| Author |
Message
|
| hughson |
 Posted: Tue Jan 20, 2015 3:05 am Post subject: |
 |
|
Padawan
Joined: 09 May 2013
Posts: 1959
Location: Bay of Plenty, New Zealand
|
| terry902 wrote: |
| I still expect the solutions |
Did you try out my suggestions in my earlier post? I didn't see any response from you to say how it worked out?
_________________
Morag Hughson @MoragHughson
IBM MQ Technical Education Specialist
Get your IBM MQ training here!
MQGem Software |
|
| Back to top |
|
 |
| LouML |
| Posted: Tue Jan 20, 2015 3:29 am Post subject: |
|
|
Partisan
Joined: 10 Nov 2005
Posts: 305
Location: Jersey City, NJ / Bethpage, NY
|
Morag, I know you're talking to terry902 but did you happen to see the post I linked to?
We tried using amqsputc and amqscnxc as mentioned here and it still fails with reason code 2035
_________________
Yeah, well, you know, that's just, like, your opinion, man. - The Dude |
|
| Back to top |
|
|
| hughson |
| Posted: Tue Jan 20, 2015 3:47 am Post subject: |
|
|
Padawan
Joined: 09 May 2013
Posts: 1959
Location: Bay of Plenty, New Zealand
|
I just read through it again and I'm not sure where you left it. The post appears to suggest you were trying to use it with PAM and markt already gave you an answer with that. That's the trouble when posts go on for a while, it's hard to see what's left still to be solved. If you could put a little summary post in to say what you're trying now that is still failing that would help.
_________________
Morag Hughson @MoragHughson
IBM MQ Technical Education Specialist
Get your IBM MQ training here!
MQGem Software |
|
| Back to top |
|
|
| terry902 |
| Posted: Wed Jan 21, 2015 12:04 am Post subject: |
|
|
Novice
Joined: 10 Oct 2014
Posts: 15
|
| hughson wrote: |
Ok let's take a different tack. Java does have some more complicated issues with sending the user ID and password up to the queue manager due to the to modes (the compatibility mode and the MQCSP mode). You say you've tried both modes from the MQ Explorer (which is a Java client) and neither works, and you say you've had it working via JMS but we don't know in which mode. You're also running with CHCKCLNT(OPTIONAL) so we haven't proved that the working case maybe didn't send a password at all.
But first let's just prove the nice simple case with no complications. Let's get you to use the simplest 'C' sample we have and provide a user ID and password in using that. You can use amqsputc with a user ID and password as detailed in MQ V8 - Samples can use user ID and password.
very simple, just do:-
set MQSERVER=channel-name/TCP/hostname(port)
set MQSAMP_USER_ID=mqm
amqsputc q-name TEST
and then it will prompt you for the password.
Let us know the outcome of that.
Extra Reference about Java modes
Cheers
Morag |
win7 cmd,i did these:
-----------
C:\Windows\system32>set MQSERVER=SVRCONN.QM_A01/TCP/172.24.18.14(14101)
C:\Windows\system32>set MQSAMP_USER_ID=mqm
C:\Windows\system32>amqsputc Q_DEADLETTER QM_A01
Sample AMQSPUT0 start
Enter password: mqm
MQCONNX ended with reason code 2035
C:\Windows\system32>
---------------
The sever error as follows:
AMQ5653: The user 'terry' is not defined.
EXPLANATION:
The system call getpwnam("terry") failed with errno -1.
ACTION:
If you are trying to use user 'terry' on this system, create the user and retry
the operation. If you are trying to map from user 'terry' to another user using
CHLAUTH USERMAP rules, check that CHLAUTH is enabled on the queue manager and
ensure the case is correct in your CHLAUTH rule.
======
why 'terry' ? 'terry' is my current os user. |
|
| Back to top |
|
|
| hughson |
| Posted: Wed Jan 21, 2015 2:24 am Post subject: |
|
|
Padawan
Joined: 09 May 2013
Posts: 1959
Location: Bay of Plenty, New Zealand
|
| terry902 wrote: |
The sever error as follows:
AMQ5653: The user 'terry' is not defined.
