IT32292: AMQ5542 message misleadingly mentions CHCKCLNT(REQDADM) when using LDAP for users/groups

APAR status

• Closed as program error.

Error description

• When an application was connecting a queue manager configured
  with LDAP for users/groups, and supplied an incorrect password,
  the AMQ5542 error message that was misleading:
  
  AMQ5542: The failed authentication check was caused by the queue
  manager CONNAUTH CHCKCLNT(REQDADM) configuration.
  EXPLANATION:
  The user ID 'my.username' and its password were checked because
  the queue manager connection authority (CONNAUTH) configuration
  refers to an authentication information (AUTHINFO) object named
  'my.authinfo' with CHCKCLNT(REQDADM).
  
  The Knowledge Centre entry stated that REQDADM was "irrelevant"
  when used with LDAP, causing confusion as to why REQDADM could
  cause a password check if it is irrelevant.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users with a queue manager using LDAP for users/groups, reading
  an AMQ5542 message in their error logs stating CONNAUTH
  CHCKCLNT(REQDADM) caused the authentication check.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  The error message, paired with the Knowledge Centre, was
  misleading and caused confusion.
  

Problem conclusion

• Extra clarification has been added to the AMQ5542 message on how
  CHCKCLNT(REQDADM) works when paired with LDAP:
  
  "Note that if the authentication configuration specifies an LDAP
  user repository,
  a CHCKCLNT value of REQDADM is treated as equivalent to a value
  of OPTIONAL."
  
  The Knowledge Centre entry is to be updated to remove the word
  "irrelevant" and clarify the OPTIONAL behaviour when using LDAP
  for group resolution.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.0 LTS   9.0.0.11
  v9.1 LTS   9.1.0.7
  v9.2 LTS   9.2.0.2
  v9.x CD    9.2.1
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE M/P

• Fixed component ID

  5724H7261

Applicable component levels