ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum Index » IBM MQ Security » AD Group - Getting 'Not authorised' : SOLVED!

Post new topic  Reply to topic
 AD Group - Getting 'Not authorised' : SOLVED! « View previous topic :: View next topic » 
Author Message
exerk
PostPosted: Tue Mar 13, 2018 3:40 am    Post subject: AD Group - Getting 'Not authorised' : SOLVED! Reply with quote

Jedi Council

Joined: 02 Nov 2006
Posts: 6339

A bit of a head-scratcher for me folks, and I know I'm doing something obviously wrong, but not sure of what that wrong is.

MQ V9.0.0.2 on RHEL 7

1. UNIX-enabled AD Group, populated with the required 'people', and role-based security set on the UNIX queue manager for that Group;

2. 'getent' command on the UNIX server enumerates the members of the Group;

3. CONNAUTH CHECKCLNT(OPTIONAL) set on the queue manager, CHLAUTH disabled (I know, but it's not my train set!);

4. Connection from MQ Explorer (no password is being sent) fails with 'Not authorised: connect' for a user in the Group (me);

5. Displaying ENTAUTH shows the AD Group has the required authorisations;

6. CONNAUTH disabled, security refreshed, same issue - 'Not authorised: connect';

7. id on the box shows me as having a local group, and also being a member of the AD Group, so I set role-based permission against my local group;

8. Magically, I can now get in (my Windows userid and UNIX one/group are identical).

I also tried this with other users in the AD Group - same issue - so at first sight it appears to me that the AD Group is not being enumerated.

This one has me nonplussed because I'm sure (as said above) I'm missing something blindingly obvious!
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys.
Back to top
View user's profile Send private message
exerk
PostPosted: Thu Apr 12, 2018 5:20 am    Post subject: Reply with quote

Jedi Council

Joined: 02 Nov 2006
Posts: 6339

Problem solved by setting an environment variable, MQS_GETGROUPLIST_API=1, and bouncing the queue manager. THIS ARTICLE provides more detailed information.
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic  Reply to topic Page 1 of 1

MQSeries.net Forum Index » IBM MQ Security » AD Group - Getting 'Not authorised' : SOLVED!
Jump to:  



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP
 
 


Theme by Dustin Baccetti
Powered by phpBB © 2001, 2002 phpBB Group

Copyright © MQSeries.net. All rights reserved.