Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com

now I seem to have an issue with "older" MQ Clients -- apps using MQ V7.0.1.2 clients connecting to MQ V7.1 seem to work OK as long as I don't try to apply channel authentication mapping rules.... the client authentication mapping rules seem to be completely ignored when an app connects with the "older" client versions.  I wonder if T. Rob or Roger have seen this problem?

From: "Derek" <dhornby5-Bhb0V27niACOppBP9C4UkQ@public.gmane.org>
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+2wyY2g16FtwPuJ0ROkVbw@public.gmane.org
Sent: Thursday, January 26, 2012 7:08:40 AM
Subject: Re: Fw: MQ V7.1 CHLAUTH Odd Behaviour

I guess, but these are "single app usage" servers, so it would be
reasonable to accept almost any Id from them.... I don't think I am
willing to tighten up the requirements any more than I have now, given
that I would be causing conflict with all the app managers

On 1/26/2012 6:50 AM, David C. Partridge wrote:
> You can't trust the ID that a client presents to the channel - it is so easy to fake it - if necessary using a security exit at the client end.   SSL authorisation with SSLCAUTH only I hope!
>
> Dave
>
> ________________________________
>
> From: MQSeries List [ mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+2wyY2g16FtwPuJ0ROkVbw@public.gmane.org] On Behalf Of Derek
> Sent: 26 January 2012 11:22
> To: MQSERIES-0lvw86wZMd9k/bWDasg6f+2wyY2g16FtwPuJ0ROkVbw@public.gmane.org
> Subject: Re: Fw: MQ V7.1 CHLAUTH Odd Behaviour
>
>
> not bad Morag but you left out the IP addresses on the rules.... When the client IP addresses are used, I am then pretty sure that client1 and client2 are on servers that are locked in a data center and protected by the OS authentication (which actually uses Centrify and AD, but that's another story....)
>
> To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+2wyY2g16FtwPuJ0ROkVbw@public.gmane.org and,
> in the message body (not the subject), write: SIGNOFF MQSERIES
> Instructions for managing your mailing list subscription are provided in
> the Listserv General Users Guide available at http://www.lsoft.com
> Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
>

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+2wyY2g16FtwPuJ0ROkVbw@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

List Archive - Manage Your List Settings - Unsubscribe

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com

MQClient on Win --> MQServer on RHEL5_X64
Yes, the IP address is good -- the filter is 10.* just to be sure...
Yes, I was passed the Id I was expecting to match the rule, which is a 12 char Id lower case (something like "serviceacct1") but no quotes around the Id in either case

I forced them to upgrade to the new MQV7.1 client and it is still not working, yet it works for me "as-is", with no changes, when I pass in the same Id from my PC to the same SVRCONN (I am on the same 10. net)
-- I am beginning to think I am overlooking something very silly.

From: "T-Rob" <t.rob.wyatt-rIXRsD/jSGdXrIkS9f7CXA@public.gmane.org>
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+2wyY2g16FtwPuJ0ROkVbw@public.gmane.org
Sent: Wednesday, February 1, 2012 4:27:21 PM
Subject: Re: MQ V7.1 CHLAUTH Odd Behaviour

Let's pull a few more of these teeth out...

Windows-to-Windows authorizes on SIDS.  Assuming the QMgr is *not* on
Windows, right?
Case? Was the rule defined with ('devapp') or (devapp)?  Has the apps team
defined DEVAPP or DevApp instead of devapp?

The mapping rule requires two items - the IP address and the user ID - to
match exactly.  I'm assuming that the IP address is easily verified so
that leaves discrepancies in the ID.  The easy way to find out is to
*temporarily* blank out MCAUSER.  You should still get a 2035 but now it
will show you the ID that is being presented on the channel rather than
the one in MCAUSER. I always find it's better if I as the WMQ admin can
verify the ID being presented rather than rely on someone to report it,
understand the implications of case, understand the implications of IDs >
12 chars, understand the interactions of groups, etc., etc.
-- T.Rob


MQSeries List <MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/W97FXqFh9Ls21Oc@public.gmane.org> wrote on 02/01/2012
04:01:11 PM:

