IT24154: IBM MQ client fails to connect with 2035 (MQRC_NOT_AUTHORIZED) when LongUserId is not set

APAR status

• Closed as program error.

Error description

• MQ CLIENT fails with error 2035 (MQRC_NOT_AUTHORIZED) and
  AMQ9777 error with blank CLNTUSER will be generated by MQ V8/V9
  queue manager.
  
  AMQ9777: Channel was blocked
  
  EXPLANATION:
  The inbound channel 'SYSTEM.DEF.SVRCONN' was blocked from
  address
  '127.0.0.1' because the active values of the channel matched a
  record
  configured with USERSRC(NOACCESS). The active values of the
  channel were
  'CLNTUSER()'.
  

Local fix

• NA
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users using MQ clients that do not set LongUserId. This problem
  likely to occur only because of a defect in older MQ clients
  that results in a blank LongUserId.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  MQ clients are expected to send LongUserID when connecting to
  the queue manager if MQ FAP level is >= 5. The queue manager
  used the Long User Id if  MQ FAP level was >= 5 and Short User
  Id for earlier FAP levels for channel authentication. If the
  client did not send LongUserID then channel authentication
  (CHLAUTH) failed with 2035 error because the channel was
  authenticated against a blank user ID.
  

Problem conclusion

• MQ has been modified to use Short User Id if Long User Id is
  blank (if no Long User Id is sent by the client) for channel
  authentication.
  
  This is an equivalent change to APAR IV60006 which was delivered
  in MQ version 7.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v8.0       8.0.0.11
  v9.0 LTS   9.0.0.6
  v9.1 CD    9.1.1
  v9.1 LTS   9.1.0.2
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ APPL M20

• Fixed component ID

  5725Z0900

Applicable component levels