1. 技术文章
  2. Can create Websphere Queue Manager but not connect

Can create Websphere Queue Manager but not connect

由 て烟熏妆下的殇ゞ 提交于 2019-12-05 07:44:51
T.Rob

If you have a recent trial version of WMQ then you are working with a v7.1 QMgr. As of v7.1 WMQ will allow only non-privileged remote connections. In order to connect with an administrator account, it will be necessary to either disable the restrictions or, better yet, to define a new channel for the administrative connection and authenticate it.

With Windows the biggest issue is that WMQ authenticates domain IDs and must look up their groups. One very common problem when running WMQ in a corporate environment is that it attempts to lookup an ID or group and does not have the domain rights to do so. Domain accounts, even those with local admin rights, often fail because they don't have access to inquire in the domain SAM to do group lookups. There's a whole section in the Infocenter here describing the requirements for Windows accounts.

One workaround for this for dev environments only is to create a local administrator's account, then log on with that and create the QMgr. Or make sure that the default account MUSR_MQADMIN has local admin rights and login rights. Again,, you must actually log in with the account to make this work because that way there is never a requirement to look up an account in Active Directory because it all hits the local SAM database. Again, this is just for development! In Production you'd want to use a real domain account and grant it the correct access rights to do SAM lookups but NOT make it a local admin, as described in the Infocenter section linked above.

Assuming that you have succeeded in creating the QMgr, next create a new channel and authorize it to accept your local connections using the admin account:

runmqsc
* Define the channel, anyone connecting runs as MUSR_MQADMIN
DEFINE CHL('DOTNET.SVRCONN')  CHLTYPE(SVRCONN) MCAUSER('MUSR_MQADMIN@hostname')

* Override default block-list - channel now allows ANYBODY
SET CHLAUTH('DOTNET.SVRCONN') TYPE(BLOCKUSER) USERLIST('nobody')

* Block access from ALL IP addresses
SET CHLAUTH('DOTNET.SVRCONN') TYPE(ADDRESSMAP) ADDRESS('*') USERSRC(NOACCESS) WARN(NO) ACTION(ADD)

* Allow access from local host only
SET CHLAUTH('DOTNET.SVRCONN') TYPE(ADDRESSMAP) ADDRESS('127.0.0.1') USERSRC(CHANNEL) ACTION(ADD) 

END

Now you have a channel that will accept local connections ONLY, map these to an administrative account and then override the security that prevents administrative accounts from connecting remotely. Using the admin account means that no queue or QMgr authorizations are required and the account being a local admin means that there are no domain lookup issues. The MCAUSER('MUSR_MQADMIN) converts every remote ID to the local admin ID so that WMQ doesn't need to look up the remote IDs. The mapping rule restricts connections to the local host only. Anyone who can connect to the channel will have local admin on the box with the ability to remotely execute OS code so if you wanted to accept connections from other users, authenticating them with certificates would be recommended.

Shashi

You may want to read this post by T.Rob here. Also other security related posts from him, they are very helpful.

I had a similar problem. My office dektop is running windows xp 32 bit and my project required me to install Websphere MQ 7 (WMQ) on local. Having local admin rights on my PC I was able to install WMQ without domain controller option configuration and add quemanager but was not able to add any local queues. Upon checking the error logs I found that my user id is not having enough permission.

So the fix is - verify your login id is part of Administrators group on your domain. Go to control-->user accounts to check your user id. If you have local admin rights on your pc then you can add your user id as a part of Administrator group. Now Delete the previously created queue manager. Restart WMQ & create queuemanager again. You should now see all the options for adding local queues, topics etc.. under newly created queue manager.

An unexpected error (2063) has occurred. (AMQ4999)

The above error can occur also because of the permission issue, check with the Groups permission and add the users

标签
ibm-mq
易学教程内所有资源均来自网络或用户发布的内容，如有违反法律规定的内容欢迎反馈！
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!