MQ

MQ

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  LDAP AuthInfo using uncrypted protocol

    Posted 11/13/24 10:48 AM

    I have an instance on IBm MQ running on Openshift. I configure ldap succesfully to connect to our internal AD domain.

    We are closing our ldap and going entirely on ldaps. so i configure AUTH INFO like: 

    DIS AUTHINFO('MYLDAP.LDAP') ALL
     1 : DIS AUTHINFO('MYLDAP.LDAP') ALL
AMQ8566I: Display authentication information details.
   AUTHINFO(MYLDAP.LDAP)                  AUTHTYPE(IDPWLDAP)
   ADOPTCTX(YES)                           DESCR(MYLDAP LDAP)
   CONNAME(myldap.ad.local(636))          CHCKCLNT(OPTIONAL)
   CHCKLOCL(OPTIONAL)                      CLASSGRP(group)
   CLASSUSR(user)                          FAILDLAY(1)
   FINDGRP(memberOf)                    
   BASEDNG(OU=Security,DC=MYLDAP,DC=ad,DC=local)
   BASEDNU(OU=Admin Accounts,DC=MYLDAP,DC=ad,DC=local)
   LDAPUSER(CN=x-svc-mqldap,DC=MYLDAP,DC=ad,DC=local)
   LDAPPWD(********************************)
   SHORTUSR(sAMAccountName)                GRPFIELD(sAMAccountName)
   USRFIELD(sAMAccountName)                AUTHORMD(SEARCHUSR)
   NESTGRP(YES)                            SECCOMM(YES)
   ALTDATE(2024-11-13)                     ALTTIME(12.42.00)

    However, in our internal tooling, we  see that the LDAP queries are done with clear text, so i seems is ignoring ldaps (as i specifically set the ldaps port):

    ANd here is the status of the connection.

    display qmstatus ldapconn
         8 : display qmstatus ldapconn
    AMQ8705I: Display Queue Manager Status Details.
       QMNAME(DEV_MQ)                    TYPE(QMGR)
       STATUS(RUNNING)                         LDAPCONN(CONNECTED)



    ------------------------------
    Andres Colodrero
    ------------------------------


  • 2.  RE: LDAP AuthInfo using uncrypted protocol

    Posted 11/14/24 03:28 AM

    By internal tooling i assume you are using something like wireshark to look at the packets?

    Your AUTHINFO object has SECCOMM(YES) set. This setting instructs the queue manager to make a secure connection to LDAP rather than insecure.

    Have you restarted your queue manager or run a REFRESH SECURITY command since you set that attribute value?

    If you have, this will need investigation by IBM MQ Support.



    ------------------------------
    Rob Parker
    Security Architect, IBM MQ Distributed
    IBM UK Ltd
    ------------------------------



  • 3.  RE: LDAP AuthInfo using uncrypted protocol

    Posted 11/14/24 11:44 AM

    Yes, we have defender publishing reports for not allowed protocols.

    I thought the logins came from MQ Explorer or other client. it turned out that the console web was enabled also and i did some changes on mqwebuser xml to enable SSL



    ------------------------------
    Andres Colodrero
    ------------------------------

    Original Message


Related Content