MQSeries.net :: View topic - AD Group

exerk · Posted: Thu Apr 12, 2018 5:20 am Post subject:

A bit of a head-scratcher for me folks, and I know I'm doing something obviously wrong, but not sure of what that wrong is.

MQ V9.0.0.2 on RHEL 7

1. UNIX-enabled AD Group, populated with the required 'people', and role-based security set on the UNIX queue manager for that Group;

2. 'getent' command on the UNIX server enumerates the members of the Group;

3. CONNAUTH CHECKCLNT(OPTIONAL) set on the queue manager, CHLAUTH disabled (I know, but it's not my train set!);

4. Connection from MQ Explorer (no password is being sent) fails with 'Not authorised: connect' for a user in the Group (me);

5. Displaying ENTAUTH shows the AD Group has the required authorisations;

6. CONNAUTH disabled, security refreshed, same issue - 'Not authorised: connect';

7. id on the box shows me as having a local group, and also being a member of the AD Group, so I set role-based permission against my local group;

8. Magically, I can now get in (my Windows userid and UNIX one/group are identical).

I also tried this with other users in the AD Group - same issue - so at first sight it appears to me that the AD Group is not being enumerated.

This one has me nonplussed because I'm sure (as said above) I'm missing something blindingly obvious!

_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys.