Original Message:
Sent: Mon May 11, 2020 05:42 PM
From: Morag Hughson
Subject: AMQ9557, AMQ9999 Channel access blocking
Ok - thank you for trying out the suggestion I made. This makes it clear that the problem is with the way you are specifying your user ID and not with CHLAUTH. I suggest you keep your setup with the user ID hardcoded in the MCAUSER and CHLAUTH turned off until that set up works. You are confusing the issue hugely by trying all sorts of CHLAUTH rules that are not pertinent to the problem at hand.
The problem at hand is that the user id you are using, hard-coded in the MCAUSER or mapped by a CHLAUTH rule, is not recognised by your queue manager. Keep things simple and stick to the hard-coded MCAUSER until you get that sorted.
You are using MCAUSER('e63254@CENTRAL'). Are you sure that is correct? In another post you used MCAUSER('e63254@central.nbg.gr'). These two are not the same. It is important to use the correct domain qualified user id here. You have said that this user id is your domain account and a member of the mqm group of the system hosting the target Queue Manager. Therefore you should be able to issue the following MQSC command, and see what the queue manager believes is the full name of that user id.
DISPLAY AUTHREC PRINCIPAL('e63254') OBJTYPE(QMGR)Alternatively, just look at the whole lot and search the output for 'e63254'. N.B. I added OBJTYPE(QMGR) just to reduce the amount of output.
DISPLAY AUTHREC OBJTYPE(QMGR)
Do not go back to CHLAUTH until the hard-coded MCAUSER setup works, because it is only then that you are using the correct user id.
Cheers,
Morag
------------------------------
Morag Hughson
MQ Technical Education Specialist
MQGem Software Limited
Original Message:
Sent: Mon May 11, 2020 09:56 AM
From: NICK DAKORONIAS
Subject: AMQ9557, AMQ9999 Channel access blocking
Yes, I have deleted both channel blocking rules (AMQ 9777 / SYSTEM.AUTO.SVRCONN) , AMQ(9776 / SYSTEM.ADMIN.SVRCONN).
I have also disabled CHLAUTH and set my MQ user ID (e63254@CENTRAL) as MCA user id on SYSTEM.AUTO.SVRCONN,
but the problem remains...
I have re-enabled CHLAUTH rules and created a "warning back-stop rule" based on your post "https://mqgem.wordpress.com/2013/03/21/mq_chlauth_the_back_stop_rule/"
My 3 access attempts were recorded in the SYSTEM.ADMIN.CHANNEL.EVENT,
but none MQRC_CHANNEL_BLOCKED_WARNING event listed in that queue and the problem still remains..
At last I have looked into your proposed post https://mqgem.wordpress.com/2013/05/23/chlauth-allow-privileged-admins/ in order to create a block user list on SYSTEM.ADMIN.SVRCONN, but the issue here is that my user ID (e63254) is a valid user account, so the rule SET CHLAUTH(SYSTEM.ADMIN.SVRCONN) TYPE(BLOCKUSER) USERLIST('e63254') won't work, since it will block the listed user.
Looking for your advise.
Cheers Nick.
------------------------------
NICK DAKORONIAS
Original Message:
Sent: Thu May 07, 2020 05:00 PM
From: Morag Hughson
Subject: AMQ9557, AMQ9999 Channel access blocking
Looking in your error log it is clear that the AMQ9776 error message you cited as happening before the AMQ9557 + AMQ9999 is an earlier event. There are no examples of AMQ9776 followed immediately by AMQ9557.
Your errorlog has the following pattern of errors
- AMQ9777: Channel was blocked + AMQ9999
Assume these errors are because you were being blocked by the default USERSRC(NOACCESS) rule for SYSTEM.* channels. Did you delete it at this point? - AMQ9776: Channel was blocked by userid+ AMQ9999
Assume these errors are because you were now being blocked by the other default provided rule, the one that blocks all privileged users. Did you delete it at this point? - AMQ9557: Queue Manager User ID initialization failed + AMQ9999
So by reading your error log I can see that you are not being blocked by CHLAUTH anymore. My first answer made a suggestion for you to test your user ID by turning off CHLAUTH and setting it on the channel's MCAUSER. Did you do that?
Once you get your user ID working, I suggest you reinstate the default rules that you deleted, and set up access for this channel (and the privileged user you wish to use on it), in a safer way, as detailed in this blog post.
Cheers,
Morag
------------------------------
Morag Hughson
MQ Technical Education Specialist
MQGem Software Limited
Original Message:
Sent: Thu May 07, 2020 04:36 AM
From: NICK DAKORONIAS
Subject: AMQ9557, AMQ9999 Channel access blocking
I have uploaded the error log file (zipped).
Thanks in advance for your time.
------------------------------
NICK DAKORONIAS
Original Message:
Sent: Wed May 06, 2020 05:50 PM
From: Morag Hughson
Subject: AMQ9557, AMQ9999 Channel access blocking
If there's more in the error log that you haven't posted on here, then certainly you should let us see the other error messages.
Cheers,
Morag
------------------------------
Morag Hughson
MQ Technical Education Specialist
MQGem Software Limited
Original Message:
Sent: Wed May 06, 2020 08:40 AM
From: NICK DAKORONIAS
Subject: AMQ9557, AMQ9999 Channel access blocking
If you want, I can send you the error log file for your review.
