DDM SECCHK failed with bad SECCHKCD

OK, I'm mostly posting this for archival purposes. The error is very obscure, difficult to diagnose, and the resolution was not at all obvious.

I had a customer that was getting this exception in a class that was trying to retrieve the record layouts from physical files on the host. The java code was running on the i and the files were local.

com.ibm.as400.access.ServerStartupException: Unable to establish a connection.
at com.ibm.as400.access.ClassDecoupler.connectDDMPhase2(ClassDecoupler.java:105)
at com.ibm.as400.access.AS400ImplRemote.getConnection(AS400ImplRemote.java:1028)
at com.ibm.as400.access.AS400FileImplRemote.connect(AS400FileImplRemote.java:178)
at com.ibm.as400.access.AS400FileImplRemote.execute(AS400FileImplRemote.java:524)
at com.ibm.as400.access.AS400FileRecordDescriptionImplRemote.retrieveRecordFormat(AS400FileRecordDescriptionImplRemote.java:1191)
at com.ibm.as400.access.AS400FileRecordDescription.retrieveRecordFormat(AS400FileRecordDescription.java:488)

They had no user exit programs in place that might be blocking the connection and no firewall rules in place (it was a localhost connection). The program had worked fine before without any major changes to the systems (OS versions or PTF applications).

Previous connections to other servers on the host worked fine.

I enabled JT400 trace and we saw this error: DDM SECCHK failed with bad SECCHKCD

Googling did not turn up a lot of useful information, although I did find references to SECCHKCD.

After staring at things for a while we noticed that the CURLIB attribute on the user profile, that we use to connect to the host servers, was referencing a library that no longer exists.

We changed the CURLIB attribute to a library that DID exist and the connection was able to be established.

The user profile was supposed to have *CRTDFT as the CURLIB, but someone must have changed it.

david