesn't show what you type, so a slip is easy to miss.
• Caps Lock or the wrong case. RACF passwords ignore case unless your site has turned on mixed-case passwords. If it has, case matters.
• You recently changed the password on a different system. Many sites have more than one RACF database, and a change on one doesn't always reach the others.
• You used another password, such as your Windows one. The mainframe password is usually separate unless your site has linked them.
• A temporary password from the help desk was mistyped, or has already been used and replaced.
• The password contains a character such as #, @ or $ and the emulator's host code page doesn't match the mainframe's. The key you press is then sent as a different character.

How to find the problem

1. Check that the user ID in the message is yours. A mistyped ID with your own password fails the same way.
2. Count your attempts. After two failures, stop and call the help desk instead of guessing. One more wrong guess may revoke the ID.
3. The help desk or a security administrator can run LISTUSER PAYU07. The output shows whether the ID is revoked, when the password was last changed (PASSDATE), how often it must change (PASS-INTERVAL) and the last successful logon (LAST-ACCESS).
4. The administrator can also search the system log (SYSLOG) for ICH408I messages naming the ID. INVALID PASSWORD ENTERED AT TERMINAL lines show each bad attempt and the terminal name. A line saying REVOKED USER ACCESS ATTEMPT means the ID is already revoked.
5. If you can't explain the failed attempts, tell the security team. Someone else may be trying your ID.

How to fix it

• Retype the password slowly. Check Caps Lock and check that you're logging on to the system you meant.
• If you've forgotten the password or the ID is revoked, call the help desk. The administrator resets it with a command such as ALTUSER PAYU07 PASSWORD(xxxxxxxx) RESUME. The new password is set as expired, so TSO asks you to choose your own at the next logon.
• Pick a new password that meets your site's rules. Standard RACF passwords are one to eight characters, and your site may require digits or forbid reusing recent ones.
• If a special character in your password never works, ask your desktop support team to check the host code page in your emulator, or choose a password without national characters.

What it looks like

IKJ56421I PASSWORD NOT AUTHORIZED FOR USERID PAYU07

ICH408I USER(PAYU07  ) GROUP(PAYCLRK ) NAME(PAY CLERK SEVEN     )
  LOGON/JOB INITIATION - INVALID PASSWORD ENTERED AT TERMINAL TCP00417

Last reviewed 2026-10-12 by the WND Software team. Written in our own words. For the full reference, check IBM’s documentation for your z/OS, CICS or Db2 release.