| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| setAlternateUser |
« View previous topic :: View next topic » |
| Author |
Message
|
| kndata |
 Posted: Mon Oct 14, 2002 7:00 am Post subject: setAlternateUser |
 |
|
Newbie
Joined: 14 Oct 2002
Posts: 3
|
Help !
Has anyone has any success using setAlternateUser on Windows NT client -> Windows NT server.
I'm using the C++ classes to connect to MQ.
I looked up the SID ok using LookupAccountName and setAlternateSecurityId returns success but when I connect to the queue manager I get a 2035 return code.
The profile I'm using to connect (serverUser) has a local account on the MQ NT server, is in the mqm group and has allmqi and altusr authority on the queue manager object. Looking in the logs, it seems MQ is using the NT user account that is logged on to do the authentication with MQ series and not the one referenced by the SID (serverUser)
char sid[256];
DWORD sizeSID = 256; // SID size
char domain[256];
DWORD sizeDN = 256;
SID_NAME_USE eUse;
BOOL b = LookupAccountName(0, "serverUser", sid, &sizeSID, domain, &sizeDN, &eUse);
MQBYTE40 AlternateSecurityId;
for (int i=0; i < 40 ; i++) {
AlternateSecurityId[i] = 0;
}
DWORD size = GetLengthSid(sid);
AlternateSecurityId[0] = (unsigned char)size;
AlternateSecurityId[1] = MQSIDT_NT_SECURITY_ID;
memcpy((void *)&AlternateSecurityId[2], sid, size);
imqBoolean imqb = m_mgr.setAlternateSecurityId(AlternateSecurityId);
m_mgr.setOpenOptions(MQOO_ALTERNATE_USER_AUTHORITY);
imqb = m_queue.setAlternateSecurityId(AlternateSecurityId);
m_queue.setOpenOptions(MQOO_ALTERNATE_USER_AUTHORITY);
if ( ! m_mgr.connect( ) ) {
/* stop if it failed */
int reason = (int)m_mgr.reasonCode( ) ;
printf("connect failed %d", reason);
return reason;
}
Dave |
|
| Back to top |
|
 |
| clindsey |
| Posted: Mon Oct 14, 2002 8:09 am Post subject: |
|
|
Knight
Joined: 12 Jul 2002
Posts: 586
Location: Dallas, Tx
|
| Try giving altusr authority to the id that is running the application. |
|
| Back to top |
|
|
| kndata |
| Posted: Mon Oct 14, 2002 11:40 pm Post subject: |
|
|
Newbie
Joined: 14 Oct 2002
Posts: 3
|
I was trying to avoid setting user authority to each individual user running the application.
I have tried this and it does work, but it doesn't really solve my problem. |
|
| Back to top |
|
|
| clindsey |
| Posted: Tue Oct 15, 2002 6:23 am Post subject: |
|
|
Knight
Joined: 12 Jul 2002
Posts: 586
Location: Dallas, Tx
|
I think this is a safety net to keep a user with no authority from using 'mqm' as an alternate id and getting access to everything.
Charlie |
|
| Back to top |
|
|
| kndata |
| Posted: Tue Oct 15, 2002 6:34 am Post subject: |
|
|
Newbie
Joined: 14 Oct 2002
Posts: 3
|
But then why have an api to set an alternate id ?
It strange that its at the connect stage that I get the error. If you look in the documentation is says the setAlternateId is used for open and put. If only I could get that far !
I did have a quick go at using the C api but I got the same result 2035.
I've got around the problem by creating a new channel and setting the MCA user id to 'ServerUser' which gets around the problem. It's not a great solution however as now any application can connect not just my application. |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
