| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| MQ 6.0 Explorer won't allow remote management, unlike 5.3MMC |
« View previous topic :: View next topic » |
| Author |
Message
|
| dogbert64 |
 Posted: Tue Aug 14, 2007 11:12 am Post subject: MQ 6.0 Explorer won't allow remote management, unlike 5.3MMC |
 |
|
Acolyte
Joined: 11 Jun 2003
Posts: 58
|
I have a coworker who had WebSphere MQ 5.3 installed on his desktop. We moved him to WebSphere MQ 6.0. Ever since then, he cannot connect to Remote Queue managers to manage them using MQExplorer, despite being in the Local MQM group on the target servers.
He could do this when he had 5.3 installed on this desktop.
The message he gets is below, and it shows up on the target server.
I also installed MQ 6.0 on my local desktop and have no problem managing Remote Queue Managers from MQExplorer.
What does he need to do to allow remote management of Queue Managers?
The servers are all running MQ 6.0.2.1 on either Windows 2000, or
Windows 2003.
He is running Windows XP, SP2 as all our desktops here.
******************************************************
Event Type: Warning
Event Source: WebSphere MQ
Event Category: None
Event ID: 8077
Date: 8/8/2007
Time: 1:55:06 PM
User: N/A
Computer: PRODMQ01
Description:
Entity 'jwilson' has insufficient authority to access object 'PMQ1'. |
|
| Back to top |
|
 |
| Michael Dag |
| Posted: Tue Aug 14, 2007 1:08 pm Post subject: |
|
|
Jedi Knight
Joined: 13 Jun 2002
Posts: 2607
Location: The Netherlands (Amsterdam)
|
so does he have the authority according to the qmgr or not? (see amqoamd -m Qmgr -s output...)
_________________
Michael
MQSystems Facebook page |
|
| Back to top |
|
|
| jeevan |
| Posted: Tue Aug 14, 2007 5:16 pm Post subject: Re: MQ 6.0 Explorer won't allow remote management, unlike 5. |
|
|
Grand Master
Joined: 12 Nov 2005
Posts: 1432
|
| Quote: |
Entity 'jwilson' has insufficient authority to access object 'PMQ1
|
Does this line tell something to you? Fix this problem than lets know happens. |
|
| Back to top |
|
|
| dogbert64 |
| Posted: Tue Sep 11, 2007 5:20 am Post subject: |
|
|
Acolyte
Joined: 11 Jun 2003
Posts: 58
|
Okay, finally got down to the root of the problem with this one. It turns out that he doesn't have proper security access to the queue manager.
But it's not as straight-forward as it sounds.
You see it turns out that there are multiple AD domains in my environment. All the employees and the Production servers are in one...I'll call it A. All the non-production servers are in another. I'll call it B.
It turns out that there is an account in B for my co-worker as well as A. This was unknown to us. I do not have an account in B, only in A. It also turns out that several years ago, they copied all the user accounts in A to B, for some Peoplesoft load-testing. The passwords are different mind you, but the userid names are the same. However, the bulk copy was a one-time event, so anyone hired after the copy only has an account in A, whereas anyone hired before the copy has an account in both A and B.
Now, what we have discovered is when you try to access a queue manager in B with an account in A, the queue manager looks up your userid in domain B first. If it finds a match, then it starts checking to see if you have membership in the local MQM (or a group which has been added to it). If not, then it stops and rejects you as being "Not Authorized". This is what was happening to my co-worker.
However, if it does not find the account in the domain B, then it starts performing lookups in the trusted domains, of which A is one of. If if finds a hit, then it starts looking up to see if you have membership in the local MQM (or a group which has been added to it). This is the path it was following for me.
This explains why both of us could manager queue manages in A, but only I could manage queue managers in B.
IBM has confirmed this via traces I sent them.
So the solution is to either delete his account out of B, or have him added to the local MQM group of each server in B (or be added to a group, which is in all the local MQM groups of B). |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