> From: dhornby5-Bhb0V27niACOppBP9C4UkQ@public.gmane.org
> To: MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/W97FXqFh9Ls21Oc@public.gmane.org
> Date: 02/01/2012 04:04 PM
> Subject: Re: MQ V7.1 CHLAUTH Odd Behaviour
> Sent by: MQSeries List <MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/W97FXqFh9Ls21Oc@public.gmane.org>
>
> the rule is as follows:
>
> Channel:  APP.SVRCONN
> Type: User Map
> Client User: devapp
> Address: 10.999.99.99
> UserSource: Map
> MCAUser in Rule: mqapps
>
> which I would expect to override the MCAUSER in the channel def
> (which is "nobody") but the error I get in SYSTEM.ADMIN.QMGR.EVENT
> is for a 2035 against user "nobody"
>
> I have tested this from my own PC running MQC V7.1 with the same Id
> and the same SVRCONN and the override works great and all is good,
> but when the app team run it, they get a 2035 -- the only difference
> I can see is that they are running MQC V7.0.1.2
>
> I have told them to try again running MQC V7.0.1.7 to see if that
> makes a difference...
>
>
> From: "T-Rob" <t.rob.wyatt-rIXRsD/jSGdXrIkS9f7CXA@public.gmane.org>
> To: MQSERIES-0lvw86wZMd9k/bWDasg6f+2wyY2g16FtwPuJ0ROkVbw@public.gmane.org
> Sent: Wednesday, February 1, 2012 2:57:02 PM
> Subject: Re: MQ V7.1 CHLAUTH Odd Behaviour
>
> Hi Derek,
>
> The rules you had defined allowed only one IP address to connect and
there
> was a back-stop where each channel had MCAUSER('nobody') set.  Did you
> change the client installation on that one IP address?  Are you using a
> different IP address and need to open up the IP mapping rules?  When you

> say "client authentication mapping rules seem to be completely ignored"
> does that mean you are getting 2035?  If so, what do the event messages
> say?
> -- T.Rob
>
>
> MQSeries List <MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/W97FXqFh9Ls21Oc@public.gmane.org> wrote on 02/01/2012
> 01:24:40 PM:
>
> > From: dhornby5-Bhb0V27niACOppBP9C4UkQ@public.gmane.org
> > To: MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/W97FXqFh9Ls21Oc@public.gmane.org
> > Date: 02/01/2012 01:26 PM
> > Subject: Re: MQ V7.1 CHLAUTH Odd Behaviour
> > Sent by: MQSeries List <MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/W97FXqFh9Ls21Oc@public.gmane.org>
> >
> > now I seem to have an issue with "older" MQ Clients -- apps using MQ
> > V7.0.1.2 clients connecting to MQ V7.1 seem to work OK as long as I
> > don't try to apply channel authentication mapping rules.... the
> > client authentication mapping rules seem to be completely ignored
> > when an app connects with the "older" client versions.  I wonder if
> > T. Rob or Roger have seen this problem?
> >
>
> To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+2wyY2g16FtwPuJ0ROkVbw@public.gmane.org and,
> in the message body (not the subject), write: SIGNOFF MQSERIES
> Instructions for managing your mailing list subscription are provided in
> the Listserv General Users Guide available at http://www.lsoft.com
> Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html
>

> List Archive - Manage Your List Settings - Unsubscribe
> Instructions for managing your mailing list subscription are
> provided in the Listserv General Users Guide available at
http://www.lsoft.com

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+2wyY2g16FtwPuJ0ROkVbw@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

List Archive - Manage Your List Settings - Unsubscribe

Hello all,

I am trying to trace all message traffic through a channel.  I followed the directions in the documentation (imagine that!) and are receiving the following errors in AMQERR01.LOG:

**** note - object names have been changed ****

1.  Error message in AMQERR01.LOG starting channel:
----- amqrcmsa.c : 912 --------------------------------------------------------
02/02/12 04:01:01 PM - Process(13957.1) User(mqm) Program(runmqchl_nd)
                    Host(fny-mqdev1)
AMQ6174: The dynamically loadable shared library '<NULL>' was not found. The
system returned error number '2' and error message 'No such file or directory'.

EXPLANATION:
This message applies to UNIX systems. The shared library '<NULL>' was not
found.
ACTION:
Check that the file exists, and is either fully qualified or is in the
appropriate director, also check the file access permissions.
-------------------------------------------------------------------------------
02/02/12 04:01:02 PM - Process(13957.1) User(mqm) Program(runmqchl_nd)
                    Host(host)
AMQ9535: User exit not valid.

