Open a ticket with IBM. The APAR number to reference for AIX 7.1 is IJ29552s7a and for AIX 7.2 it is IJ29730s1a.
Switch over to PAM authentication from LAM authentication.
How to enable AIX to authenticate users via PAM instead of LAM
**The below recommendations are directed at customers using both LAM and Mapped User Mode**
The new AIX OS update needs to have the VASMU setting explicitly set. That's set in /etc/methods.cfg, with the authonly flag.
That can be set per person, with the command:
chsec -f /etc/security/user -a SYSTEM=VASMU -s <username>
Or vastool / vasd can set it for all user's in the mapped user file if this setting is disabled:
/opt/quest/bin/vastool configure vas vas_auth mapped-user-directory-auth-optional
Then the mapping re-applied with: