IC90674: IIS APPLICATION FAILS TO REMOTELY CONNECT TO A QUEUE MANAGER AND REPORTS 'SYSTEM.COMPONENTMODEL.WIN32EXCEPTION'

WebSphere MQ V7.5 Fix Pack 7.5.0.2
Fix Pack 7.1.0.4 for WebSphere MQ V7.1
WebSphere MQ v7.5.0.2 Hypervisor for RHEL

APAR status

• Closed as program error.

Error description

• IIS application fails to remotely connect to a queue manager
  and throws Win32Exception with access denied error on an
  OpenProcess call
  
  Exception Reported for the first time :
  System.Reflection.TargetInvocationException: Exception has been
  thrown by the target of an invocation. --->
  System.Reflection.TargetInvocationException: Exception has been
  thrown by the target of an invocation. --->
  System.ComponentModel.Win32Exception: Access is denied at
  System.Diagnostics.ProcessManager.OpenProcess(Int32 processId,
  Int32 access, Boolean throwIfExited) at
  System.Diagnostics.NtProcessManager.GetModuleInfos(Int32
  processId, Boolean firstModuleOnly) at
  System.Diagnostics.Process.get_Modules() at
  IBM.WMQ.CommonServices.TraceEnvironment() at
  IBM.WMQ.CommonServices.CreateCommonServices() at
  IBM.WMQ.CommonServices.TraceEnabled() at IBM.WMQ.MQBase..ctor()
  
  This connection, however, works locally because
  authentication/impersonation works differently when connection
  is local vs when browsed from a client.
  

Local fix

• Granting "Query process information and read process virtual
  memory" rights to the impersonated user so that OpenProcess
  succeeds.
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users of IIS applications that remotely connects to Queue
  manager
  
  Platforms affected:
  Windows
  
  ****************************************************************
  PROBLEM SUMMARY:
  WebSphere MQ client code issues an OpenProcess call on itself.
  However, an IIS application with impersonation turned ON does
  not have the required security privileges to issue OpenProcess
  call on itself. Hence the application throws Win32Exception with
  access denied error.
  

Problem conclusion

• WebSphere MQ client code has been modified such that the
  Win32Exception is handled gracefully.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following:
  
                     v7.1
  Platform           Fix Pack 7.1.0.4
  --------           --------------------
  Windows            7.1.0.4
  
  Version            v7.5
  --------           --------------------
  Fix available in:  7.5.0.2
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WMQ WINDOWS V7

• Fixed component ID

  5724H7220

Applicable component levels

• R710 PSY

     UP