| Author |
Message
|
| dougie |
 Posted: Wed Jul 30, 2003 2:18 am Post subject: MQ5.3 with IIS |
 |
|
Newbie
Joined: 12 Nov 2002
Posts: 6
|
A VB application that accesses MQ via IIS worked under 5.2 but stopped working under 5.3 after an upgrade. The application does not appear to be able to connect to the QM and reports the following error codes:
2059, amq6119 Failed to open handle, access is denied
This does not appear to be an authorisation problem but I cannot discout it yet. |
|
| Back to top |
|
 |
| HomeBrew |
| Posted: Mon Nov 10, 2003 2:09 pm Post subject: IIS error |
|
|
Newbie
Joined: 10 Nov 2003
Posts: 5
|
| I have the same problem .... Does anyone know of the cause and solution ? |
|
| Back to top |
|
|
| dougie |
| Posted: Tue Nov 11, 2003 12:35 am Post subject: |
|
|
Newbie
Joined: 12 Nov 2002
Posts: 6
|
| MUSR_MQADMIN needs inserted into the administrator group. I understand that 5.3 has tightened up it security. |
|
| Back to top |
|
|
| JasonE |
| Posted: Tue Nov 11, 2003 2:05 am Post subject: |
|
|
Grand Master
Joined: 03 Nov 2003
Posts: 1220
Location: Hursley
|
No, MUSR_MQADMIN does not have to be in the Administrator group. Without knowing the exact details of the problem it is difficult to identify the cause, but doing this step usually covers up an underlying security related problem.
If your domain controller is active directory, and it wasnt upgraded from winnt then you may need MQ to run under a domain userid (see the quick beginnings chapter).
If you see the access denied on opening the handle problem, you need to ensure that the userid MQ is running under has the SE_DEBUG_NAME ("Debug Programs") - Look under the local security policy GUI to achieve this. Note MUSR_MQADMIN is by default given this user right. |
|
| Back to top |
|
|
| mrlinux |
| Posted: Tue Nov 11, 2003 6:32 am Post subject: |
|
|
Grand Master
Joined: 14 Feb 2002
Posts: 1261
Location: Detroit,MI USA
|
A 2059 reason code is not a security issue, it is an env. setup issue
if you are using client connection check your definitions. If you are using server check for qmgr name typo on MQCONN Call
_________________
Jeff
IBM Certified Developer MQSeries
IBM Certified Specialist MQSeries
IBM Certified Solutions Expert MQSeries |
|
| Back to top |
|
|
| JasonE |
| Posted: Tue Nov 11, 2003 7:04 am Post subject: |
|
|
Grand Master
Joined: 03 Nov 2003
Posts: 1220
Location: Hursley
|
| Actually, 2059 can occur as a default because a problem occurred during the processing and so the connection failed. The 6119 indicates a problem occurred, and the description of a failure to open the handle is very similar to some problems I have seen recently (I think they normally come from an FDC in the shared memory server). Without full details of the problem, its still a guess, but I still stand by my previous update... |
|
| Back to top |
|
|
| HomeBrew |
| Posted: Tue Nov 11, 2003 8:48 am Post subject: IIS w/ WebSphere MQ v 5.3 |
|
|
Newbie
Joined: 10 Nov 2003
Posts: 5
|
This is the error we get when trying to send messages with IIS
WebSphere MQ v 5.3
Event Type: Error
Event Source: WebSphere MQ
Event Category: None
Event ID: 6177
Date: 11/10/2003
Time: 1:01:13 PM
User: N/A
Computer: NEWWEBTEST
Description:
An internal WebSphere MQ error has occurred.
An error has been detected, and the MQ error recording routine has been called.
Details of the error have been stored at C:\Program Files\IBM\WebSphere MQ\errors\AMQ02780.0.FDC. A synopsis is given in the data section below. Use the standard facilities supplied with your system to record the problem identifier, and to save the generated output files. Contact your IBM support center. Do not discard these files until the problem has been resolved.
