IT26557: When ChlAuthEarlyAdopt is enabled the MQCSP supplied by the application is authenticated prior

APAR status

• Closed as program error.

Error description

• After applying APAR IT25839, it is observed that a security
  exit, when called with SEC_PARMS, may not influence the MQCSP
  security that is used for CONNAUTH checking, if
  ChlAuthEarlyAdopt is enabled.
  
  
  An example of an affected scenario is as follows:
  
  A client application attempted to connect to a queue manager by
  passing invalid credentials in the MQCSP structure.  Those
  credentials were corrected by a server-side security exit but
  the connection failed and the application received a
  MQRC_NOT_AUTHORIZED error.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  This issue affects users of MQ V8 and later who configure their
  queue manager with the setting chlauthearlyadopt=y and use a
  security exit to change the contents of the MQCSP structure.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  A logic error in the MQ code prevented the queue manager from
  using the credentials returned by the security exit for
  authentication.
  

Problem conclusion

•  The queue manager logic has been modified to fix this error so
  that the user is authenticated using the new credentials after
  the security exit has been called.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v8.0       8.0.0.11
  v9.0 LTS   9.0.0.6
  v9.1 CD    9.1.2
  v9.1 LTS   9.1.0.1
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE MP

• Fixed component ID

  5724H7251

Applicable component levels