IT08408: MQ V8: WHEN USING THE CONNAUTH FEATURE THE ERROR MESSAGE AMQ9557 COULD CAUSE CONFUSION .

APAR status

• Closed as program error.

Error description

• If a Websphere MQ queue manager is configured to check userid
  and password with these settings:
  
  - ALTER QMGR CONNAUTH(LOCAL.ISPW)
  - DEF AUTHINFO(LOCAL.ISPW) AUTHTYPE(IDPWOS) CHCKCLNT(OPTIONAL)
   ADOPTCTX(YES)
  
  and the following is used
  
  - USER_OWNER : user ID used to start the client application (or
   owner of the application)
  - USER_MQCSP : user ID passed in MQCSP structure for
   authorization check. The password is also provided in MQCSP
   structure.
  
  In these scenarios the error message AMQ9557 may cause
  confusion:
  
  Scenario 1:
   USER_MQCSP has no authority to access the queue manager.
   The client application fails to connect and following error
   messages are generated in queue manager error log:
  
   AMQ8077: Entity 'USER_MQCSP' has insufficient authority to
   access object 'QM1'.
   EXPLANATION:
   The specified entity is not authorized to access the required
   object.
   The following requested permissions are unauthorized: connect
  
   AMQ9557: Queue Manager User ID initialization failed for
   'USER_OWNER'.
   EXPLANATION:
   The call to initialize the User ID 'USER_OWNER' failed with
   CompCode 2 and Reason 2035.
  
  Scenario 2:
   USER_MQCSP has authority to connect and open objects on QM1.
   But the password is incorrect.
   The client application fails to connect and following error
   messages are generated in queue manager error log:
  
   AMQ5534: User ID 'USER_MQCSP' authentication failed
   EXPLANATION:
   The user ID and password supplied by 'amqsputc' could not be
   authenticated.
  
   AMQ5542: The failed authentication check was caused by the
   queue manager CONNAUTH CHCKCLNT(OPTIONAL)
   configuration.
   EXPLANATION:
   The user ID 'USER_MQCSP' and its password were checked because
   the queue manager connection authority (CONNAUTH)
   configuration refers to an authentication information
   (AUTHINFO) object named 'LOCAL.ISPW' with CHCKCLNT(OPTIONAL).
   This message accompanies a previous error to clarify the
   reason for the user ID
  
  
   AMQ9557: Queue Manager User ID initialization failed for
   'USER_OWNER'.
   EXPLANATION:
   The call to initialize the User ID 'USER_OWNER' failed with
   CompCode 2 and Reason 2035.
  
  In both scenarios AMQ9557 presents the asserted User ID not the
  attempted User ID
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users of Websphere MQ v8.0 queue manager using the connauth
  feature
  who are passing a user ID in MQCSP structure for the
  authorization check, where that user ID has no authority to
  access the queue manager, or
  where the user ID passed in MQCSP structure has authority to
  access the queue
  manager but the password is incorrect.
  
  
  
  
  
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  A programming error within the queue manager code to generate
  this log message meant that the wrong user ID was inserted into
  the error logs within the AMQ9557 message
  

Problem conclusion

• The queue manager security component has been updated so that
  the AMQ9557 error will show the attempted User ID rather than
  the asserted User ID.
  
  In terms of the scenario described above, this means that the
  AMQ9557 message will now show USER_MQCSP rather than USER_OWNER
  in this case.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v8.0       8.0.0.3
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WMQ BASE MULTIP

• Fixed component ID

  5724H7251

Applicable component levels

• R800 PSY

     UP