Data:
0000: 44 61 74 65 2f 54 69 6d Date/Tim
0008: 65 20 20 20 20 20 20 20 e
0010: 20 20 3a 2d 20 4d 6f 6e :- Mon
0018: 20 4e 6f 76 65 6d 62 65 Novembe
0020: 72 20 31 30 20 31 33 3a r 10 13:
0028: 30 31 3a 31 33 20 45 61 01:13 Ea
0030: 73 74 65 72 6e 20 53 74 stern St
0038: 61 6e 64 61 72 64 20 54 andard T
0040: 69 6d 65 20 32 30 30 33 ime 2003
0048: 20 20 2c 48 6f 73 74 20 ,Host
0050: 4e 61 6d 65 20 20 20 20 Name
0058: 20 20 20 20 20 3a 2d 20 :-
0060: 4e 45 57 57 45 42 54 45 NEWWEBTE
0068: 53 54 20 28 57 69 6e 64 ST (Wind
0070: 6f 77 73 20 56 65 72 20 ows Ver
0078: 35 2e 32 20 42 75 69 6c 5.2 Buil
0080: 64 20 33 37 39 30 3a 20 d 3790:
0088: 29 2c 50 49 44 53 20 20 ),PIDS
0090: 20 20 20 20 20 20 20 20
0098: 20 20 20 20 3a 2d 20 35 :- 5
00a0: 37 32 34 42 34 31 30 30 724B4100
00a8: 20 20 20 2c 4c 56 4c 53 ,LVLS
00b0: 20 20 20 20 20 20 20 20
00b8: 20 20 20 20 20 20 3a 2d :-
00c0: 20 35 33 30 2e 35 20 20 530.5
00c8: 43 53 44 30 35 2c 50 72 CSD05,Pr
00d0: 6f 64 75 63 74 20 4c 6f oduct Lo
00d8: 6e 67 20 4e 61 6d 65 20 ng Name
00e0: 3a 2d 20 57 65 62 53 70 :- WebSp
00e8: 68 65 72 65 20 4d 51 20 here MQ
00f0: 66 6f 72 20 57 69 6e 64 for Wind
00f8: 6f 77 73 2c 56 65 6e 64 ows,Vend
0100: 6f 72 20 20 20 20 20 20 or
0108: 20 20 20 20 20 20 3a 2d :-
0110: 20 49 42 4d 2c 50 72 6f IBM,Pro
0118: 62 65 20 49 64 20 20 20 be Id
0120: 20 20 20 20 20 20 20 3a :
0128: 2d 20 58 59 34 34 31 30 - XY4410
0130: 30 38 2c 41 70 70 6c 69 08,Appli
0138: 63 61 74 69 6f 6e 20 4e cation N
0140: 61 6d 65 20 20 3a 2d 20 ame :-
0148: 4d 51 4d 20 20 2c 43 6f MQM ,Co
0150: 6d 70 6f 6e 65 6e 74 20 mponent
0158: 20 20 20 20 20 20 20 20
0160: 3a 2d 20 78 73 74 41 64 :- xstAd
0168: 64 43 6f 6e 6e 65 63 74 dConnect
0170: 65 64 54 68 72 65 61 64 edThread
0178: 2c 42 75 69 6c 64 20 44 ,Build D
0180: 61 74 65 20 20 20 20 20 ate
0188: 20 20 20 3a 2d 20 53 65 :- Se
0190: 70 20 32 37 20 32 30 30 p 27 200
0198: 33 2c 43 4d 56 43 20 6c 3,CMVC l
01a0: 65 76 65 6c 20 20 20 20 evel
01a8: 20 20 20 20 3a 2d 20 70 :- p
01b0: 35 33 30 2d 30 35 2d 4c 530-05-L
01b8: 30 33 30 39 32 36 2c 42 030926,B
01c0: 75 69 6c 64 20 54 79 70 uild Typ
01c8: 65 20 20 20 20 20 20 20 e
01d0: 20 3a 2d 20 49 4b 41 50 :- IKAP
01d8: 20 2d 20 28 50 72 6f 64 - (Prod
01e0: 75 63 74 69 6f 6e 29 2c uction),
01e8: 55 73 65 72 49 44 20 20 UserID
01f0: 20 20 20 20 20 20 20 20
01f8: 20 20 3a 2d 20 4d 55 53 :- MUS
0200: 52 5f 4d 51 41 44 4d 49 R_MQADMI
0208: 4e 2c 50 72 6f 63 65 73 N,Proces
0210: 73 20 4e 61 6d 65 20 20 s Name
0218: 20 20 20 20 3a 2d 20 43 :- C
0220: 3a 5c 50 72 6f 67 72 61 :\Progra
0228: 6d 20 46 69 6c 65 73 5c m Files\
0230: 49 42 4d 5c 57 65 62 53 IBM\WebS
0238: 70 68 65 72 65 20 4d 51 phere MQ
0240: 5c 62 69 6e 5c 61 6d 71 \bin\amq
0248: 78 73 73 76 6e 2e 65 78 xssvn.ex
