| Author |
Message
|
| kirani |
 Posted: Thu Jun 27, 2002 2:53 pm Post subject: |
 |
|
Jedi Knight
Joined: 05 Sep 2001
Posts: 3779
Location: Torrance, CA, USA
|
All,
Here are the authorisations for user-id's casswmqi and ci64 on Transmission queue (AH1_TNL11) on my local queue manager (MQSI).
| Code: |
C:\>dspmqaut -n AH1_TNL11 -t q -p casswmqi
Entity casswmqi has the following authorizations for object AH1_TNL11:
get
browse
put
inq
set
crt
dlt
chg
dsp
passid
passall
setid
setall
clr
C:\>dspmqaut -n AH1_TNL11 -t q -p ci64
Entity ci64 has the following authorizations for object AH1_TNL11:
get
browse
put
inq
set
crt
dlt
chg
dsp
passid
passall
setid
setall
clr
|
Everything looks ok to me here. 
Thanks.
_________________
Kiran
IBM Cert. Solution Designer & System Administrator - WBIMB V5
IBM Cert. Solutions Expert - WMQI
IBM Cert. Specialist - WMQI, MQSeries
IBM Cert. Developer - MQSeries
|
|
| Back to top |
|
 |
| nimconsult |
| Posted: Thu Jun 27, 2002 11:13 pm Post subject: |
|
|
Master
Joined: 22 May 2002
Posts: 268
Location: NIMCONSULT - Belgium
|
Kiran,
Can you try this and posts the result of your test:
"How to check this? Connect on QM MQSI (with the API exerciser for example) and post a message to KI.REPORT using the principal of the application. "
Thanks,
_________________
Nicolas Maréchal
Senior Architect - Partner
NIMCONSULT Software Architecture Services (Belgium)
http://www.nimconsult.be |
|
| Back to top |
|
|
| mqonnet |
| Posted: Fri Jun 28, 2002 5:06 am Post subject: |
|
|
Grand Master
Joined: 18 Feb 2002
Posts: 1114
Location: Boston, Ma, Usa.
|
Kiran, your authorizations look fine. But as i have been repeatedly pointing out, is "casswmqi" having a principal on qmgr ANH1_TNL11. Please post the output of dspmqaut for the userid "casswmqi" on this qmgr. Unless you have appropriate authorities for this userid on this qmgr, the MQSI qmgr cannot put msgs to KI.REPORT.
The authorities at MQSI qmgr might not have anything to do in this particular scenario.
Cheers.
Kumar
_________________
IBM Certified WebSphere MQ V5.3 Developer
IBM Certified WebSphere MQ V5.3 Solution Designer
IBM Certified WebSphere MQ V5.3 System Administrator |
|
| Back to top |
|
|
| kirani |
| Posted: Fri Jun 28, 2002 7:38 am Post subject: |
|
|
Jedi Knight
Joined: 05 Sep 2001
Posts: 3779
Location: Torrance, CA, USA
|
Nicolas,
There is no such queue KI.REPORT on queue manager MQSI. So I can not use API exerciser to put message on it. I understanding is queue manager will put report message directly on transmission queue (AH1_TNL11) of MQSI queue manager with appropriate transmission header. Then the message will be delivered to KI.REPORT queue on AH1_TNL11. is that correct?
Kumar,
user-id casswmqi is WMQI service user-id on AH1_TNL11 box, what this means is, casswmqi is in MQM group and has authorizations to do everything with MQobjects. I am 100% sure the authorizations will be similar to above (in my earlier post). I don't have access to the server, so I cannot run dspmqaut command on it.
Thanks.
_________________
Kiran
IBM Cert. Solution Designer & System Administrator - WBIMB V5
IBM Cert. Solutions Expert - WMQI
IBM Cert. Specialist - WMQI, MQSeries
IBM Cert. Developer - MQSeries
|
|
| Back to top |
|
|
| mqonnet |
| Posted: Fri Jun 28, 2002 7:46 am Post subject: |
|
|
Grand Master
Joined: 18 Feb 2002
Posts: 1114
Location: Boston, Ma, Usa.
|
Well. It sure looks like somethin's wrong with the userid "casswmqi" on AH1_TNL11. Since you dont have access/rights to run "dspmqaut", i would suggest what Nicolas suggested. Try running amqsput to put message onto a remote queue on MQSI qm pointing to KI.REPORT(local queue) on AN1_TNL11. You MUST use "casswmqi" userid. To be more sure of the userid, i would suggest, you stopping the SDR channel on MQSI so that the message put to remote queue waits on the TQ. Read the message to see if the userid is appropriate. Then start the sdr and see if the message goes over to the appropriate queue.
The other test to run is, try running a client to put a message onto this queue KI.REPORT, using "casswmqi" to see if you are able to put message.
This would clarify if this userid has the appropriate authorities on AN1_TN11.
Cheers.
Kumar
_________________
IBM Certified WebSphere MQ V5.3 Developer
IBM Certified WebSphere MQ V5.3 Solution Designer
IBM Certified WebSphere MQ V5.3 System Administrator |
|
| Back to top |
|
|
| kirani |
| Posted: Fri Jun 28, 2002 10:49 am Post subject: |
|
|
Jedi Knight
Joined: 05 Sep 2001
Posts: 3779
Location: Torrance, CA, USA
|
Kumar,
I was able to put a message with casswmqi user-id on some remote queue on MQSI queue manager using amqsput. This remote queue points to KI.REPORT on AH1_TNL11. I verified the message and it shows casswmqi in MQMD field on AH1_TNL11.
_________________
Kiran
IBM Cert. Solution Designer & System Administrator - WBIMB V5
IBM Cert. Solutions Expert - WMQI
IBM Cert. Specialist - WMQI, MQSeries
IBM Cert. Developer - MQSeries
|
|
| Back to top |
|
|
| mqonnet |
| Posted: Fri Jun 28, 2002 10:55 am Post subject: |
|
|
Grand Master
Joined: 18 Feb 2002
Posts: 1114
Location: Boston, Ma, Usa.
|
Hmmm...
One thing that i forgot was this. Try to stop your SDR channel from MQSI and re-run your original test which gives your 2035(MQRC_NOT_AUTHORIZED). When the message reaches the TQ, check to see what userid it has in it.
And am i right to assume that you have regular channels(DQM) setup without any Context information being used neither by the channels nor by the apps.
What are the platforms in question again.
Cheers.
Kumar
_________________
IBM Certified WebSphere MQ V5.3 Developer
IBM Certified WebSphere MQ V5.3 Solution Designer
IBM Certified WebSphere MQ V5.3 System Administrator |
|
| Back to top |
|
|
| kirani |
| Posted: Fri Jun 28, 2002 11:14 am Post subject: |
|
|
Jedi Knight
Joined: 05 Sep 2001
Posts: 3779
Location: Torrance, CA, USA
|
Kumar,
I will run my app again and post the results here.
Yes, the channels are regular.
The platform is WIN2K
Thanks.
_________________
Kiran
IBM Cert. Solution Designer & System Administrator - WBIMB V5
IBM Cert. Solutions Expert - WMQI
IBM Cert. Specialist - WMQI, MQSeries
IBM Cert. Developer - MQSeries
|
|
| Back to top |
|
|
| kirani |
| Posted: Fri Jun 28, 2002 12:19 pm Post subject: |
|
|
Jedi Knight
Joined: 05 Sep 2001
Posts: 3779
Location: Torrance, CA, USA
|
Kumar,
I ran the application once again after stopping the SDR channel on MQSI queue manager. I was watching the transmission very closely. I saw COA report message in the transmission queue (AH1_TNL11), but COD/Expiration report message went directly to the DLQ of MQSI.
