IT40977: IBM MQ create subscription fails with 'AMQ8135E: Not authorized'

APAR status

• Closed as program error.

Error description

• The creation of new subscriptions in runmqsc fails with a
  "AMQ8135E: Not authorized." error.
  

Local fix

• 1. It may be possible to define the subscription locally using
  runmqsc with the "-w WaitTime" flag and the "-m LocalQMgrName"
  parameter. for example:
  
  runmqsc -w 10 -m QMGR
  
  2. To correct the SYSTEM.DEFAULT.SUB definition, use the
  following sequence of commands:
  
  runmqsc QMGR
  alter sub(SYSTEM.DEFAULT.SUB)
  end
  
  Then, restart the queue manager:
  
  endmqm QMGR
  strmqm QMGR
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users who alter the SYSTEM.DEFAULT.SUB subscription via PCF, or
  via runmqsc using the -c or -w options, may be affected by this
  issue.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  If the SYSTEM.DEFAULT.SUB object is altered via PCF, or via
  runmqsc using the -c or -w options,  then IBM MQ adds the
  MQSO_ALTERNATE_USER_AUTHORITY flag to the
  subscription definition.
  
  An attempt to create a new subscription based on this default
  object template via a direct runmqsc command did not set up an
  appropriate alternate user identity context when calling MQSUB
  since it is not necessary to do so when using the runmqsc
  command directly.  This caused an MQRC_NOT_AUTHORIZED (2035)
  error to be generated and the command failed.
  

Problem conclusion

• The IBM MQ code has been modified so that it removes any
  MQSO_ALTERNATE_USER_AUTHORITY flag on the template object when
  creating a subscription via a direct local runmqsc session.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.1 LTS   9.1.0.20
  v9.2 LTS   9.2.0.20
  v9.3 LTS   9.3.0.10
  v9.x CD    9.3.4
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE MP

• Fixed component ID

  5724H7271

Applicable component levels