| Author |
Message
|
| vmcgloin |
 Posted: Mon Jun 16, 2003 4:54 am Post subject: NT security AMQ4036 and AMQ8077 |
 |
|
Knight
Joined: 04 Apr 2002
Posts: 560
Location: Scotland
|
Hi,
MQ5.3 on NT.
When trying to connect to a remote qmgr we get an error:
| Quote: |
| AMQ4036 Access not authorized. You are not authorized to perform this operation. |
The corresponding error at the remote machine is:
| Quote: |
AMQ8077 Entity 'myUserid' has insufficient authority to access object 'QM_name'.
Explanation: The specified entity is not authorized to access the required object. The following requested permissions are unauthorized: connect
User Response: Ensure that the correct level of authority has been set for this entity against the required object, or ensure that the entity is a member of a privileged group. |
This occurs only when connecting to NT qmgrs, and only when logged on a users on a 'company-wide' domain. If we log on to the PC locally with the same userid the connection is OK. The remote PC has the same userid locally with the same password and is in the administrators, mqm, and mqsi groups (mqb*).
My understanding is/was that MQ would look to see if there was a matching local userid first before going to the domain level. Any suggestions?
Thanks,
Vicky |
|
| Back to top |
|
 |
| mqonnet |
| Posted: Sat Jun 28, 2003 2:38 am Post subject: |
|
|
Grand Master
Joined: 18 Feb 2002
Posts: 1114
Location: Boston, Ma, Usa.
|
So you say 'myUserid' is the userid that you use from 2 different domains and it works from one and not from the other???
I havent played much with multiple domains, but i would assume what your understanding is make logical sense.
Are you connecting to these qms as a client or as a server app???
Did you check that the userid 'myUserid' on both systems on different domains are exactly the same, including case and that it matches with the principal you have defined on your remote queue manager.
Cheers
Kumar |
|
| Back to top |
|
|
| interactivechannel |
| Posted: Mon Jun 30, 2003 1:13 am Post subject: |
|
|
Voyager
Joined: 20 May 2003
Posts: 94
Location: uk
|
| Have a look on the queue managers and see if the ‘SecurityPolicy’ option is set to ‘NTSIDsRequired’ (accessed from the WebSphere MQ Services snap-in). I think this defaults to being on, which means MQ is checking the SID not just the ID. Therefore you need to authorise the domain accounts on the queue managers. The easiest way to do this is stick them in a domain group and come up with a basic script to be run on all queue managers. |
|
| Back to top |
|
|
| Nasirul Haque |
| Posted: Mon Jul 05, 2010 2:24 am Post subject: |
|
|
Newbie
Joined: 05 Jul 2010
Posts: 7
|
Hi,
I am having this problem in Windows 2000 SP4. Recently the domain and username has changed for the desktop where Queue Manager is running and I am getting AMQ8077 error. Can you please suggest what I need to do to fix the problem.
Thanks
contact admin Haque |
|
| Back to top |
|
|
| shashivarungupta |
| Posted: Mon Jul 05, 2010 4:21 am Post subject: |
|
|
Grand Master
Joined: 24 Feb 2009
Posts: 1343
Location: Floating in space on a round rock.
|
| vmcgloin wrote: |
| MQ5.3 on NT |
MQ5.3 Still ? 
| vmcgloin wrote: |
...When trying to connect to a remote qmgr we get an error
...when connecting to NT qmgrs, and only when logged on a users on a 'company-wide' domain. |
has your user id given access authorities to connect to the qmgr 'Remotely' ?
_________________
*Life will beat you down, you need to decide to fight back or leave it.
Last edited by shashivarungupta on Mon Jul 05, 2010 4:52 am; edited 1 time in total |
|
| Back to top |
|
|
| shashivarungupta |
| Posted: Mon Jul 05, 2010 4:25 am Post subject: |
|
|
Grand Master
Joined: 24 Feb 2009
Posts: 1343
Location: Floating in space on a round rock.
|
| contact admin Haque wrote: |
| I am having this problem in Windows 2000 SP4. Recently the domain and username has changed for the desktop where Queue Manager is running and I am getting AMQ8077 error. Can you please suggest what I need to do to fix the problem. |
Have you googled ? OR Checked the IBM Sites for help ?
Have a look at this !!
http://www-01.ibm.com/support/docview.wss?uid=swg21188194
_________________
*Life will beat you down, you need to decide to fight back or leave it. |
|
| Back to top |
|
|
| Nasirul Haque |
| Posted: Mon Jul 05, 2010 7:30 am Post subject: |
|
|
Newbie
Joined: 05 Jul 2010
Posts: 7
|
Hi,
I have google and gone through the same link but it is of no help in my case. I am trying to connect to my queue manager on my desktop using MQ Explorer and an unable to do it. I dont have a scenario wherein QM interaction is happening between 2 domains. In my case the queue manager was earlier in one domain and it has now been changed to a different domain. After the change of the domain I am unable to connect to the queue manager through MQ explorer.
Thanks |
|
| Back to top |
|
|
| shashivarungupta |
| Posted: Mon Jul 05, 2010 8:06 am Post subject: |
|
|
Grand Master
Joined: 24 Feb 2009
Posts: 1343
Location: Floating in space on a round rock.
|
| contact admin Haque wrote: |
| ..In my case the queue manager was earlier in one domain and it has now been changed to a different domain. After the change of the domain I am unable to connect to the queue manager through MQ explorer. |
Your userid dont have access to connect to the qmgr as your computer belongs to some new domain and user id has to be given access privileges.
By the way... what all you have done to eliminate that problem ?
_________________
*Life will beat you down, you need to decide to fight back or leave it. |
|
| Back to top |
|
|
| Vitor |
| Posted: Mon Jul 05, 2010 8:59 am Post subject: |
|
|
Grand High Poobah
Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA
|
| contact admin Haque wrote: |
Hi,
I am having this problem in Windows 2000 SP4. Recently the domain and username has changed for the desktop where Queue Manager is running and I am getting AMQ8077 error. Can you please suggest what I need to do to fix the problem.
Thanks
contact admin Haque |
It's considered rude to reopen an old post. You've also been told about double posting and this is a double of this.
Don't double post. 
_________________
Honesty is the best policy.
Insanity is the best defence. |
|
| Back to top |
|
|
|
|