EXPLANATION:
The system call getpwnam("terry") failed with errno -1.
ACTION:
If you are trying to use user 'terry' on this system, create the user and retry
the operation. If you are trying to map from user 'terry' to another user using
CHLAUTH USERMAP rules, check that CHLAUTH is enabled on the queue manager and
ensure the case is correct in your CHLAUTH rule.
======
why 'terry' ? 'terry' is my current os user. |
If terry is the user ID your client process is running under, and this is not known to the queue manager OS and you instead want to run using the user ID that you present with the password, please change your AUTHINFO object to have ADOPTCTX(YES) instead of NO.
Cheers
Morag
_________________
Morag Hughson @MoragHughson
IBM MQ Technical Education Specialist
Get your IBM MQ training here!
MQGem Software |
|
| Back to top |
|
|
| terry902 |
| Posted: Wed Jan 21, 2015 5:51 pm Post subject: |
|
|
Novice
Joined: 10 Oct 2014
Posts: 15
|
| hughson wrote: |
| terry902 wrote: |
The sever error as follows:
AMQ5653: The user 'terry' is not defined.
EXPLANATION:
The system call getpwnam("terry") failed with errno -1.
ACTION:
If you are trying to use user 'terry' on this system, create the user and retry
the operation. If you are trying to map from user 'terry' to another user using
CHLAUTH USERMAP rules, check that CHLAUTH is enabled on the queue manager and
ensure the case is correct in your CHLAUTH rule.
======
why 'terry' ? 'terry' is my current os user. |
If terry is the user ID your client process is running under, and this is not known to the queue manager OS and you instead want to run using the user ID that you present with the password, please change your AUTHINFO object to have ADOPTCTX(YES) instead of NO.
Cheers
Morag |
It works, now I can put msgs into the queue. |
|
| Back to top |
|
|
| murdeep |
| Posted: Thu Feb 19, 2015 11:07 am Post subject: |
|
|
Master
Joined: 03 Nov 2004
Posts: 211
|
Bumping to see if anyone has got WMQ V8.0.0.1 MQExplorer on windows to connect.
I have the following config:
| Quote: |
dis qmgr connauth
11 : dis qmgr connauth
AMQ8408: Display Queue Manager details.
QMNAME(QMBKRD01)
CONNAUTH(SYSTEM.DEFAULT.AUTHINFO.IDPWOS)
dis authinfo(SYSTEM.DEFAULT.AUTHINFO.IDPWOS) all
12 : dis authinfo(SYSTEM.DEFAULT.AUTHINFO.IDPWOS) all
AMQ8566: Display authentication information details.
AUTHINFO(SYSTEM.DEFAULT.AUTHINFO.IDPWOS)
AUTHTYPE(IDPWOS) ADOPTCTX(NO)
DESCR( ) CHCKCLNT(REQUIRED)
CHCKLOCL(REQUIRED) FAILDLAY(1)
ALTDATE(2015-02-19) ALTTIME(12.21.50)
|
I set and run the following at the command line:
| Quote: |
C:\Windows\system32>set MQSAMP_USER_ID=
C:\Windows\system32>amqsput Q1 QMBKRD01
Sample AMQSPUT0 start
MQCONNX ended with reason code 2035
C:\Windows\system32>set MQSAMP_USER_ID=bkrid
C:\Windows\system32>amqsput Q1 QMBKRD01
Sample AMQSPUT0 start
Enter password: ********
target queue is Q1
Sample AMQSPUT0 end |
So I can connect runnng amqsput with no issues when supplying the password for my bkrid userid.
Now I try to connect from MQExplorer.
I configure the qmgr connection via ConnectionDetails->Properties->UserId. I check Enable User Identification. Uncheck User Identification Compatibility Mode. I enter my userid bkrsid.