0250: 65 2c 50 72 6f 63 65 73 e,Proces
0258: 73 20 20 20 20 20 20 20 s
0260: 20 20 20 20 3a 2d 20 30 :- 0
0268: 30 30 30 32 37 38 30 2c 0002780,
0270: 54 68 72 65 61 64 20 20 Thread
0278: 20 20 20 20 20 20 20 20
0280: 20 20 3a 2d 20 30 30 30 :- 000
0288: 30 30 30 30 31 2c 51 75 00001,Qu
0290: 65 75 65 4d 61 6e 61 67 eueManag
0298: 65 72 20 20 20 20 20 20 er
02a0: 3a 2d 20 57 45 42 44 45 :- WEBDE
02a8: 56 30 21 51 55 45 55 45 V0!QUEUE
02b0: 4d 47 52 28 31 29 20 20 MGR(1)
02b8: 20 20 20 20 20 20 20 20
02c0: 20 20 20 20 20 20 20 20
02c8: 20 20 20 20 20 20 20 20
02d0: 20 20 20 2c 4d 61 6a 6f ,Majo
02d8: 72 20 45 72 72 6f 72 63 r Errorc
02e0: 6f 64 65 20 20 20 3a 2d ode :-
02e8: 20 78 65 63 46 5f 45 5f xecF_E_
02f0: 55 4e 45 58 50 45 43 54 UNEXPECT
02f8: 45 44 5f 53 59 53 54 45 ED_SYSTE
0300: 4d 5f 52 43 2c 4d 69 6e M_RC,Min
0308: 6f 72 20 45 72 72 6f 72 or Error
0310: 63 6f 64 65 20 20 20 3a code :
0318: 2d 20 4f 4b 2c 50 72 6f - OK,Pro
0320: 62 65 20 54 79 70 65 20 be Type
0328: 20 20 20 20 20 20 20 3a :
0330: 2d 20 4d 53 47 41 4d 51 - MSGAMQ
0338: 36 31 31 39 20 20 2c 50 6119 ,P
0340: 72 6f 62 65 20 53 65 76 robe Sev
0348: 65 72 69 74 79 20 20 20 erity
0350: 20 3a 2d 20 32 2c 50 72 :- 2,Pr
0358: 6f 62 65 20 44 65 73 63 obe Desc
0360: 72 69 70 74 69 6f 6e 20 ription
0368: 3a 2d 20 41 4d 51 36 31 :- AMQ61
0370: 31 39 3a 20 41 6e 20 69 19: An i
0378: 6e 74 65 72 6e 61 6c 20 nternal
0380: 57 65 62 53 70 68 65 72 WebSpher
0388: 65 20 4d 51 20 65 72 72 e MQ err
0390: 6f 72 20 68 61 73 20 6f or has o
0398: 63 63 75 72 72 65 64 20 ccurred
03a0: 28 46 61 69 6c 65 64 20 (Failed
03a8: 74 6f 20 6f 70 65 6e 20 to open
03b0: 68 61 6e 64 6c 65 20 6f handle o
03b8: 6e 20 70 72 6f 63 65 73 n proces
03c0: 73 20 32 35 36 38 20 2d s 2568 -
03c8: 20 28 35 29 29 2c 46 44 (5)),FD
03d0: 43 53 65 71 75 65 6e 63 CSequenc
03d8: 65 4e 75 6d 62 65 72 20 eNumber
03e0: 3a 2d 20 35 37 2c 41 72 :- 57,Ar
03e8: 69 74 68 31 20 20 20 20 ith1
03f0: 20 20 20 20 20 20 20 20
03f8: 3a 2d 20 35 33 36 38 39 :- 53689
0400: 35 37 36 39 20 32 30 30 5769 200
0408: 30 36 31 31 39 2c 41 72 06119,Ar
0410: 69 74 68 32 20 20 20 20 ith2
0418: 20 20 20 20 20 20 20 20
0420: 3a 2d 20 35 20 35 2c 43 :- 5 5,C
0428: 6f 6d 6d 65 6e 74 31 20 omment1
0430: 20 20 20 20 20 20 20 20
0438: 20 3a 2d 20 46 61 69 6c :- Fail
0440: 65 64 20 74 6f 20 6f 70 ed to op
0448: 65 6e 20 68 61 6e 64 6c en handl
0450: 65 20 6f 6e 20 70 72 6f e on pro
0458: 63 65 73 73 20 32 35 36 cess 256
0460: 38 20 2d 20 28 35 29 20 8 - (5)
0468: 20 20 20 20 20 20 20 20
0470: 20 20 20 20 20 20 20 20
0478: 20 20 20 2c 43 6f 6d 6d ,Comm
0480: 65 6e 74 32 20 20 20 20 ent2
0488: 20 20 20 20 20 20 3a 2d :-
0490: 20 41 63 63 65 73 73 20 Access
0498: 69 73 20 64 65 6e 69 65 is denie
04a0: 64 2e 20 20 20 20 20 20 d.
