IT38970: A non-mqm group user is not able to create new non-TLS channels despite having create authority for channel objects

APAR status

• Closed as program error.

Error description

• <span style="font-size:12px">A </span><span
  style="font-size:12px">user who is not in the mqm group, but who
  has been granted appropriate MQ authority to create channels is
  not able to do so when running the runmqsc command locally to
  the queue manager. The command completes without any reported
  error, but the channel definition is not created.</span>
  
  <span style="font-size:12px">An IBM MQ diagnostic trace of the
  attempt to create a channel shows failure to access the qm.ini
  file.</span>
  

Local fix

• Re-run the runmqsc command as a member of the "mqm" group, or
  issue the command using runmqsc in client mode (runmqsc -c).
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Non-mqm group users trying to create MQ channels running runmqsc
  locally to the queue manager.
  
  Running runmqsc in client mode with the -c switch in order to
  connect over a SVRCONN channel is unaffected by this issue, even
  if the connection is made to localhost.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  Changes in MQ 9.2 meant that the qm.ini file was accessed during
  the creation of the channel object. If the runmqsc program was
  running with insufficient permissions to access the qm.ini file
  (ie. running as a user who was not a member of the mqm group),
  the access to the qm.ini file failed, which caused the channel
  creation to fail.
  

Problem conclusion

• The fix allows users who have appropriate IBM MQ authorities to
  create a non-TLS channel when running runmqsc locally against
  the queue manager.
  
  
  
  If creating a TLS channel (SSLCIPH attribute set to a non-empty
  value) locally, the operation will fail with the following
  errors:
  
  Permission denied attempting to access an INI file.
  Permission denied attempting to access an INI file.
  AMQ8242E: SSLCIPH definition wrong.
  
  This inability to create TLS channels when running runmqsc as a
  local non-mqm group user is a product restriction and
  improvements to the documentation in this regard are covered by
  related APAR IT41324.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.2 LTS   9.2.0.6
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MQ BASE V9.2

• Fixed component ID

  5724H7281

Applicable component levels