IBM Support

SE47385: WEBSPHERE MQ V7: WRKMQMQSTS COMMAND FAILS FOR END USERS NOT PARTOF THE QMQMADM GROUP PROFILE WITH NOT AUTHORIZED ERROR

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • Enduser has upgraded from WMQ V7.0.0.2 to WMQ V7.0.1.4.
    When using the WMQ panels and/or the WRKMQMQSTS command to
    view the status of a queue, message AMQ8077 is being logged
    for an ensuser that is not part of the QMQMADM group profile.
    The enduser has the followig specific authorization *CONNECT
    *INQ *SETALL and *ADMDSP for the queue manager (*MQM)
    definition and *ADMDSP *GET, *PUT, *BROWSE and *INQ for a
    local queue definition.
    .
    Perform the following to recreate scenario:
    1. CRTUSRPRF USRPRF(ANGEL)
    2. GRTMQMAUT OBJ(COMMON) OBJTYPE(*MQM) USER(ANGEL)
        AUT(*CONNECT*INQ *SETALL *ADMDSP) MQMNAME(COMMON)
    3. GRTMQMAUT OBJ(APPLE.LQ) OBJTYPE(*Q) USER(ANGEL)
        AUT(*ADMDSP *INQ *PUT *GET) MQMNAME(COMMON)
    4. EDTOBJAUT OBJ(QMQM/WRKMQM) OBJTYPE(*CMD), verify *PUBLIC
       has *USE authority
    5. EDTOBJAUT OBJ(QMQM/WRKMQMQSTS) OBJTYPE(*CMD), verify
       *PUBLIC has *USE authority
    6. Issue the WRKMQMQSTS comamnd or select option 18 from the
       WRKMQM panel and then select option 8 (WRKMQMQSTS) next to
       the queue.
    .
    WebSphere MQ Trace indicates the enduser does not have
    sufficient authorization.
    .
    

Local fix

  • Grant *SYSTEM authority to the queue manager *MQM defintion
    GRTMQMAUT OBJ(<QMGR_NAME) OBJTYPE(*MQM) USER(<ENDUSER>)
    AUT(*SYSTEM) MQMNAME(<QMGR_NAME>)
    RFRMQMAUT MQMNARM(<QMGR_NAME>)
    

Problem summary

  • ****************************************************************
    USERS AFFECTED:
    End User, who is not part of the QMQMADM group or does not have
    *SYSTEM authority, attempting to issue a WRKMQMQSTS command.
    
    Platforms affected:
    iSeries
    
    ****************************************************************
    PROBLEM SUMMARY:
    The problem occurs when iSeries end users issue a WKRMQMQSTS,
    either directly or its equivalent option through the console
    panels and are unsuccessful.  The system will report either an
    unauthorized error or the queue manager is unavailable.  A user
    appears to require *SYSTEM level authority for this command to
    be successful, either by directly granting the user authority,
    or adding the user to the QMQMADM group.
    

Problem conclusion

  • In 701 a few internal functions were changed to require a
    higher level of authority or a privileged interface.  The code
    that implements the WRKMQMQSTS functionality had been using one
    of these functions.  Previous MQ versions, the function only
    checks for connect authority.  The new function will check for
    *SYSTEM and therefore the command will fail.  The code solution
    was to switch this function with the equivalent function that
    does not require the privileged interface and therefore reverts
    to the former behavior.
    
    With the fix applied, the end user will successfully be able to
    run WRKMQMQSTS without any addition authority changes.
    
    ---------------------------------------------------------------
    The fix is targeted for delivery in the following PTFs:
    
                       v7.0
    Platform           Fix Pack 7.0.1.5
    --------           --------------------
    iSeries            tbc_p700_0_1_5
    
    The latest available maintenance can be obtained from
    'WebSphere MQ Recommended Fixes'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
    
    If the maintenance level is not yet available, information on
    its planned availability can be found in 'WebSphere MQ
    Planned Maintenance Release Dates'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
    ---------------------------------------------------------------
    

Temporary fix

Comments

APAR Information

  • APAR number

    SE47385

  • Reported component name

    WMQ ISERIES V7

  • Reported component ID

    5724H7226

  • Reported release

    701

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2011-03-17

  • Closed date

    2011-03-18

  • Last modified date

    2011-03-18

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Modules/Macros

  • RCHMGR
    

Fix information

  • Fixed component name

    WMQ ISERIES V7

  • Fixed component ID

    5724H7226

Applicable component levels

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSCPQ63","label":"APAR \/ Maintenance"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}}]

Document Information

Modified date:
27 April 2020