Hi Folks,
I've always assumed/figured out that an AuthRec entry that shows as

SET AUTHREC ...
GROUP('S-1-5-21-648082027-817777525-689221762-1605')

means that the entity SID (group or principal) can't be resolved because the entity is no longer available to the QM either because it's been deleted or because the AuthInfo has since changed e.g. from IDPWOS to LDAP.

Is that correct? If so, is there any way to delete these entries? I always fail because MQ seems to check that it exists in the system before it deletes them and fails to find them and gives up.

thanks,
John.

------------------------------
John Hawkins
Integration Consultant
------------------------------

setmqaut -u <sid> should allow you to refer to those.
See https://www.ibm.com/docs/en/ibm-mq/9.2?topic=reference-setmqaut-grant-revoke-authority

------------------------------
Mark Taylor
Winchester
------------------------------

Original Message:
Sent: Wed October 06, 2021 08:32 AM
From: John Hawkins
Subject: AuthRec entity is now not known

Hi Folks,
I've always assumed/figured out that an AuthRec entry that shows as

SET AUTHREC ...
GROUP('S-1-5-21-648082027-817777525-689221762-1605')

means that the entity SID (group or principal) can't be resolved because the entity is no longer available to the QM either because it's been deleted or because the AuthInfo has since changed e.g. from IDPWOS to LDAP.

Is that correct? If so, is there any way to delete these entries? I always fail because MQ seems to check that it exists in the system before it deletes them and fails to find them and gives up.

thanks,
John.

------------------------------
John Hawkins
Integration Consultant
------------------------------

Brilliant thanks Mark - and am I correct in my assumptions as to how MQ got in that state i.e. I'm not doing something that's not good !

------------------------------
John Hawkins
Integration Consultant
------------------------------

Original Message:
Sent: Wed October 06, 2021 09:52 AM
From: Mark Taylor
Subject: AuthRec entity is now not known

setmqaut -u <sid> should allow you to refer to those.
See https://www.ibm.com/docs/en/ibm-mq/9.2?topic=reference-setmqaut-grant-revoke-authority

------------------------------
Mark Taylor
Winchester

Original Message:
Sent: Wed October 06, 2021 08:32 AM
From: John Hawkins
Subject: AuthRec entity is now not known

Hi Folks,
I've always assumed/figured out that an AuthRec entry that shows as

SET AUTHREC ...
GROUP('S-1-5-21-648082027-817777525-689221762-1605')

means that the entity SID (group or principal) can't be resolved because the entity is no longer available to the QM either because it's been deleted or because the AuthInfo has since changed e.g. from IDPWOS to LDAP.

Is that correct? If so, is there any way to delete these entries? I always fail because MQ seems to check that it exists in the system before it deletes them and fails to find them and gives up.

thanks,
John.

------------------------------
John Hawkins
Integration Consultant
------------------------------

Yes - the most common reason is that the id has been deleted from the windows database or the domain setup has changed in some way so the sid can no longer be resolved.

------------------------------
Mark Taylor
Winchester
------------------------------

Original Message:
Sent: Wed October 06, 2021 10:27 AM
From: John Hawkins
Subject: AuthRec entity is now not known

Brilliant thanks Mark - and am I correct in my assumptions as to how MQ got in that state i.e. I'm not doing something that's not good !

------------------------------
John Hawkins
Integration Consultant

Original Message:
Sent: Wed October 06, 2021 09:52 AM
From: Mark Taylor
Subject: AuthRec entity is now not known

setmqaut -u <sid> should allow you to refer to those.
See https://www.ibm.com/docs/en/ibm-mq/9.2?topic=reference-setmqaut-grant-revoke-authority

------------------------------
Mark Taylor
Winchester

Original Message:
Sent: Wed October 06, 2021 08:32 AM
From: John Hawkins
Subject: AuthRec entity is now not known

Hi Folks,
I've always assumed/figured out that an AuthRec entry that shows as

SET AUTHREC ...
GROUP('S-1-5-21-648082027-817777525-689221762-1605')

means that the entity SID (group or principal) can't be resolved because the entity is no longer available to the QM either because it's been deleted or because the AuthInfo has since changed e.g. from IDPWOS to LDAP.