EXPLANATION:
Channel program 'outbound.chl' ended because user exit 'wmqcml64.so(wmqcml)'
is not valid.
ACTION:
Ensure that the user exit is specified correctly in the channel definition, and
that the user exit program is correct and available.


1a.  Channel is RETRYING


2: The channel is defined as:

AMQ8414: Display Channel details.
   CHANNEL(outbound.chl)                   CHLTYPE(SDR)
   ALTDATE(2012-02-02)                     ALTTIME(15.58.22)
   BATCHHB(0)                              BATCHINT(0)
   BATCHSZ(50)                             COMPHDR(NONE)
   COMPMSG(NONE)                           CONNAME(16.34.29.17(1414))
   CONVERT(NO)                         
   DESCR()
   DISCINT(3600)                           HBINT(10)
   KAINT(AUTO)                             LOCLADDR(160.43.94.142)
   LONGRTY(999999999)                      LONGTMR(1200)
   MAXMSGL(4194304)                        MCANAME( )
   MCATYPE(PROCESS)                        MCAUSER(Bloomberg)
   MODENAME( )                             MONCHL(OFF)
   MSGDATA(PF=outbound.mlcfg)              MSGEXIT(wmqcml64.so(wmqcml))
   NPMSPEED(FAST)                          PASSWORD( )
   PROPCTL(COMPAT)                         RCVDATA( )
   RCVEXIT( )                              SCYDATA( )
   SCYEXIT( )                              SENDDATA( )
   SENDEXIT( )                             SEQWRAP(999999999)
   SHORTRTY(10)                            SHORTTMR(60)
   SSLCIPH( )                              SSLPEER( )
   STATCHL(OFF)                            TPNAME( )
   TRPTYPE(TCP)                            USERID( )
   XMITQ(XQ.outbound.chl)           


3: File outbound.mlcfg contains:
outbound.chl:LO=0,3,6,10,11;LF=/bb/mqm/log/to-BBLP.#N.log;UC=.;LC=9;LS=50


4: /var/mqm/exits64 $ ls -ltr
total 1622
-r-xr-x---   1 mqm      mqm       105592 Feb 25  2009 BlockIP2_2.48
-r-xr-x---   1 mqm      mqm       167440 Apr 16  2009 BlockIP2_2.69.6021
-rwxr-x---   1 mqm      mqm       167416 May  1  2009 BlockIP2
-r-xr-x---   1 mqm      mqm       167416 May  1  2009 BlockIP2_2.69_6010
-rw-rw-r--   1 mqm      mqm          722 May 25  2011 wmqcml.readme
-rwxr-x---   1 mqm      mqm       146152 Feb  2 14:55 wmqcml64.so
-rwxrwxr-x   1 mqm      mqm         1312 Feb  2 14:56 mlconfig.ivt
-rwxrwxr-x   1 mqm      mqm         1675 Feb  2 14:56 mlconfig.sample
-rwxrwxr-x   1 mqm      mqm         9060 Feb  2 14:56 mlutil
-rwxrwxr-x   1 mqm      mqm         1677 Feb  2 15:43 mlconfig.nasdaq
-rw-rw-r--   1 mqm      mqm           53 Feb  2 15:46 mlutil.cmdin
-rw-rw-r--   1 mqm      mqm          273 Feb  2 15:46 mlutil.history
-rwxrwxr-x   1 mqm      mqm          304 Feb  2 15:52 nasdaq.mlcfg


5. $ uname -a
SunOS fny-mqdev1 5.10 142900-02 sun4u sparc SUNW,Sun-Fire-V210


I am hoping for some ideas.
Thanks,
Dave


------------------------------------------------------------
David Awerbuch - Sr. Systems Administrator - WebSphereMQ Infrastructure
email:         dawerbuch-AlFclGv/SK3MFIMGWPqnnw@public.gmane.org      || ==== Bloomberg LP ==== ||
phone:         + 1 212 617 6184             ||  Making Financial      ||
WMQ support:   mq-support-AlFclGv/SK36V6G2DxALlg@public.gmane.org     ||    Markets Transparent ||

731 Lexington Avenue - New York, New York  10022   U.S.A.
_________________________________________________________________________

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com