IT44790: IBM MQ WebConsole may report a not authorized error when accessing z/OS Queue Managers

APAR status

• Closed as program error.

Error description

• Users connecting their IBM MQ console to a z/OS queue manager
  with a user which is assigned the MQWebUser role and has a user
  id that is mixed case or all lower case see an error generated
  in the queue manager logs like:
  
  TSS7100E J=xxxxMSTR A=xxxxxxx T=N/A F=XXX - UNDEFINED ACID
  CSQN207I COMMAND SERVER UNABLE TO OPEN REPLY TO QUEUE
  CSQN203I QUEUE SYSTEM.REST.REPLY.QUEUE, MQCC=2 MQRC=2035
  (MQRC_NOT_AUTHORIZED)
  
  when accessing objects on the queue manager. The console may
  also see an error like:
  
  Failed to retrieve list of queues
  MQWB2018E: User lacks authority to access resource.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  This issue affects users of the IBM MQ console who are
  administering z/OS queue managers.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  For users of the IBM MQ console administering z/OS queue
  managers, when the user was assigned a role MQWebUser and the
  user id was either mixed cased or all lower case, any attempts
  to access objects on a z/OS queue manager, such as browsing a
  queue, could lead to errors in the queue manager log like:
  
  TSS7100E J=xxxxMSTR A=xxxxxxx T=N/A F=XXX - UNDEFINED ACID
  CSQN207I COMMAND SERVER UNABLE TO OPEN REPLY TO QUEUE
  CSQN203I QUEUE SYSTEM.REST.REPLY.QUEUE, MQCC=2 MQRC=2035
  (MQRC_NOT_AUTHORIZED)
  
  and errors in the console like:
  
  Failed to retrieve list of queues
  MQWB2018E: User lacks authority to access resource.
  
  This issue may also lead to problems accessing objects, although
  in some cases the object could be accessed and the errors still
  logged.
  

Problem conclusion

• The z/OS queue manager objects can now be accessed without error
  for a user id of mixed or lower case assigned to the MQWebUser
  role.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.x CD    9.3.5
  
  The latest available maintenance can be obtained from
  'IBM MQ Recommended Fixes'
  https://www.ibm.com/support/pages/recommended-fixes-ibm-mq
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'IBM MQ
  Planned Maintenance Release Dates'
  https://ibm.biz/mqplannedmaintenance
  
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MQ BASE V9.3

• Fixed component ID

  5724H7291

Applicable component levels