MQSeries.net :: View topic - WSMQ 8, can't create Authority Records for AD domain group

xeonix · Posted: Thu Oct 09, 2014 4:40 pm Post subject:

Hello, gentlemen.

I have Windows 2008 R2 Active Directory domain controller. The domain is "domainwsmq".
Also there's another box running Windows 2008 R2 with IBM WebSphere MQ 8 FP 1 installed, which is a member of "domainwsmq".
Queue manager "QMTEST" is configured to work in AD environment with "domainwsmq\Domain mqm" (member of local 'mqm') group, and is running under "domainwsmq\SVC_MQ_0000" (member of 'Domain mqm').

Everything works fine, but now I need to:
- Create local queue "TESTQ" on "QMTEST"
- Create domain group "GR_DFTE_0000"
- Grant permissions to connect to "QMTEST", put/get/browse/inq on "TESTQ" to domain group "domainwsmq\GR_DFTE_0000"

So, according to documentation I'm trying to use command "setmqaut":
http://www-01.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.ref.adm.doc/q083500_.htm

I started with granting +connect to queue manager. Here's all variations of the command I've tried:

- Using "-g"

setmqaut -m QMTEST -t qmgr -g domainwsmq\GR_DFTE_0000 +connect
AMQ7026: A principal or group name was invalid.

setmqaut -m QMTEST -t qmgr -g GR_DFTE_0000@domainwsmq +connect
AMQ7026: A principal or group name was invalid.

setmqaut -m QMTEST -t qmgr -g GR_DFTE_0000@domainwsmq.ua +connect
AMQ7026: A principal or group name was invalid.

setmqaut -m QMTEST -t qmgr -g GR_DFTE_0000 +connect
AMQ7026: A principal or group name was invalid.

- Using "-p"

setmqaut -m QMTEST -t qmgr -p domainwsmq\GR_DFTE_0000 +connect
AMQ7026: A principal or group name was invalid.

setmqaut -m QMTEST -t qmgr -p GR_DFTE_0000@domainwsmq +connect
AMQ7026: A principal or group name was invalid.

setmqaut -m QMTEST -t qmgr -p GR_DFTE_0000@domainwsmq.ua +connect
AMQ7026: A principal or group name was invalid.

setmqaut -m QMTEST -t qmgr -p GR_DFTE_0000 +connect
AMQ7026: A principal or group name was invalid.

As a result - nothing of these ain't working, it's constantly saying "AMQ7026: A principal or group name was invalid.".
Even thought documentation says:

-----------------------------------------------
-p PrincipalName
The name of the principal for which to change authorizations.
[Windows] For WebSphere MQ for Windows only, the name of the principal can optionally include a domain name, specified in the following format:

userid@domain

For more information about including domain names on the name of a principal, see Principals and groups.

You must have at least one principal or group.
-g GroupName
The name of the user group for which to change authorizations. You can specify more than one group name, but each name must be prefixed by the -g flag.
For WebSphere MQ for Windows only, the group name can optionally include a domain name, specified in the following formats:

GroupName@domain
domain\GroupName
-----------------------------------------------

So, how do I create Authority Records for Active Directory domain group, what am I missing?