IBM Support

IT28555: MQ V8.0.0.11 client with client-side security exit fails to connect gets AMQ8077 authority errors

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • When using a client-side exit with an MQ Client application to
    connect to queue manager with CONNAUTH enabled,
    connections can fail if ChlAuthEarlyAdopt=Y is set in the
    qm.ini.
    
    The queue manager reports that the user does not have +altusr
    and +inq MQ authority on the queue manager.
    
    AMQQ8077: Entity '??' has insufficient authority to access
    object '??'.
    
    EXPLANATION:
    The specified entity is not authorized to access the required
    object. The following requested permissions are unauthorized:
    altusr
    
    If you do not use a client side exit then this problem is not
    observed.
    

Local fix

  • Do not use client-side exit
    

Problem summary

  • ****************************************************************
    USERS AFFECTED:
    This issue affects users who use a CLNTCONN channel with a
    client-side
    security exit to connect to a SVRCONN channel on a V8.0.0.9 and
    later
    queue manager with ChlAuthEarlyAdopt=Y configured in the qm.ini.
    
    
    Platforms affected:
    MultiPlatform
    
    ****************************************************************
    PROBLEM DESCRIPTION:
    A client application attempted to connect to a queue manager
    with ChlAuthEarlyAdopt=Y configured in the qm.ini file.  The
    client used a client-side security exit to connect
    to a SVRCONN channel.
    
    The connection failed with two AMQ8077 errors which stated that
    the user did not have '+altusr' and '+inq' permission for the
    queue manager.  When the client-side exit was removed from the
    channel then the connection succeeded.
    
    Examples of the errors are shown below:
    
    ----------------------------------------------------------------
    ---------------
    03/14/19 12:37:06 - Process(494.12) User(root) Program(amqzlaa0)
                        Host(377881bc1732)
    Installation(Installation1)
                        VRMF(8.0.0.11) QMgr(80011)
    
    AMQ8077: Entity 'guest1' has insufficient authority to access
    object '80011'.
    
    EXPLANATION:
    The specified entity is not authorized to access the required
    object. The
    following requested permissions are unauthorized: altusr
    ACTION:
    Ensure that the correct level of authority has been set for this
    entity against
    the required object, or ensure that the entity is a member of a
    privileged
    group.
    ----- amqzfubx.c : 1495
    -------------------------------------------------------
    03/14/19 12:37:06 - Process(494.12) User(root) Program(amqzlaa0)
                        Host(377881bc1732)
    Installation(Installation1)
                        VRMF(8.0.0.11) QMgr(80011)
    
    AMQ8077: Entity 'guest1' has insufficient authority to access
    object '80011'.
    
    EXPLANATION:
    The specified entity is not authorized to access the required
    object. The
    following requested permissions are unauthorized: inq
    ACTION:
    Ensure that the correct level of authority has been set for this
    entity against
    the required object, or ensure that the entity is a member of a
    privileged
    group.
    ----- amqzfubx.c : 1495
    -------------------------------------------------------
    
    The connection should have been successful because the user
    should not require '+altusr' and '+inq' permission to connect to
    the queue manager.  The issue was caused by a programming error
    in the queue manager.
    

Problem conclusion

  • The error has been fixed so that the user does not require
    +altusr and +inq permissions.
    
    ---------------------------------------------------------------
    The fix is targeted for delivery in the following PTFs:
    
    Version    Maintenance Level
    v8.0       8.0.0.13
    v9.0 LTS   9.0.0.7
    v9.1 CD    9.1.3
    v9.1 LTS   9.1.0.3
    
    The latest available maintenance can be obtained from
    'WebSphere MQ Recommended Fixes'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
    
    If the maintenance level is not yet available information on
    its planned availability can be found in 'WebSphere MQ
    Planned Maintenance Release Dates'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
    ---------------------------------------------------------------
    

Temporary fix

Comments

APAR Information

  • APAR number

    IT28555

  • Reported component name

    IBM MQ BASE MP

  • Reported component ID

    5724H7251

  • Reported release

    800

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2019-03-22

  • Closed date

    2019-04-29

  • Last modified date

    2019-07-08

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    IBM MQ BASE MP

  • Fixed component ID

    5724H7251

Applicable component levels

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSYHRD","label":"IBM MQ"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.0.0.0","Edition":"","Line of Business":{"code":"LOB36","label":"IBM Automation"}}]

Document Information

Modified date:
08 July 2019