Why do I get a MQRC_NOT_AUTHORIZED error when trying to get channel information using PCF?

Question

I am using MQ Java PCF API to retrieve information from an MQ installation. There are several constructors for the class PCFMessageAgent. There is one that accepts the host, port and channel name. I have shown an extract from the documentation.

public PCFMessageAgent(String host, int port, String channel) throws MQException Initialises a new PCFMessageAgent with a client connection to a queue manager.
The code I have is

    PCFMessageAgent agent = new PCFMessageAgent(host, port, "SYSTEM.DEF.SVRCONN");
    PCFMessage pcfCmd = new PCFMessage(MQConstants.MQCMD_INQUIRE_CHANNEL);
    pcfCmd.addParameter(MQConstants.MQCACH_CHANNEL_NAME, channelName);
    PCFMessage[] pcfResponse = agent.send(pcfCmd);

but I get a MQRC_NOT_AUTHORIZED error

Exception in thread "main" com.ibm.mq.MQException: MQJE001: Completion Code '2', Reason '2035'.
    at com.ibm.mq.MQManagedConnectionJ11.<init>(MQManagedConnectionJ11.java:249)
    at com.ibm.mq.MQClientManagedConnectionFactoryJ11._createManagedConnection(MQClientManagedConnectionFactoryJ11.java:450)
    at com.ibm.mq.MQClientManagedConnectionFactoryJ11.createManagedConnection(MQClientManagedConnectionFactoryJ11.java:487)
    at com.ibm.mq.StoredManagedConnection.<init>(StoredManagedConnection.java:97)
    at com.ibm.mq.MQSimpleConnectionManager.allocateConnection(MQSimpleConnectionManager.java:194)
    at com.ibm.mq.MQQueueManagerFactory.obtainBaseMQQueueManager(MQQueueManagerFactory.java:868)

Why do I get this error? How do I fix this.

I found this in the error logs. Any help will be much appreciated.

07/08/17 15:42:51 - Process(3294.15) User(user1) Program(amqrmppa)
                    Host(ubuntuvm-2) Installation(Installation1)
                    VRMF(8.0.0.7) QMgr(QM_FR2_2)

AMQ9777: Channel was blocked

EXPLANATION:
The inbound channel 'SYSTEM.DEF.SVRCONN' was blocked from address
'192.168.56.101' because the active values of the channel matched a record
configured with USERSRC(NOACCESS). The active values of the channel were
'CLNTUSER(user1)'.
ACTION:
Contact the systems administrator, who should examine the channel
authentication records to ensure that the correct settings have been
configured. The ALTER QMGR CHLAUTH switch is used to control whether channel
authentication records are used. The command DISPLAY CHLAUTH can be used to
query the channel authentication records.
----- cmqxrmsa.c : 1462 -------------------------------------------------------
07/08/17 15:42:51 - Process(3294.15) User(user1) Program(amqrmppa)
                    Host(ubuntuvm-2) Installation(Installation1)
                    VRMF(8.0.0.7) QMgr(QM_FR2_2)

AMQ9999: Channel 'SYSTEM.DEF.SVRCONN' to host '192.168.56.101' ended
abnormally.

EXPLANATION:
The channel program running under process ID 3294 for channel
'SYSTEM.DEF.SVRCONN' ended abnormally. The host name is '192.168.56.101'; in
some cases the host name cannot be determined and so is shown as '????'.
ACTION:
Look at previous error messages for the channel program in the error logs to
determine the cause of the failure. Note that this message can be excluded
completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
found in the System Administration Guide.
----- amqrmrsa.c : 930 --------------------------------------------------------

JoshMc JoshMc · Accepted Answer · 2017-08-07T19:47:59

The issue is that you are attempting to connect to the channel SYSTEM.DEV.SVRCONN. By default there is a CHLAUTH rule that blocks access to channels named SYSTEM.*.

You can create a new SVRCONN channel that does not have a name that starts with SYSTEM and it would get past this check.

Why do I get a MQRC_NOT_AUTHORIZED error when trying to get channel information using PCF?

1 Answers