WebSphere MQ 7.1帮助需求 - 访问或安全性

WebSphere MQ 7.1帮助需求 - 访问或安全性

问题描述:

我想在WebSphere MQ服务器上创建一个队列管理器和一个队列,我想做两件事
1)使用客户端框中的WMQ Explorer访问队列管理器和队列
2编写一个在客户端框上运行的Java独立应用程序,并从队列中放入和接收消息。

I want to create a queue manager and a queue on the WebSphere MQ server and I want to do two things 1) access the queue manager and the queue using WMQ Explorer from a client box 2) write a Java stand-alone app that runs on the client box and puts and receives message from the queue.

但是我收到身份验证例外。请让我知道我做错了什么?

However I am getting authentication exceptions. Please let me know what I am doing wrong?

我有WebSphere MQ v7。 1已安装

队列管理器 QM_TEST 已创建( crtmqm strmqm 命令)

本地队列 Q_TEST 已创建( runmqsc 和 define qlocal )

SVRCONN通道定义( DEFINE CHANNEL(TEST_CHANNEL)CHLTYPE(SVRCONN)TRPTYPE(TCP)

启动了一个监听器( runmqlsr -t tcp -m QM_TEST -p 1414

I have WebSphere MQ v7.1 installed
Queue manager QM_TEST created (crtmqm, strmqm commands)
Local queue Q_TEST created (runmqsc and the define qlocal)
SVRCONN channel defined (DEFINE CHANNEL (TEST_CHANNEL) CHLTYPE (SVRCONN) TRPTYPE (TCP))
started a listener (runmqlsr -t tcp -m QM_TEST -p 1414)

尝试使用主机名,IP地址,队列管理器名称和通道名称显示/隐藏队列管理器;但是我收到以下错误:

Tried to Show/Hide the queue manager using hostname, ip address, queue manager name and the channel name; However I get the following error:

Access not permitted. You are not authorized to perform this operation. (AMQ4036)
Severity: 10 (Warning)
Explanation: The queue manager security mechanism has indicated that the userid associated with this request is not authorized to access the object.

尝试使用java代码访问队列管理器和队列,下面给出了重点:

Tried to access the queue manager and the queue using the java code, highlights given below:

public void sendMail(Mail mail) { MQConnectionFactory cf = new
MQQueueConnectionFactory(); Connection conn = null; try { //config
cf.setHostName("hostname"); cf.setPort(1414);
cf.setQueueManager("QM_TEST"); cf.setChannel("TEST_CHANNEL");
cf.setTransportType(WMQConstants.WMQ_CM_CLIENT);//WMQ_CM_DIRECT_TCPIP);
WMQ_CM_CLIENT

conn = cf.createConnection(); //fails here

但是我收到以下错误:


发生错误:JMSWMQ2013:安全认证无效
为QueueManager'QM_TEST'提供连接模式
'客户'和主机名'主机名(1414)'。

Error occurred :JMSWMQ2013: The security authentication was not valid that was supplied for QueueManager 'QM_TEST' with connection mode 'Client' and host name 'hostname(1414)'.

你能帮忙吗?如何传递安全认证信息?现在,如果我也可以禁用安全性,那也没关系。只需要让这个工作吗?

Can you help? How do I pass the security authentication information? For now, it is OK if I can disable security as well. Just need to get this working?

如果我需要提供更多信息,请告诉我。

Let me know if I need to provide more information.

更新:

我创建了mq-userlinux用户(mq-users组)。 CHLAUTH已启用(默认)。
创建队列管理器QM_TEST(使用sudo mqm)后,我使用sudo mqm再次执行了以下mqsc命令:

UPDATE:
I have created 'mq-user' linux user (mq-users group). CHLAUTH is enabled (default). After creating the queue manager QM_TEST (using sudo mqm) I have executed the following mqsc commands again using sudo mqm:

DEFINE QLOCAL(TEST_QUEUE)
SET AUTHREC PROFILE('TEST_QUEUE') OBJTYPE(QUEUE) PRINCIPAL('mq-user') AUTHADD(PUT,GET)
SET AUTHREC OBJTYPE(QMGR) PRINCIPAL('mq-user') AUTHADD(CONNECT)
DEFINE CHANNEL (TEST_CHANNEL) CHLTYPE (SVRCONN) TRPTYPE (TCP)
SET CHLAUTH(TEST_CHANNEL) TYPE(ADDRESSMAP) ADDRESS('xxx.xx.xxx.*') MCAUSER('mq-user')
DEFINE LISTENER (TEST_LISTENER) TRPTYPE (TCP) CONTROL (QMGR) PORT (1414)
START LISTENER (TEST_LISTENER)

我仍然无法获得AMQ4036访问错误。请注意,我从作为第三个用户登录的第三台远程计算机(客户端计算机)访问队列管理器和队列。但是我意识到我可以传递'mq-user'凭据。我希望有一个明确的分步说明,WebShere MQ 71.信息中心对我来说不够清楚。

I still get AMQ4036 access not permitted error. Mind you, I access the Queue Manager and Queue from a third remote machine (client machine) logged in as a third user. However I realize I can pass 'mq-user' credentials. I wish there was a clear step by step instructions somewhere, WebShere MQ 71. infocenter is not clear enough for me.

这里还缺少什么?

对于WMQ的v7.1,队列管理器默认不允许管理连接。因此,如果您使用的ID是 mqm ,或者它是在MQ服务器上的 mqm 组中,那么将无法访问。 easy(读取:NOT SECURE)解决此问题的方法是删除包含规则的CHLAUTH记录。 IBM已发布有关此此处的技术说明。

With v7.1 of WMQ the queue manager will by default not allow administrative connections. So if the ID that you are using is mqm or if it is in the mqm group on the MQ server, it won't have access. The easy (read: NOT SECURE) way to address this is to delete the CHLAUTH record which contains the rule. IBM has published a TechNote about this here.

更长期和更好的解决方案是保留不允许管理访问的CHLAUTH记录,而是使用不同的用户ID进行连接。当然,该ID需要存在于MQ服务器中并且位于已授权的组中。有关该主题的更多信息,请查看幻灯片和网络研讨会录制这里

A longer-term and better solution is to keep the CHLAUTH record that disallows administrative access and instead connect using a different user ID. Of course, that ID will need to exist in the MQ server and be in a group that is authorized. For more on that topic, take a look at the slides and webinar recording here.

当您准备重新打开安全性时,您可以找到有关 setmqaut 命令的大量信息在 t-rob.net ,我已经在IMPACT和欧洲WSTC会议上存档了安全演示和实验室。

When you are ready to turn security back on, you can find plenty of information on what setmqaut commands to use at t-rob.net where I've archived the security presentations and labs from the IMPACT and European WSTC conferences.