IT38712: ACE MQSI COMMANDS BYPASS AUTHORIZATION CHECK.

APAR status

• Closed as program error.

Error description

• ACE skips authorization check on the userid under which mqsi
  commands are run. Customers migrated from IIB may spot this
  change in behavior.
  

Local fix

• NA
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All users of IBM App Connect Enterprise V11.0 and V12.0 who
  would like to impose administration security on mqsi commands.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  A user in IBM Integration Bus V10.0 or older versions can impose
  administration security on mqsi commands by revoking permission
  of 'mqbrkrs' group on the SYSTEM.BROKER.AUTH* queues. However,
  ACE  gives full permissions,  to a user running mqsi command, if
  it is a member of mqbrkrs group.
  

Problem conclusion

• The default behavior of App Connect Enterprise is not to use
  authorization on IPC calls and hence the fix for this issue is
  made by adding a new property named '<span
  style="background-color:rgb(255, 255,
  255)">localIPCAuthorizationEnabled </span>' under <span
  style="background-color:rgb(255, 255, 255)">RestAdminListener.
  Setting localIPCAuthorizationEnabled=true will enable
  authorization security on mqsi commands. </span>
  
  The property can be set either by editing the node.conf.yaml
  file or by using mqsichangeproperties command as below
  
  mqsichangeproperties IIB_MQ_AUTH_V11 -b RestAdminListener -n
  localIPCAuthorizationEnabled -v true
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v11.0      11.0.0.17
  v12.0      12.0.4.0
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available,information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  APP CONNECT ENT

• Fixed component ID

  5724J0550

Applicable component levels