MQSeries.net :: View topic

TMQ · Posted: Mon Jun 29, 2009 8:01 am Post subject: Help with Linux MQ using AD LDAP

Hello All,

I'm currently building a proof of concept to host our MQ server from Linux (instead to it's current Windows Server home). I'm having troubles configuring the LDAP services to properly consult AD for authorization to specific objects. Here's more detail:

I've built the various LDAP configuration files into /etc/ and I can use LDAP to properly authenticate my local user logons and such to the Linux machine. So I'm confident that my bind name and various pointers are properly configured. My trouble is that when I use the 'setmqaut' command (or the similar GUI commands) MQ's response is 'Unknown group (AMQ4808). This happens for any group known by AD, but not in the local /etc/group file.

What I don't get about this is that if I switch my config files to use a Linux hosted LDAP server, it will work as expected. I can then setmqaut a group which exists only on the LDAP server and MQ is happy with that. Only when I redirect the LDAP to Windows AD does it fail

Also, I've tried configuring the host Linux system to use WINBIND and SAMBA. This also results in a successful authorization of local resources against the AD server (as long as I properly build the domain name), but any attempt to add an AD LDAP served group to MQ using setmqaut yeilds the QMQ4808 message.

Has anyone else implemented this architecture? Any tips or hints (or outright answers!) are welcome.

Version specifics:

MQ server - MQ V7 running on RHEL 5.0
Windows AD is the LDAP server.

Thanks.