| Author |
Message
|
| kordi |
 Posted: Fri Nov 06, 2015 3:10 am Post subject: label name and mq client user name are different but works |
 |
|
Centurion
Joined: 28 May 2012
Posts: 146
Location: PL
|
Hi,
I can see pretty strange configuration on one of our boxes.
Trigger monitor is running as mqm user however in the kdb I found label for xyz user only (ibmwebspheremqxyz). Trigger monitor is connected however to MQ server. SVRCONN channel has BlockIP2(BlockExit) which maps mqm and xyz users to floop user.
How is it possible that username mqm is allowed to use certificate labeled for xyz user??? |
|
| Back to top |
|
 |
| zpat |
| Posted: Fri Nov 06, 2015 3:44 am Post subject: |
|
|
Jedi Council
Joined: 19 May 2001
Posts: 5866
Location: UK
|
A local trigger monitor should use binding mode and does not go anywhere near a channel connection.
_________________
Well, I don't think there is any question about it. It can only be attributable to human error. This sort of thing has cropped up before, and it has always been due to human error. |
|
| Back to top |
|
|
| kordi |
| Posted: Fri Nov 06, 2015 4:41 am Post subject: |
|
|
Centurion
Joined: 28 May 2012
Posts: 146
Location: PL
|
| Yes, that's right, but this is mq client trigger monitor using CCDT to connect QMGR. |
|
| Back to top |
|
|
| mqjeff |
| Posted: Fri Nov 06, 2015 6:48 am Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
Have you verified that the channel is actually requiring SSL mutual authentication ?
_________________
chmod -R ugo-wx / |
|
| Back to top |
|
|
| kordi |
| Posted: Fri Nov 06, 2015 11:15 am Post subject: |
|
|
Centurion
Joined: 28 May 2012
Posts: 146
Location: PL
|
That's very good question 
I will verify this on Monday. |
|
| Back to top |
|
|
| kordi |
| Posted: Tue Nov 10, 2015 6:02 am Post subject: |
|
|
Centurion
Joined: 28 May 2012
Posts: 146
Location: PL
|
It looks like SVRCONN channel requires mutual authentication:
I know that security exit can map one user to another but only after client will connect MQ server. Till now I thought MQ client is looking for ibmwebsphere{userID} labeled certificate in key database to use for connection. If user is mqm, no other label will be used than ibmwebspheremq mqm. This is strange. |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Fri Nov 20, 2015 6:10 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
| kordi wrote: |
| Any idea how is it possible? |
I believe that if using java the client will choose any suitable cert... 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| kordi |
| Posted: Fri Nov 20, 2015 8:15 am Post subject: |
|
|
Centurion
Joined: 28 May 2012
Posts: 146
Location: PL
|
yes, I think you are right accroding to what IBM claims here: http://www-01.ibm.com/support/docview.wss?uid=swg21245474
| Quote: |
| In the MQ Java and MQ JMS client environment the label is not used to do the certificate look up. However, a personal certificate for the queue manager end still needs a label of 'ibmwebspheremq<qmgrname>'. |
The thing is this is the case for trigger monitor, which runs as mqm user and kdb holds only once personal certificate: ibmwebspheremqxyz. SVRCONN channel requires mutual authentication and trigger monitor is connected to SVRCONN channel. |
|
| Back to top |
|
|
|
|
