IT28555: MQ V8.0.0.11 client with client-side security exit fails to connect gets AMQ8077 authority errors

APAR status

• Closed as program error.

Error description

• When using a client-side exit with an MQ Client application to
  connect to queue manager with CONNAUTH enabled,
  connections can fail if ChlAuthEarlyAdopt=Y is set in the
  qm.ini.
  
  The queue manager reports that the user does not have +altusr
  and +inq MQ authority on the queue manager.
  
  AMQQ8077: Entity '??' has insufficient authority to access
  object '??'.
  
  EXPLANATION:
  The specified entity is not authorized to access the required
  object. The following requested permissions are unauthorized:
  altusr
  
  If you do not use a client side exit then this problem is not
  observed.
  

Local fix

• Do not use client-side exit
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  This issue affects users who use a CLNTCONN channel with a
  client-side
  security exit to connect to a SVRCONN channel on a V8.0.0.9 and
  later
  queue manager with ChlAuthEarlyAdopt=Y configured in the qm.ini.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  A client application attempted to connect to a queue manager
  with ChlAuthEarlyAdopt=Y configured in the qm.ini file.  The
  client used a client-side security exit to connect
  to a SVRCONN channel.
  
  The connection failed with two AMQ8077 errors which stated that
  the user did not have '+altusr' and '+inq' permission for the
  queue manager.  When the client-side exit was removed from the
  channel then the connection succeeded.
  
  Examples of the errors are shown below:
  
  ----------------------------------------------------------------
  ---------------
  03/14/19 12:37:06 - Process(494.12) User(root) Program(amqzlaa0)
                      Host(377881bc1732)
  Installation(Installation1)
                      VRMF(8.0.0.11) QMgr(80011)
  
  AMQ8077: Entity 'guest1' has insufficient authority to access
  object '80011'.
  
  EXPLANATION:
  The specified entity is not authorized to access the required
  object. The
  following requested permissions are unauthorized: altusr
  ACTION:
  Ensure that the correct level of authority has been set for this
  entity against
  the required object, or ensure that the entity is a member of a
  privileged
  group.
  ----- amqzfubx.c : 1495
  -------------------------------------------------------
  03/14/19 12:37:06 - Process(494.12) User(root) Program(amqzlaa0)
                      Host(377881bc1732)
  Installation(Installation1)
                      VRMF(8.0.0.11) QMgr(80011)
  
  AMQ8077: Entity 'guest1' has insufficient authority to access
  object '80011'.
  
  EXPLANATION:
  The specified entity is not authorized to access the required
  object. The
  following requested permissions are unauthorized: inq
  ACTION:
  Ensure that the correct level of authority has been set for this
  entity against
  the required object, or ensure that the entity is a member of a
  privileged
  group.
  ----- amqzfubx.c : 1495
  -------------------------------------------------------
  
  The connection should have been successful because the user
  should not require '+altusr' and '+inq' permission to connect to
  the queue manager.  The issue was caused by a programming error
  in the queue manager.
  

Problem conclusion

• The error has been fixed so that the user does not require
  +altusr and +inq permissions.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v8.0       8.0.0.13
  v9.0 LTS   9.0.0.7
  v9.1 CD    9.1.3
  v9.1 LTS   9.1.0.3
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE MP

• Fixed component ID

  5724H7251

Applicable component levels