------------------------------
NICK DAKORONIAS
Original Message:
Sent: Tue May 05, 2020 08:22 PM
From: Morag Hughson
Subject: AMQ9557, AMQ9999 Channel access blocking
Absent any other error messages to explain a different reason why your Queue Manager User ID initialization failed, the error message AMQ9557 most likely means that your user ID is not known on the system.
If there are other error messages before the AMQ9557, please post them, as they are relevant.
You can test this is the case, by taking CHLAUTH out of the picture temporarily.
ALTER QMGR CHLAUTH(DISABLED)ALTER CHANNEL(SYSTEM.AUTO.SVRCONN) CHLTYPE(SVRCONN) MCAUSER('e63254@CENTRAL')And then run your MQ Explorer again. You should see the same behaviour.
In short what I'm saying is that your CHLAUTH rule has the same effect as hard-coding the MCAUSER on the channel. Once you get the user ID known to the system, the hard-coded MCAUSER on the channel will work, and you can then go back to using CHLAUTH again
ALTER CHANNEL(SYSTEM.AUTO.SVRCONN) CHLTYPE(SVRCONN) MCAUSER(' ')ALTER QMGR CHLAUTH(ENABLED)Cheers,
Morag
------------------------------
Morag Hughson
MQ Technical Education Specialist
MQGem Software Limited
Original Message:
Sent: Tue May 05, 2020 10:52 AM
From: NICK DAKORONIAS
Subject: AMQ9557, AMQ9999 Channel access blocking
Furthermore, after running the command dis chlauth(*) to display all channel authentication records on specific Queue Manager there are only 4 channel rules listed:
The first system rule (address map) refers on SYSTEM.ADMIN.SVRCONN channel and allows MQ explorer access from all IP addresses (*).
The second rule is mine (IP:xx.x.xxx.xxx) = my machine , e63254@CENTRAL = my domain profile / member of local mqm group in target machine hosting the target queue manager).
The other two rules (SENDER*) are custom created allowing access to sender channels from Profile Application Server and Private Banking Batch Scheduler respectively.
----------------------------
display CHLAUTH(*)
3 : display CHLAUTH(*)
AMQ8878: Display channel authentication record details.
CHLAUTH(SYSTEM.ADMIN.SVRCONN) TYPE(ADDRESSMAP)
ADDRESS(*) USERSRC(CHANNEL)
AMQ8878: Display channel authentication record details.
CHLAUTH(SYSTEM.AUTO.SVRCONN) TYPE(ADDRESSMAP)
ADDRESS(xx.x.xxxx.xxx) MCAUSER(e63254@CENTRAL)
AMQ8878: Display channel authentication record details.
CHLAUTH(SENDER*) TYPE(ADDRESSMAP)
ADDRESS(xx.xx.xxx.xx) USERSRC(CHANNEL)
AMQ8878: Display channel authentication record details.
CHLAUTH(SENDER*) TYPE(ADDRESSMAP)
ADDRESS(xx.xx.xxx.xx) USERSRC(CHANNEL)
------------------------------
NICK DAKORONIAS
Original Message:
Sent: Tue May 05, 2020 07:14 AM
From: NICK DAKORONIAS
Subject: AMQ9557, AMQ9999 Channel access blocking
Hello MQ community users,
When I am trying to access from my machine –via MQ Explorer- a target Queue Manager by using a Channel Authentication Record (enabled), I receive the following errors in Queue Manager's log:
FYI, I have created a channel authentication record using MQ explorer GUI -> General -> Channel SYSTEM.AUTO.SVRCONN / Address Map – Address -> IP : xx.x.xxx.xxx (my machine) –
Extended: User Source Map: MCA UserID: (my domain account / member of mqm group of system hosting target Queue Manager).
Target System is accessible from my machine's IP on ports 3389 (RDP), 1414(MQ Explorer)
----- amqrmrsa.c : 898 --------------------------------------------------------
5/5/2020 13:02:04 - Process(2296.271) User(MQTestUser) Program(amqrmppa.exe)
Host(V000010733) Installation(TEST)
VRMF(7.5.0.2) QMgr(MQTPRIV)
AMQ9557: Queue Manager User ID initialization failed.
EXPLANATION:
The call to initialize the User ID failed with CompCode 2 and Reason 2035.
ACTION:
Correct the error and try again.
----- cmqxrsrv.c : 1975 -------------------------------------------------------
5/5/2020 13:02:04 - Process(2296.271) User(MQTestUser) Program(amqrmppa.exe)
Host(V000010733) Installation(TEST)
VRMF(7.5.0.2) QMgr(MQTPRIV)
AMQ9999: Channel 'SYSTEM.AUTO.SVRCONN' to host 'w003500595 (10.1.100.155)' ended abnormally.
EXPLANATION:
The channel program running under process ID 2296(14768) for channel 'SYSTEM.AUTO.SVRCONN' ended abnormally. The host name is 'w003500595
(10.1.100.155)'; in some cases the host name cannot be determined and so is shown as '????'.
ACTION:
Look at previous error messages for the channel program in the error logs to determine the cause of the failure. Note that this message can be excluded completely
or suppressed by tuning the "ExcludeMessage" or "SuppressMessage" attributes under the "QMErrorLog" stanza in qm.ini. Further information can be found
in the System Administration Guide.
----- amqrmrsa.c : 898 --------------------------------------------------------
Any advise on the above will be much appreciated.
------------------------------
NICK DAKORONIAS
------------------------------