IT24067: Authorised user connecting to MQ queue manager on Windows unexpectedly receives 2035(MQRC_NOT_AUTHORIZED)

APAR status

• Closed as program error.

Error description

• When adopt context (ADOPTCTX) is set to yes and MQCSP
  authentication is enabled , the client receives
  2035 error from QMGR when attempting to authenticate a user who
  is expected to have access to the queue manager.
  
  The following error is seen from the
  trace.
  {  zfu_as_CheckObjectAuthority
  EntityName     [userName]
  EntityDomain   <null>
  EntityType     1
  ObjectName     <QMGR_Name>
  ObjectType     5
  AccessTemplate 1
  F:\build\slot1\p900_P\src\lib\exits\oam\pc\winnt\amqzfubn.c
  (20)---------------------{  zfu_as_CalculateAuthority
  No valid SID, SecurityId field:
  (19)--------------------{  zfp_ss_unlock_service
  (19)--------------------}  zfp_ss_unlock_service (rc=OK)
  (18)-------------------}! gpiCheckObjectAuthority
  (rc=lrcE_NOT_AUTHORIZED)
  (17)------------------}! kqiAuthorityChecks
  (rc=lrcE_NOT_AUTHORIZED)
  (17)------------------{  kqiErrorEvent
  (17)------------------}! kqiErrorEvent (rc=krcI_EVENT_OFF)
  (16)-----------------}! kqiAuthenticateUserForAdopt
  (rc=lrcE_NOT_AUTHORIZED)
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users of MQ connecting to a QMGR which is running on a Windows
  system. and has ADOPTCTX set to YES and MQCSP authentication
  enabled.
  
  
  Platforms affected:
  Windows
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  A logic error in MQ meant that the mapping of SID and accounting
  token failed, due to which authorization errors are reported
  while connecting to the queue manager.
  

Problem conclusion

• The MQ queue manager Code has been modified such that the  SID
  and accounting token are  mapped appropriately in this scenario.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.0 LTS   9.0.0.5
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE M/P

• Fixed component ID

  5724H7261

Applicable component levels