IT16598: Authorization to remote cluster queue using generic profiles fails with RC 2035 MQRC_NOT_AUTHORIZED

APAR status

• Closed as program error.

Error description

• If setting a user's authorization for a remote cluster queue
  using generic profiles, MQOPEN or MQPUT1 calls for the remote
  cluster queue fail with "2035" (MQRC_NOT_AUTHORIZED).
  
  There is no problem if the profile is a fully qualified remote
  cluster queue name.
  
  The MQ trace captures the error message as posted below:
  .
  xxx    yyy  CONN:000010 (10)-----------}!
  gpiCheckObjectAuthority rc=arcE_OBJECT_NOT_FOUND
  FunctionTime=124
  xxx    yyy  CONN:000010 (09)----------}!
  kqiAuthorityChecks rc=arcE_OBJECT_NOT_FOUND FunctionTime=130
  

Local fix

• Use partially qualified generic profiles
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  This problem is only seen when trying to use generic profiles to
  provide authorization control for remotely-defined cluster
  queues.
  
  The issue is observed only if the
  ClusterQueueAccessControl=RQMName is set in the queue manager's
  qm.ini file.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  A logic omission meant that the generic authority matching code
  for remotely-defined cluster objects was invoked only for topics
  in this scenario, instead of topics and queues. This meant that
  the generic authority was not evaluated if there was no specific
  authority profile defined for the cluster queue, resulting in an
  authorization failure.
  

Problem conclusion

• The queue manager's generic authority matching code in for
  remotely-defined cluster objects has been updated to apply to
  both queues and topics.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v8.0       8.0.0.8
  v9.0 CD    9.0.4
  v9.0 LTS   9.0.0.3
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WMQ BASE MULTIP

• Fixed component ID

  5724H7251

Applicable component levels

• R800 PSY

     UP