Friday, May 22, 2015

WebSphere MQ Client throws 2035 (MQRC_NOT_AUTHORIZED) after upgrading MQ QueueManager to version 8


It took me a while to figure out, so here is a solution to this issue:

Problem: after an upgrade (or rather uninstall/install) of an MQSeries Queue Manager to Version 8.0.0, my C application suddenly complains about being not authorized: 

MQCONNX(qmgr=,MQCNO_STANDARD_BINDING) - reason: 2035 (MQRC_NOT_AUTHORIZED)

Now, the issue, it seems is that with MQ Verson 8, by default, the administrator must have user id and password set if he uses the MQ Client connection. I'm not here to judge, but you should read this 

To be sure your issue is the same as mine, check your error log in C:\ProgramData\IBM\MQ\qmgrs\QM1\errors\AMQERR01.LOG:

----- amqzfuca.c : 4107 -------------------------------------------------------
5/22/2015 10:12:55 - Process(27776.20) User(apodehl) Program(amqzlaa0.exe)
                      Host(BERLIN) Installation(Installation1)
                      VRMF(8.0.0.0) QMgr(QM1)                     
AMQ5541: The failed authentication check was caused by the queue manager
CONNAUTH CHCKCLNT(REQDADM) configuration.
EXPLANATION:
The user ID 'apodehl' and its password were checked because the user ID is
privileged and the queue manager connection authority (CONNAUTH) configuration
refers to an authentication information (AUTHINFO) object named
'SYSTEM.DEFAULT.AUTHINFO.IDPWOS' with CHCKCLNT(REQDADM). 



Solution: be aware of the security implications, but you can change this authentication in the WebSphere MQ Explorer -> QM1 -> Authentication Information, choose SYSTEM...IDPWOS and set "Check client connections" to be "None" instead of 'Required for Adminstrators'