| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
| MCA UserId needed? |
« View previous topic :: View next topic » |
| Author |
Message
|
| fjb_saper |
 Posted: Wed Feb 23, 2011 2:21 pm Post subject: |
 |
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
| naxtell wrote: |
Alright, so I will plan to use an MCAUSER. But I still get "Not Authorized" no matter what I try for an MCAUSER value on my receiving queue (leaving it blank or setting it a user that I've added to the MQM group). I would like to get this to work first without an MCAUSER (to verify basic functionality), then with an MCAUSER to address the security concerns.
So what I have now is a sending channel on the other end with a blank MCAUSER and a receiving channel on my end with a blank MCAUSER, but I get "Not Authorized". I'd like to clear this up before moving onto using an MCAUSER on my receiving channel (since I can't get either to work). From what you're saying, it looks like I shouldn't be seeing messages placed onto the dead letter queue with "Not Authorized" as it's running with mqm privileges. Any ideas on why this basic setup doesn't work?
Thank you. |
Just to make sure... you are specifying the mcauser with quotes? Like
mcauser('myuser') and not just mcauser(myuser)?
Remember the rule that folds lower case to upper case, and remember that case matters! 
_________________
MQ & Broker admin |
|
| Back to top |
|
 |
| naxtell |
| Posted: Thu Feb 24, 2011 5:37 am Post subject: |
|
|
Novice
Joined: 30 Sep 2003
Posts: 17
|
| Vitor wrote: |
| Enabling security events will prove what user id the queue manager has found to use and is failing. Remembering that on AIX both users and groups are case sensitive so adding someone to the MQM group will not give a user admin rights to the queue manager in the way adding him to the mqm group will. |
I'm having trouble finding the userid in the logs after enabling Authority events. Does any have an example of what to look for or maybe where specifically to look in? Please note that I am using Windows, AIX is on the other end.
| fjb_saper wrote: |
| Just to make sure... you are specifying the mcauser with quotes? |
I'll give it a try.
| bruce2359 wrote: |
| Please display your RCVR channel (using runmqsc) |
1 : DISPLAY CHANNEL (XXXXXX)
AMQ8414: Display Channel details.
CHANNEL(XXXXXX)
CHLTYPE(RCVR)
ALTDATE(2011-02-23)
ALTTIME(14.03.15)
BATCHSZ(50)
COMPHDR(NONE)
COMPMSG(NONE)
DESCR(Channel for receiving messages from YYYYYY.)
HBINT(300)
KAINT(AUTO)
MAXMSGL(4194304)
MCAUSER(username@localserver)
MONCHL(QMGR)
MRDATA( )
MREXIT( )
MRRTY(10)
MRTMR(1000)
MSGDATA( )
MSGEXIT( )
NPMSPEED(FAST)
PUTAUT(DEF)
RCVDATA( )
RCVEXIT( )
SCYDATA( )
SCYEXIT( )
SENDDATA( )
SENDEXIT( )
SEQWRAP(999999999)
SSLCAUTH(OPTIONAL)
SSLCIPH( )
SSLPEER( )
STATCHL(QMGR)
TRPTYPE(TCP) |
|
| Back to top |
|
|
| bruce2359 |
| Posted: Thu Feb 24, 2011 5:52 am Post subject: |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9472
Location: US: west coast, almost. Otherwise, enroute.
|
| Quote: |
| MCAUSER(username@localserver) |
As well-documented, things you specify in lower-case will be folded into upper-case. Thus, the MCAUSER you specified would be USERNAME@LOCALSERVER.
As fjp_saper wrote, make sure the MCAUSER is in quotes.
This is the normal behavior for WMQ for all objects, all attributes.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| naxtell |
| Posted: Thu Feb 24, 2011 8:17 am Post subject: |
|
|
Novice
Joined: 30 Sep 2003
Posts: 17
|
| PeterPotkay wrote: |
If the RCVR channel's Put Authority parameter is set to Context, you are telling the channel to use the User ID in the MQMD of the message for authority checking.
If you are using Put Authority set to Context, don't. Its trivial for the sender to send a message with mqm in the MQMD header and do whatever they want to your QM. |
Messages are now being placed on my receiving queue. The receiver channel detail printout above works for me. The major changes are PutAuthority=Default and a local user account for MCAUSER. Also, I did not have to use single quotes. Thank you everyone for your suggestions and help. |
|
| Back to top |
|
|
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
