Hi,

im trying to set the MQ Web Console integration with active directory. I managed to connect to LDAP and authenticate the user connecting to MQ Web Console. Now, i have a problem to understand how to query if this user is authorized to access:

<enterpriseApplication id="com.ibm.mq.console">
        <application-bnd>
            <security-role name="MQWebAdmin">
                <group name="CN=mq-admins,OU=Security,OU=Users and Computers,DC=domain,DC=ad,DC=local" 
                realm="defaultRealm"/>
            </security-role>
        </application-bnd>
    </enterpriseApplication>

And here the LDAP settings:

<ldapRegistry id="ldap" 
        realm="defaultRealm" 
        host="domain.ad.local" 
        port="389"
        ignoreCase="true" 
        bindDN="CN=mqldap,OU=Services,DC=domain,DC=ad,DC=local" 
        bindPassword="xxxxxxxxxxxxxxxx" 
        baseDN="OU=Services,DC=center1,DC=ad,DC=local"
        ldapType="Microsoft Active Directory"
        searchTimeout="2m"
        sslEnabled="false"
        recursiveSearch="true"
        sslRef="thisSSLConfig">
        <activedFilters 
           userFilter="(&amp;(sAMAccountName=%v)(objectcategory=user))"
           groupFilter="(&amp;(objectClass=group)(member=%v))"
           userIdMap="user:sAMAccountName" 
           groupIdMap="group:cn" 
           groupMemberIdMap="memberOf:member">
         </activedFilters>
    </ldapRegistry>

The loging return a user :

CN=mq admin user ,OU=Admin Accounts,,OU=Services,DC=center1,DC=ad,DC=local

------------------------------
Andres Colodrero
------------------------------

Hi Andres,

Do you get any error messages that might help us to debug the issue? And probably a stupid question but in your XML you define the group as 

CN=mq-admins,OU=Security,OU=Users and Computers,DC=domain,DC=ad,DC=local

and according to the description the returning user has a MemberOf definition without a hyphen as 

CN=mq admins,OU=Security,OU=Users and Computers,DC=domain,DC=ad,DC=local

Maybe a typo but just checking....

HI and thanks for the answer.

I debugged a bit with "ldapsearch", until i could get the correct groups. It looked like base search was incorrect

Hi Andres

I'm a bit late to the party since your issue is solved. I like to use nettools to build my ldap queries. I find it a very user friendly tool. Maybe it can help you in the future :)

https://nettools.net/download/