APAR status
Closed as program error.
Error description
After applying APAR IT25839, it is observed that a security exit, when called with SEC_PARMS, may not influence the MQCSP security that is used for CONNAUTH checking, if ChlAuthEarlyAdopt is enabled. An example of an affected scenario is as follows: A client application attempted to connect to a queue manager by passing invalid credentials in the MQCSP structure. Those credentials were corrected by a server-side security exit but the connection failed and the application received a MQRC_NOT_AUTHORIZED error.
Local fix
Problem summary
**************************************************************** USERS AFFECTED: This issue affects users of MQ V8 and later who configure their queue manager with the setting chlauthearlyadopt=y and use a security exit to change the contents of the MQCSP structure. Platforms affected: MultiPlatform **************************************************************** PROBLEM DESCRIPTION: A logic error in the MQ code prevented the queue manager from using the credentials returned by the security exit for authentication.
Problem conclusion
The queue manager logic has been modified to fix this error so that the user is authenticated using the new credentials after the security exit has been called. --------------------------------------------------------------- The fix is targeted for delivery in the following PTFs: Version Maintenance Level v8.0 8.0.0.11 v9.0 LTS 9.0.0.6 v9.1 CD 9.1.2 v9.1 LTS 9.1.0.1 The latest available maintenance can be obtained from 'WebSphere MQ Recommended Fixes' http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037 If the maintenance level is not yet available information on its planned availability can be found in 'WebSphere MQ Planned Maintenance Release Dates' http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309 ---------------------------------------------------------------
Temporary fix
Comments
APAR Information
APAR number
IT26557
Reported component name
IBM MQ BASE MP
Reported component ID
5724H7251
Reported release
800
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2018-10-09
Closed date
2018-11-15
Last modified date
2019-04-02
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
IBM MQ BASE MP
Fixed component ID
5724H7251
Applicable component levels
[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSYHRD","label":"IBM MQ"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.0.0.0","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]
Document Information
Modified date:
02 April 2019