APAR status
Closed as program error.
Error description
When using a client-side exit with an MQ Client application to connect to queue manager with CONNAUTH enabled, connections can fail if ChlAuthEarlyAdopt=Y is set in the qm.ini. The queue manager reports that the user does not have +altusr and +inq MQ authority on the queue manager. AMQQ8077: Entity '??' has insufficient authority to access object '??'. EXPLANATION: The specified entity is not authorized to access the required object. The following requested permissions are unauthorized: altusr If you do not use a client side exit then this problem is not observed.
Local fix
Do not use client-side exit
Problem summary
**************************************************************** USERS AFFECTED: This issue affects users who use a CLNTCONN channel with a client-side security exit to connect to a SVRCONN channel on a V8.0.0.9 and later queue manager with ChlAuthEarlyAdopt=Y configured in the qm.ini. Platforms affected: MultiPlatform **************************************************************** PROBLEM DESCRIPTION: A client application attempted to connect to a queue manager with ChlAuthEarlyAdopt=Y configured in the qm.ini file. The client used a client-side security exit to connect to a SVRCONN channel. The connection failed with two AMQ8077 errors which stated that the user did not have '+altusr' and '+inq' permission for the queue manager. When the client-side exit was removed from the channel then the connection succeeded. Examples of the errors are shown below: ---------------------------------------------------------------- --------------- 03/14/19 12:37:06 - Process(494.12) User(root) Program(amqzlaa0) Host(377881bc1732) Installation(Installation1) VRMF(8.0.0.11) QMgr(80011) AMQ8077: Entity 'guest1' has insufficient authority to access object '80011'. EXPLANATION: The specified entity is not authorized to access the required object. The following requested permissions are unauthorized: altusr ACTION: Ensure that the correct level of authority has been set for this entity against the required object, or ensure that the entity is a member of a privileged group. ----- amqzfubx.c : 1495 ------------------------------------------------------- 03/14/19 12:37:06 - Process(494.12) User(root) Program(amqzlaa0) Host(377881bc1732) Installation(Installation1) VRMF(8.0.0.11) QMgr(80011) AMQ8077: Entity 'guest1' has insufficient authority to access object '80011'. EXPLANATION: The specified entity is not authorized to access the required object. The following requested permissions are unauthorized: inq ACTION: Ensure that the correct level of authority has been set for this entity against the required object, or ensure that the entity is a member of a privileged group. ----- amqzfubx.c : 1495 ------------------------------------------------------- The connection should have been successful because the user should not require '+altusr' and '+inq' permission to connect to the queue manager. The issue was caused by a programming error in the queue manager.
Problem conclusion
The error has been fixed so that the user does not require +altusr and +inq permissions. --------------------------------------------------------------- The fix is targeted for delivery in the following PTFs: Version Maintenance Level v8.0 8.0.0.13 v9.0 LTS 9.0.0.7 v9.1 CD 9.1.3 v9.1 LTS 9.1.0.3 The latest available maintenance can be obtained from 'WebSphere MQ Recommended Fixes' http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037 If the maintenance level is not yet available information on its planned availability can be found in 'WebSphere MQ Planned Maintenance Release Dates' http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309 ---------------------------------------------------------------
Temporary fix
Comments
APAR Information
APAR number
IT28555
Reported component name
IBM MQ BASE MP
Reported component ID
5724H7251
Reported release
800
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2019-03-22
Closed date
2019-04-29
Last modified date
2019-07-08
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
IBM MQ BASE MP
Fixed component ID
5724H7251
Applicable component levels
[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSYHRD","label":"IBM MQ"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.0.0.0","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]
Document Information
Modified date:
08 July 2019