Connecting IBM App Connect to IBM MQ

You want to connect your integration to IBM MQ by using mutual authentication.

1. Download the set of sample files: cp4i-ace-mq.zip.

   This .zip file contains a BAR file with a basic IBM MQ integration and a set of configuration files for setting up the system.

2. Extract the contents of the .zip file to a directory that you can use for working through the tutorial. The .zip file contains the following contents:
   • mqtest.bar: A BAR file that contains a simple integration that reads messages from one IBM MQ queue to another IBM MQ queue.
   • mqtest: A policy project (in a subdirectory) that contains the connection details to an IBM MQ queue manager.
   • mtlsqm: A YAML file (mtlsqm.yaml) that contains configuration properties for an IBM MQ queue manager.
   • application.kdb: A key databases file that contains public certificates and an application private key with the aceclient label.
     Note: The mqtest.bar file references this label, so if you decide to create your own key databases file, you must ensure that the application private key has an aceclient label.
   • application.sth: A stashed password for the key databases file (application.kdb).
   • server.conf.yaml: A file that contains override properties to configure the keystore path to be used by IBM MQ nodes.
   • queue-manager-certs: A subdirectory that contains the public certificates and the server private key that are used to set up the IBM MQ queue manager:
     • application.crt: The public certificate of the application
     • server.crt: The public certificate of the server
     • server.key: The private key of the server
   • prepare_and_upload_configurations.sh: A script that shows how to create or update configurations by using the Red Hat® OpenShift® CLI (oc).
3. Log in to your Red Hat OpenShift cluster from the command line and ensure that you are in the same project where you deployed the IBM Cloud Pak for Integration Platform UI.
4. Before you run the prepare_and_upload_configurations.sh script, mark it as an executable file by running the following command:

   chmod +x prepare_and_upload_configurations.sh

5. Run the prepare_and_upload_configurations.sh script, which you can find in the .zip file.

   This script uploads certificates, and creates the secrets, policies, and configuration files for IBM App Connect and IBM MQ. The script creates or updates the necessary configurations by using the oc apply -f command, then causes the integration server to do a rolling restart to pick up the changes. You can modify this script to create any number of different configurations that you need. It compresses the policy project into a .zip file, then creates or updates each configuration object in the cluster.

6. Change to the directory that contains the queue manage certificates by running the following command:

   cd "queue-manager-certs"

7. Create two Kubernetes secrets by running the following commands. These secrets enable SSL communication between the IBM MQ queue manager and IBM App Connect by using the server.crt and server.key certificates in the queue-manager-certs folder of the .zip file.

   oc create secret tls qmcerts --cert=server.crt --key=server.key

   oc create secret generic mqtrustcerts --from-file=application.crt

8. Set up an IBM MQ queue manager by using the mtlsqm.yaml file in the .zip file.

   The YAML file deploys a queue manager that is called mtlsqm, which is configured to use the secrets that you created in the previous step. The YAML file also creates two local queues that are called IN and OUT.

   1. Edit mtlsqm.yaml to replace both occurrences of <PROJECT> with the name of your Red Hat OpenShift project where the Platform UI is installed.
   2. To apply the YAML file, run the following command from the command line.

      oc apply -f mtlsqm.yaml

You now use the App Connect Dashboard to configure an integration server that connects to IBM MQ by using mutual authentication. The simple example flow contains an integration that moves messages from the IN queue to the OUT queue in an IBM MQ system. The same configuration can be used for far more complex integrations that include interactions with other external systems.

Before you begin

Update the extracted contents of the cp4i-ace-mq.zip file as follows:

• The mqtest policy project contains a policy that is called mq, which is used as the MQEndpoint policy for IBM MQ nodes that connect to IBM MQ by using mutual authentication. Update the policy project as follows:
  1. From the mqtest subdirectory, open mq.policyxml and examine the settings. Notice that the values in this file are the same values that were supplied earlier for creating a queue manager and an application channel in your IBM MQ system.

     If your queue manager is not running in the same Red Hat OpenShift namespace (or project) as your integration server, you need to update the queueManagerHostname value.

  2. Create a .zip file of the mqtest subdirectory (and its updated contents). You use this .zip file to create a policy project configuration later.
• Examine the server.conf.yaml file. Notice that the mqKeyRepository entry is set up to use the keystore configuration for the application.kdb and application.sth keystore files. These files contain the public certificates and application private key for connecting to IBM MQ with mutual authentication.

Procedure

To create the integration server and configure it to connect to IBM MQ, complete the following steps:

1. From your App Connect Dashboard instance, click the Dashboard icon in the navigation panel.
2. On the Servers page, click Create server.
3. Choose Quick start integration as the type of integration and click Next.
4. Provide mqtest.bar as the BAR file that you want to deploy and click Next.
5. From the Configuration view, select each of the configurations and click Next.
   The configurations were created when you ran the prepare_and_upload_configurations.sh script. Ensure that the configurations have the correct names.

   • application.kdb is a keystore file that is referenced by the server.conf.yaml file.
   • application.sth is a keystore that is referenced by the server.conf.yaml file.
   • mqtest-policyproject is the policy project.
   • mqtest-server.conf.yaml is the server.conf.yaml file.
6. Define the following details for the integration server:
   1. Give the integration server the name mqtest.
   2. Ensure that the Designer flows mode is set to disabled, which is required when deploying a Toolkit integration.
   3. Set the application transport for the integration endpoint to http.
   4. Click Create. The integration server starts and is ready to handle messages. (You might need to refresh the page to see the Started state on the integration server's tile.)

To test your flow in IBM MQ, put a sample message on the IN queue. You can expect the message to be moved onto the OUT queue.

This tutorial shows how to set up an integration server to securely connect to IBM MQ by using mutual authentication.