04a8: 20 20 20 20 20 20 20 20
04b0: 20 20 20 20 20 20 20 20
04b8: 20 20 20 20 20 20 20 20
04c0: 20 20 20 20 20 20 20 20
04c8: 20 20 20 20 20 20 20 20
04d0: 2c 2c 43 6f 6d 70 6f 6e ,,Compon
04d8: 65 6e 74 20 44 75 6d 70 ent Dump
04e0: 73 20 28 54 68 72 65 61 s (Threa
04e8: 64 20 30 30 30 30 30 30 d 000000
04f0: 30 31 29 2c 2d 2d 2d 2d 01),----
04f8: 2d 2d 2d 2d 2d 2d 2d 2d --------
0500: 2d 2d 2d 2d 2d 2d 2d 2d --------
0508: 2d 2d 2d 2d 2d 2d 2d 2d --------
0510: 2d 2d 2d 2d 2d 2d 2d 2d --------
0518: 2d 2c -, |
|
| Back to top |
|
|
| JasonE |
| Posted: Tue Nov 11, 2003 9:00 am Post subject: |
|
|
Grand Master
Joined: 03 Nov 2003
Posts: 1220
Location: Hursley
|
Yuck - For future reference, if you look in the mq install dir, \errors there are FDC files which give the info you pasted in hex in a much cleaner format.
But yes, this is precisely the problem I am talking about, and I have had a few people report it. Make sure you are 5.3 csd04 or higher, and ensure the MQ userid has the Debug Programs local security policy:
Bring up the Local Security Policy tool, click on 'Security Settings
->Local Policies->User Right Assignments', click on 'Debug Programs'
(See Q101366 for the list and their 'Display names'). Can you please
try double clicking Debug Programs, then Add 'MUSR_MQADMIN' into the list. (I think thats your MQ userid from the fdc)
Does this help (This is the SE_DEBUG_NAME I mentioned). |
|
| Back to top |
|
|
| HomeBrew |
| Posted: Wed Nov 12, 2003 9:23 am Post subject: |
|
|
Newbie
Joined: 10 Nov 2003
Posts: 5
|
I tried the suggestion about adding to the debug group .... now we get:
mqax200 error '800a7d00'
MQAX200.MQSession::AccessQueueManager CompletionCode = 2, ReasonCode = 2063, ReasonName = MQRC_SECURITY_ERROR
jeeesh !! |
|
| Back to top |
|
|
| HomeBrew |
| Posted: Wed Nov 12, 2003 9:25 am Post subject: |
|
|
Newbie
Joined: 10 Nov 2003
Posts: 5
|
I tried the suggestion about adding to the debug group .... now we get:
mqax200 error '800a7d00'
MQAX200.MQSession::AccessQueueManager CompletionCode = 2, ReasonCode = 2063, ReasonName = MQRC_SECURITY_ERROR
jeeesh !! |
|
| Back to top |
|
|
| JasonE |
| Posted: Wed Nov 12, 2003 9:46 am Post subject: |
|
|
Grand Master
Joined: 03 Nov 2003
Posts: 1220
Location: Hursley
|
I've sent you a message with my email addr in - take a trace and I'll take a look. I think you have got beyond the other failure only to find a new problem.
Also:
Out of interest what o/s are you running this on?
What userid is MQ configured to run under (default==musr_mqadmin)?
Are you in a domain, and if so is it active directory?
Do you get any errors logged in the system errors or the qmgr errors dir when this occurs (such as amq8079 or amq8135)? |
|
| Back to top |
|
|
| HomeBrew |
| Posted: Wed Nov 12, 2003 10:48 am Post subject: Problem solved |
|
|
Newbie
Joined: 10 Nov 2003
Posts: 5
|
I spoke with IBM support.... After a few hours on the phone yesterday & today, they suggested we add the registry key: HKLM\Software\IBM\MQSeries\CurrentVersion\ThreadModel with a string value of FIXED .
That registry key didn't exist, so I had to add it ..... (shouldn't it already have been there ??)
Thanks for everyone's help
Disclaimer .... this may not work for others, and it's probably not a good idea to add registry keys unless required to fix a specific problem. |
|
| Back to top |
|
|
| bower5932 |
| Posted: Wed Nov 12, 2003 12:57 pm Post subject: |
|
|
Jedi Knight
Joined: 27 Aug 2001
Posts: 3023
Location: Dallas, TX, USA
|
| Not all of the registry keys exist ahead of time. Some of them have defaults and won't be in the registry. Every now and then, IBM support will determine that something is wrong and have you add one to override the default. You'll also find this is true with some of the tuning parameters. |
|
| Back to top |
|
|
| JasonE |
| Posted: Thu Nov 13, 2003 3:29 am Post subject: |
|
|
Grand Master
Joined: 03 Nov 2003
Posts: 1220
Location: Hursley
|
Just FYI the registry disables our MTS layer (which didnt exist pre-5.2), so the call into MQ goes directly on the thread making the call rather than via a worker thread in the case where we are running in a COM+ context. The problem you had was that the worker thread is running under one userid (probably system or related) whereas the calling thread used impersonation to become a different userid.
I would not recommend its use unless you have a *need* to disable this layer (which you do havem but this is for anyone else reading it!) |
|
| Back to top |
|
|
|
|