Is that correct? If so, is there any way to delete these entries? I always fail because MQ seems to check that it exists in the system before it deletes them and fails to find them and gives up.

thanks,
John.

------------------------------
John Hawkins
Integration Consultant
------------------------------

Thanks Mark !!

------------------------------
John Hawkins
Integration Consultant
------------------------------

Original Message:
Sent: Wed October 06, 2021 10:36 AM
From: Mark Taylor
Subject: AuthRec entity is now not known

Yes - the most common reason is that the id has been deleted from the windows database or the domain setup has changed in some way so the sid can no longer be resolved.

------------------------------
Mark Taylor
Winchester

Original Message:
Sent: Wed October 06, 2021 10:27 AM
From: John Hawkins
Subject: AuthRec entity is now not known

Brilliant thanks Mark - and am I correct in my assumptions as to how MQ got in that state i.e. I'm not doing something that's not good !

------------------------------
John Hawkins
Integration Consultant

Original Message:
Sent: Wed October 06, 2021 09:52 AM
From: Mark Taylor
Subject: AuthRec entity is now not known

setmqaut -u <sid> should allow you to refer to those.
See https://www.ibm.com/docs/en/ibm-mq/9.2?topic=reference-setmqaut-grant-revoke-authority

------------------------------
Mark Taylor
Winchester

Original Message:
Sent: Wed October 06, 2021 08:32 AM
From: John Hawkins
Subject: AuthRec entity is now not known

Hi Folks,
I've always assumed/figured out that an AuthRec entry that shows as

SET AUTHREC ...
GROUP('S-1-5-21-648082027-817777525-689221762-1605')

means that the entity SID (group or principal) can't be resolved because the entity is no longer available to the QM either because it's been deleted or because the AuthInfo has since changed e.g. from IDPWOS to LDAP.

Is that correct? If so, is there any way to delete these entries? I always fail because MQ seems to check that it exists in the system before it deletes them and fails to find them and gives up.

thanks,
John.

------------------------------
John Hawkins
Integration Consultant
------------------------------

Be aware that if you are using an MSCS cluster the local mqm group on the other cluster member will show up as S.... if it doesn't have the same SID...

------------------------------
Francois Brandelik
------------------------------

Original Message:
Sent: Wed October 06, 2021 10:27 AM
From: John Hawkins
Subject: AuthRec entity is now not known

Brilliant thanks Mark - and am I correct in my assumptions as to how MQ got in that state i.e. I'm not doing something that's not good !

------------------------------
John Hawkins
Integration Consultant

Original Message:
Sent: Wed October 06, 2021 09:52 AM
From: Mark Taylor
Subject: AuthRec entity is now not known

setmqaut -u <sid> should allow you to refer to those.
See https://www.ibm.com/docs/en/ibm-mq/9.2?topic=reference-setmqaut-grant-revoke-authority

------------------------------
Mark Taylor
Winchester

Original Message:
Sent: Wed October 06, 2021 08:32 AM
From: John Hawkins
Subject: AuthRec entity is now not known

Hi Folks,
I've always assumed/figured out that an AuthRec entry that shows as

SET AUTHREC ...
GROUP('S-1-5-21-648082027-817777525-689221762-1605')

means that the entity SID (group or principal) can't be resolved because the entity is no longer available to the QM either because it's been deleted or because the AuthInfo has since changed e.g. from IDPWOS to LDAP.

Is that correct? If so, is there any way to delete these entries? I always fail because MQ seems to check that it exists in the system before it deletes them and fails to find them and gives up.

thanks,
John.

------------------------------
John Hawkins
Integration Consultant
------------------------------