The DLH header says this:
Reason: MQRC_NOT_AUTHORIZED
Destination Queue: KI.REPORT
Destination Queue Manager: AH1_TNL11
PutApplicationType: Queue Manager
Put Application Name: MQSI
User-id : casswmqi
The message is not even going to Transmission queue. 
_________________
Kiran
IBM Cert. Solution Designer & System Administrator - WBIMB V5
IBM Cert. Solutions Expert - WMQI
IBM Cert. Specialist - WMQI, MQSeries
IBM Cert. Developer - MQSeries
|
|
| Back to top |
|
|
| dhaksr |
| Posted: Fri Jun 28, 2002 12:36 pm Post subject: |
|
|
Apprentice
Joined: 20 Feb 2002
Posts: 37
|
Kiran,
Set your default transmission Queue (for Queue Manager AH1_TNL11)
as the XMIT queue for your machine. After that it should work fine.
-Dhaks |
|
| Back to top |
|
|
| kirani |
| Posted: Fri Jun 28, 2002 12:51 pm Post subject: |
|
|
Jedi Knight
Joined: 05 Sep 2001
Posts: 3779
Location: Torrance, CA, USA
|
AH1_TNL11 is the only and default transmission queue on my queue manager.
_________________
Kiran
IBM Cert. Solution Designer & System Administrator - WBIMB V5
IBM Cert. Solutions Expert - WMQI
IBM Cert. Specialist - WMQI, MQSeries
IBM Cert. Developer - MQSeries
|
|
| Back to top |
|
|
| mqonnet |
| Posted: Sat Jun 29, 2002 5:04 am Post subject: |
|
|
Grand Master
Joined: 18 Feb 2002
Posts: 1114
Location: Boston, Ma, Usa.
|
Kiran,
You have this setup
AH1_TNL1---Puts with userid "casswmqi"---MQSI
Message expires on MQSI QM and is supposed to generate the report and is unable to put to the transmission queue using userid "casswmqi". Now that we have gone through a lot of things and ruled out many, the only obvious thing that is left out is to see the groups "casswmqi" belongs to on MQSI qm workstation. I mean to say, check out the groups "casswmqi" is in on the w2k box where qm MQSI is hosted. Somthing tells me that it is not in the "mqm" group and thats the reason you are not able to put even to the TQ. Well, i think we should have gotten this much earlier, but somehow things went on...
Could you check the same and post your observations.
_________________
IBM Certified WebSphere MQ V5.3 Developer
IBM Certified WebSphere MQ V5.3 Solution Designer
IBM Certified WebSphere MQ V5.3 System Administrator |
|
| Back to top |
|
|
| kirani |
| Posted: Mon Jul 01, 2002 8:04 am Post subject: |
|
|
Jedi Knight
Joined: 05 Sep 2001
Posts: 3779
Location: Torrance, CA, USA
|
Kumar,
I recreated the user casswmqi on my local workstation and reassigned it to mqm group. Now everything is working as expected! Looks like the persmissions were not setup correctly earlier on this machine.
Thank you all for going over this with me.
Have a great day! 
_________________
Kiran
IBM Cert. Solution Designer & System Administrator - WBIMB V5
IBM Cert. Solutions Expert - WMQI
IBM Cert. Specialist - WMQI, MQSeries
IBM Cert. Developer - MQSeries
|
|
| Back to top |
|
|
| mqonnet |
| Posted: Mon Jul 01, 2002 8:22 am Post subject: |
|
|
Grand Master
Joined: 18 Feb 2002
Posts: 1114
Location: Boston, Ma, Usa.
|
Kiran,
Good to note that your problem is now resolved. Authorizations are one of the areas of real confusion always and takes a while before we figure out where the problem is. Glad that it worked.
Cheers.
Kumar
_________________
IBM Certified WebSphere MQ V5.3 Developer
IBM Certified WebSphere MQ V5.3 Solution Designer
IBM Certified WebSphere MQ V5.3 System Administrator |
|
| Back to top |
|
|
|
|