I have chosen not to save passwords to a file within MQExplorer. So I get prompted when I try and connect to the qmgr. The connect fails and a dialogue box displays:
| Quote: |
Access not permitted. You are not authorized to perform this operation. (AMQ4036)
Access not permitted. You are not authorized to perform this operation. (AMQ4036)
Severity: 10 (Warning)
Explanation: The queue manager security mechanism has indicated that the userid associated with this request is not authorized to access the object. |
And finally I see the following events in the windows application event log that coincide with failed connection attempt in MQExplorer:
| Quote: |
Log Name: Application
Source: WebSphere MQ (Installation1)
Date: 2/19/2015 1:57:43 PM
Event ID: 5542
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: KVM838-R9PYH7N
Description:
2/19/2015 13:57:43 - Process(3568.3) User(MUSR_MQADMIN) Program(amqzlsa0.exe) Host(KVM838-R9PYH7N) Installation(Installation1) VRMF(8.0.0.1) QMgr(QMBKRD01)
The failed authentication check was caused by the queue manager CONNAUTH CHCKLOCL(REQUIRED) configuration.
The user ID 'bkrid' and its password were checked because the queue manager connection authority (CONNAUTH) configuration refers to an authentication information (AUTHINFO) object named 'SYSTEM.DEFAULT.AUTHINFO.IDPWOS' with CHCKLOCL(REQUIRED). &P This message accompanies a previous error to clarify the reason for the user ID and password check.
Refer to the previous error for more information. &P Ensure that a password is specified by the client application and that the password is correct for the user ID. The authentication configuration of the queue manager connection determines the user ID repository. For example, the local operating system user database or an LDAP server. &P If the CHCKCLNT setting is OPTIONAL, the authentication check can be avoided by not passing a user ID across the channel. For example, by omitting the MQCSP structure from the client MQCONNX API call. &P To avoid the authentication check, you can amend the authentication configuration of the queue manager connection, but you should generally not allow unauthenticated remote access.
Log Name: Application
Source: WebSphere MQ (Installation1)
Date: 2/19/2015 1:57:43 PM
Event ID: 5534
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: KVM838-R9PYH7N
Description:
2/19/2015 13:57:43 - Process(3568.3) User(MUSR_MQADMIN) Program(amqzlsa0.exe) Host(KVM838-R9PYH7N) Installation(Installation1) VRMF(8.0.0.1) QMgr(QMBKRD01)
User ID 'bkrid' authentication failed
The user ID and password supplied by 'here MQ\bin64\MQExplorer.exe' could not be authenticated.
Ensure that the correct user ID and password are provided by the application. Ensure that the authentication repository is correctly configured. Look at previous error messages for any additional information.
|
Anyone manged to get MQExplorer to locally connect with CONNAUTH enabled? |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Fri Feb 20, 2015 10:10 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
The default is CHCKLOCL(optional) and checkclnt(reqadmin).
This works well with MQExplorer. The parts of defining the client are not setup to work with a local connection (connection mode bindings vs client)...
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| murdeep |
| Posted: Mon Feb 23, 2015 7:37 am Post subject: |
|
|
Master
Joined: 03 Nov 2004
Posts: 211
|
A couple of more notes. I added my queue manager as a remote queue manager (even though MQExplorer is running local) and I get the same error. I also went into Preferences and selected "Do Not Save Passwords" and when I try to connect MQExplorer does not prompt me for a password.
I then exited MQExplorer and went and deleted the file C:\Users\...\WebSphereMQ\workspace-Installation1\.metadata\.plugins\com.ibm.mq.explorer.ui\WMQ_Passwords.xml, restarted MQExplorer and verified that I was not storing passwords and tried to connect. I was not prompted for my password. So not sure what password MQExplorer was using when trying to connect.
So it seems to me that MQExplorer is not working as expected with regards to passwords.
So I guess my original question remains. Has anyone managed to get V8.0.0.1 (8.0.0.201404291830) MQExplorer to work (connect) with queue manager CONNAUTH enabled? |
|
| Back to top |
|
|
|
|
