| Author |
Message
|
| brad_matrix |
 Posted: Wed Sep 22, 2004 6:59 am Post subject: Specific Authority across machines |
 |
|
Newbie
Joined: 22 Sep 2004
Posts: 6
Location: US
|
MQSeries 5.2
Machine A = Server = Win2K - Pentium 4
Machine B = Client = Solaris 7 (SunOS 5.7) -Sun Sparc
Get the following error reported on Machine B
-----------------------------------------------------
Sample AMQSPUT0 start
MQCONN ended with reason code 2035
Get the following error reported on Machine A
-----------------------------------------------------
Authorization failed because the SID for entity 'myuser' cannot be obtained.
The Object Authority Manager was unable to obtain a SID for the specified entity.
Ensure that the entity is valid, and that all necessary domain controllers are available.
Question
----------
How do you go about authenticating a Solaris User on a Win2K box?
Win2K does not seem to allow you specify clients as either Solaris boxes or Solaris users?
I have already searched for forums but nothing seems to address this error the Solaris/Win2K combination.
Thanks in advance.
Brad |
|
| Back to top |
|
 |
| RogerLacroix |
| Posted: Wed Sep 22, 2004 8:56 am Post subject: |
|
|
Jedi Knight
Joined: 15 May 2001
Posts: 3264
Location: London, ON Canada
|
Hi,
On the Win2k box, add the user of 'myuser'. Then on the Win2K box use setmqaut to allow 'myuser' to access whatever MQ objects you want.
Or simply cheat and on the Win2K box the add the 'myuser' to the mqm group. But this will give the UserID FULL access / control to ALL the queue managers on the Win2k box!!!!!!!!!!! 
Regards,
Roger Lacroix
_________________
Capitalware: Transforming tomorrow into today.
Connected to MQ!
Twitter |
|
| Back to top |
|
|
| brad_matrix |
| Posted: Wed Sep 22, 2004 9:14 am Post subject: |
|
|
Newbie
Joined: 22 Sep 2004
Posts: 6
Location: US
|
| RogerLacroix wrote: |
Hi,
On the Win2k box, add the user of 'myuser'. Then on the Win2K box use setmqaut to allow 'myuser' to access whatever MQ objects you want.
<snip>
|
Many thanks. Got it working on an NT4 box.
However there is something very odd going on.
I have identical MQ Server configurations on an NT4 box and a Win2K box.
The NT4 box works fine.
However the Win2K box doesn't. All settings have been checked and double checked to ensure the MQ and user configurations are the same.
Are there known problems with authentication with Win2K that do not happen on NT4?
Thanks in advance. |
|
| Back to top |
|
|
| jefflowrey |
| Posted: Wed Sep 22, 2004 9:40 am Post subject: |
|
|
Grand Poobah
Joined: 16 Oct 2002
Posts: 19981
|
Is your W2K box in a domain?
_________________
I am *not* the model of the modern major general. |
|
| Back to top |
|
|
| brad_matrix |
| Posted: Thu Sep 23, 2004 12:27 am Post subject: |
|
|
Newbie
Joined: 22 Sep 2004
Posts: 6
Location: US
|
The Win2K box and NT4 box are both on the same domain.
However the Solaris box reports as not being able to accertain the Networ Domain. I dont think the Solaris box is on the same domain.
In addition I did apply the latest patch for MQSeries 5.2 but no joy. |
|
| Back to top |
|
|
| PeterPotkay |
| Posted: Thu Sep 23, 2004 3:55 am Post subject: |
|
|
Poobah
Joined: 15 May 2001
Posts: 7722
|
For both the NT box and the 2K box, can you ru dspmqaut commands for the ID in question for the QM and Q in question, and post the results.
If you added myuser to the mqm group, after you added myuser to the mqm group on the 2K box, did you issue the REFRESH SECURITY command to the QM? If not, it doesn't know that you made changes to the mqm group.
_________________
Peter Potkay
Keep Calm and MQ On |
|
| Back to top |
|
|
| brad_matrix |
| Posted: Thu Sep 23, 2004 4:42 am Post subject: |
|
|
Newbie
Joined: 22 Sep 2004
Posts: 6
Location: US
|
| PeterPotkay wrote: |
...If you added myuser to the mqm group, after you added myuser to the mqm group on the 2K box, did you issue the REFRESH SECURITY command to the QM? If not, it doesn't know that you made changes to the mqm group. |
I did not.
However I then rebooted the Win2K box(after much bartering with the IT staff) and it is now working on the Win2K box as well.
Many thanks for all your help! |
|
| Back to top |
|
|
| PeterPotkay |
| Posted: Thu Sep 23, 2004 4:45 am Post subject: |
|
|
Poobah
Joined: 15 May 2001
Posts: 7722
|
The reboot had the same effect as the REFRESH CLUSTER command.
The QM caches all its OAM data, for performance reasons. If you make changes to MQ authorities via setmqaut, the OAM is updated right away.
But if you add a member to a group, the OAM has no reason to refresh its cache at that point, so the new user in a group that has permissions doesn't have the permissions, until the OAM refreshes its cache and then sees the new member (or deleted members, or new groups, etc).
A reboot will referesh the cache as the QM comes up, and so will the command REFRESH SECURITY.
_________________
Peter Potkay
Keep Calm and MQ On |
|
| Back to top |
|
|
| jefflowrey |
| Posted: Thu Sep 23, 2004 5:16 am Post subject: |
|
|
Grand Poobah
Joined: 16 Oct 2002
Posts: 19981
|
Peter
I'm not positive that Refresh Security works on 5.2
_________________
I am *not* the model of the modern major general. |
|
| Back to top |
|
|
| PeterPotkay |
| Posted: Thu Sep 23, 2004 7:40 am Post subject: |
|
|
Poobah
Joined: 15 May 2001
Posts: 7722
|
Your right I think. Another reason to get off that unsupported version of MQ!
A QM bounce will have the same effect if you don't want to reboot.
_________________
Peter Potkay
Keep Calm and MQ On |
|
| Back to top |
|
|
|
|
