WMQ JNDI look up with authentication

Question

For the following code

 public class JMSSamplePut 
    {
      private static String initialContextUrl = null;
      private static String connectionFactoryFromJndi = "UM_QMGR_QCF";
      private static String queueFromJndi = "BCUFXW.EXB.ATHENA.FX.IN";
      private static String outString = "A sample text message " +
                                    "from JMSSampleput";
      private static int retryInterval = 10;
      private static int retryCount = 3;
      private static int connStatus = 1;


      /**
       * @param args
       */
      public static void main( String[] args ) 
      {

        // Variables
        Queue                   ioQueue      = null;
        QueueSession            session      = null;
        QueueSender             queueSender  = null;
        QueueConnection         connection   = null;
        QueueConnectionFactory  factory      = null;
        boolean                 transacted   = false;
        int i = 0;

        try { 
          // Instantiate the initial context for JNDI
          String contextFactory ="com.sun.jndi.fscontext.RefFSContextFactory";
          Hashtable environment = new Hashtable();
          environment.put(Context.INITIAL_CONTEXT_FACTORY, contextFactory);
          environment.put(Context.PROVIDER_URL, "file:/c:/jndi"); 
          Context context = new InitialDirContext(environment);
          System.out.println("Initial context found!");

          // Create a Queue ConnectionFactory
          factory = (QueueConnectionFactory) context.lookup(connectionFactoryFromJndi);

    ...........

The last line is failing with

caught JMSException: com.ibm.msg.client.jms.DetailedJMSSecurityException: JMSWMQ2013: The security authentication was not valid that was supplied for QueueManager '' with connection mode 'Client' and host name 'NATMIB1.hostname.net(1414)'. Please check if the supplied username and password are correct on the QueueManager you are connecting to linked exception: com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2035' ('MQRC_NOT_AUTHORIZED'). Finished

JVM args

-Djavax.net.ssl.keystore=c://keystore//a_dev.jks \
-Djavax.net.ssl.keyStorePassword=******** \
-Djavax.net.ssl.trustStorePassword=******** \
-Djavax.net.ssl.trustStore=c://keystore//cacerts.jks \
-Djavax.net.debug=all

Any pointers? Why is the following line?

security authentication was not valid that was supplied for QueueManager '' with connection mode 'Client' and host name 'NATMIB1.hostname.net(1414)'

Looks like the JNDI agent is not able to find the name of the QueueManager? I have the following line in .bindings file and the queue manager name is NATMIB1

UM_QMGR_QCF/RefAddr/3/Content=NATMIB1.xyz.net

Thanks in Advance

Sundar

T.Rob T.Rob · Accepted Answer · 2013-01-20T03:34:49

Debugging WMQ security errors is dead-simple if you have the right tools. First, go get SupportPac MS0P and install into WMQ Explorer according to the instructions. If you do not have a modern version of WMQ Explorer, you can download it from SupportPac MS0T.

Next, enable authorization events on the QMgr and recreate the error.

At this point, right-click on the event queue in WMQ Explorer and select Format Event Messages. This will show you all aspects of the error including:

The User ID that generated the error. Depending on the channel setup, exits and the client settings, the ID used may not be the one you expect.
The API call that was made. Probably Connect in this case, but sometimes this is also not what you expect. For example, the IBM JMS classes will always inquire on the QMgr to get the DLQ name and if you didn't grant inquire, it fails.
The exact options used for the call.
The object against which the call was issued.

Once you know these elements of the error, you can identify whether it is a problem with the ID itself, the channel, the authorizations for the ID, etc.

Update

In response to a question in the comments, to enable Authorization Events use MQ Explorer or runmqsc as follows:

For the MQ Explorer version, first right-click on the QMgr and select Properties.

Then select Events in the nav panel, set the events as required and click OK.

WMQ JNDI look up with authentication

2 Answers