MQSeries.net :: View topic - windows Server SID warning

MQSeries.net

Tech Exchange

Education

Certifications

Library

Info Center

SupportPacs

FAQÂ Â

Usergroups

RSS Feed - WebSphere MQ Support

RSS Feed - Message Broker Support

MQSeries.net Forum Index » IBM MQ Security » windows Server SID warning

windows Server SID warning

« View previous topic :: View next topic »

Author

Message

smdavies99

Posted: Thu Jan 23, 2014 5:43 am Post subject: windows Server SID warning

Jedi Council

Joined: 10 Feb 2003
Posts: 6076
Location: Somewhere over the Rainbow this side of Never-never land.

Many of us use Virtual Machines in our development and testing.
It is oh so very easy to copy a VM, change the hostname and away you go.

Everything is working fine and the two servers are communicating fine and the WMQ Clients on one can talk to the QMGR on the other until....

You do enable CHLAUTH on the Qmgr and suddenly everything grids to a halt.

You spend hours trying to setup all the authorities that worked on another machine yet somehow fail miserably here.

You get errors logged like

Code:

Log Name: Application
Source: WebSphere MQ (Installation1)
Date: 1/23/2014 10:50:45 AM
Event ID: 8074
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: AAN-BROKER8
Description:
1/23/2014 10:50:45 - Process(4360.394) User(MUSR_MQADMIN) Program(amqzlaa0.exe) Host(AAN-BROKER8) Installation(Installation1) VRMF(7.5.0.2) QMgr(AANLBRKR)

Authorization failed as the SID 'S-1-5-21-323498503-1607127228-4129056961-1009' does not match the entity 'contact admin'.

The Object Authority Manager received inconsistent data - the supplied SID does not match that of the supplied entity information.

Ensure that the application is supplying valid entity and SID information.

There are a number of posts that quote the sid does not match the entity

My solution to the above problem has as far as I can see not been described anywhere (yet).

I fired up another VM and after creating the same user as the errant VM was using I was able to connect to the Qmgr without issue. So what is different?

Because the two original VM's were clones, and despite them having a different hostname, the pesky people at Microsoft use this thing called a SID.

The long string in the error message starting ''S-1-5-21-3' is the SID.
The SID's for the two machines was identical. There was a mismatch between the two systems and the username number. Hence the failure.
The other VM despite using the same username, also used a different SID so everything was fine.

The moral of this story was, yes by all means go ahead and clone the VM but don't forget to change the SID. For some archaic reason only known to Microsoft changing the SID requires you to reboot twice and re-enter your location an KB type. You kick all this off using the 'sysprep' utility. There is plenty of notes on this on the internet but beware. The laws of unintended consequences comes bearing down at you like an express train (think TGV and not Amtrak). Some products may/will also require a re-installation. SQLServer 2008 is one just product.

After many hours on this and at one point almost

I carried on and after a lot more

I won out in the end.

I'm posting this here in the hope that it might be useful to a few people.
_________________
WMQ User since 1999
MQSI/WBI/WMB/'Thingy' User since 2002
Linux user since 1995

Every time you reinvent the wheel the more square it gets (anon). If in doubt think and investigate before you ask silly questions.

Display posts from previous:

Page 1 of 1

MQSeries.net Forum Index » IBM MQ Security » windows Server SID warning

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Protected by Anti-Spam ACP