IT35274: IBM MQ incorrectly generates AMQ8077W warning, reporting missing 'ALTUSR' access to qmgr when activity trace level set to HIGH

APAR status

• Closed as program error.

Error description

• When activity trace is enabled at the queue manager or on a
  specific channel with trace level set to HIGH in mqat.ini file,
  an incorrect error message is generated with user missing
  'altusr' authority when user connects to the queue manager.
  for example:
  AMQ8077W: Entity 'user1' has insufficient authority to access
  object QM1[qmgr].
  
  EXPLANATION:
  The specified entity is not authorized to access the required
  object. The
  following requested permissions are unauthorized: altusr
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users with activity trace enabled to HIGH in mqat.ini file.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  A internal channel datastructure lookup related to the activity
  trace metadata was incorrectly made in the security context of
  the adopted channel user, rather than the queue manager's
  security context. This meant that the operation was authorized
  using the stricter context of the user's authorities, which
  could cause the activity trace metadata lookup to incorrectly
  fail if the user context had limited authority.
  

Problem conclusion

• The IBM MQ queue manager channel logic has been corrected to
  perform this internal activity trace processing using the
  correct, privileged security context.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.2 LTS   9.2.0.5
  v9.x CD    9.2.5
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MQ BASE V9.2

• Fixed component ID

  5724H7281

Applicable component levels