CT-Lib-based clients enabling extended password encryption (CS_SEC_EXTENDED_ENCRYPTION=CS_TRUE) must set CS_SEC_NON_ENCRYPTION_RETRY = CS_TRUE to connect to DirectConnect for z/OS Option. The initial connection attempt using the encrypted password fails, but after you set CS_SEC_NON_ENCRYPTION_RETRY = CS_TRUE, CT-Lib automatically resends the password as plain text.
