IBM Support

IT32292: AMQ5542 message misleadingly mentions CHCKCLNT(REQDADM) when using LDAP for users/groups

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • When an application was connecting a queue manager configured
    with LDAP for users/groups, and supplied an incorrect password,
    the AMQ5542 error message that was misleading:
    
    AMQ5542: The failed authentication check was caused by the queue
    manager CONNAUTH CHCKCLNT(REQDADM) configuration.
    EXPLANATION:
    The user ID 'my.username' and its password were checked because
    the queue manager connection authority (CONNAUTH) configuration
    refers to an authentication information (AUTHINFO) object named
    'my.authinfo' with CHCKCLNT(REQDADM).
    
    The Knowledge Centre entry stated that REQDADM was "irrelevant"
    when used with LDAP, causing confusion as to why REQDADM could
    cause a password check if it is irrelevant.
    

Local fix

Problem summary

  • ****************************************************************
    USERS AFFECTED:
    Users with a queue manager using LDAP for users/groups, reading
    an AMQ5542 message in their error logs stating CONNAUTH
    CHCKCLNT(REQDADM) caused the authentication check.
    
    
    Platforms affected:
    MultiPlatform
    
    ****************************************************************
    PROBLEM DESCRIPTION:
    The error message, paired with the Knowledge Centre, was
    misleading and caused confusion.
    

Problem conclusion

  • Extra clarification has been added to the AMQ5542 message on how
    CHCKCLNT(REQDADM) works when paired with LDAP:
    
    "Note that if the authentication configuration specifies an LDAP
    user repository,
    a CHCKCLNT value of REQDADM is treated as equivalent to a value
    of OPTIONAL."
    
    The Knowledge Centre entry is to be updated to remove the word
    "irrelevant" and clarify the OPTIONAL behaviour when using LDAP
    for group resolution.
    
    ---------------------------------------------------------------
    The fix is targeted for delivery in the following PTFs:
    
    Version    Maintenance Level
    v9.0 LTS   9.0.0.11
    v9.1 LTS   9.1.0.7
    v9.2 LTS   9.2.0.2
    v9.x CD    9.2.1
    
    The latest available maintenance can be obtained from
    'WebSphere MQ Recommended Fixes'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
    
    If the maintenance level is not yet available information on
    its planned availability can be found in 'WebSphere MQ
    Planned Maintenance Release Dates'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
    ---------------------------------------------------------------
    

Temporary fix

Comments

APAR Information

  • APAR number

    IT32292

  • Reported component name

    IBM MQ BASE M/P

  • Reported component ID

    5724H7261

  • Reported release

    900

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2020-03-24

  • Closed date

    2020-07-10

  • Last modified date

    2021-03-03

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    IBM MQ BASE M/P

  • Fixed component ID

    5724H7261

Applicable component levels

[{"Line of Business":{"code":"LOB36","label":"IBM Automation"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSYHRD","label":"IBM MQ"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"9.0"}]

Document Information

Modified date:
05 March 2021