IBM MQ调用失败，compcode为“2”('mqcc_failed')原因为“2035”('mqrc_not_authorized')

Question

String hostName = '...'
int port = ...
String queueManager = '...'
String channel = '...'
String userId = 'ABC123'
String password = '...'

JmsConnectionFactory cf = JmsFactoryFactory.
        getInstance(WMQConstants.WMQ_PROVIDER).
        createConnectionFactory()

cf.setStringProperty(WMQConstants.WMQ_HOST_NAME, hostName)
cf.setIntProperty(WMQConstants.WMQ_PORT, port)
cf.setStringProperty(WMQConstants.WMQ_CHANNEL, channel)
cf.setIntProperty(WMQConstants.WMQ_CONNECTION_MODE, WMQConstants.WMQ_CM_CLIENT)
cf.setStringProperty(WMQConstants.WMQ_QUEUE_MANAGER, queueManager)
cf.setStringProperty(WMQConstants.USERID, userId)
cf.setStringProperty(WMQConstants.PASSWORD, password)
// tried with both `true` and `false`... same error
cf.setBooleanProperty(WMQConstants.USER_AUTHENTICATION_MQCSP, true)

Connection connection = cf.createConnection()
connection.start()
connection.close()

Exception in thread "main" com.ibm.msg.client.jms.DetailedJMSSecurityException: 
JMSWMQ2013: The security authentication was not valid 
that was supplied for queue manager '...' with connection 
mode 'Client' and host name '...'.
Please check if the supplied username and password 
are correct on the queue manager to which you are 
connecting.  
Caused by: com.ibm.mq.MQException: JMSCMQ0001: IBM 
MQ call failed with compcode '2' ('MQCC_FAILED') reason 
'2035' ('MQRC_NOT_AUTHORIZED').

MQ团队告诉我，日志包含如下内容：-

----- amqzfuca.c : 4527 -------------------------------------------------------
04/17/2019 10:32:20 AM - Process(10468.40757) User(...) Program(...)
                    Host(...) Installation(Installation1)
                    VRMF(9.1.0.1) QMgr(...)
                    Time(2019-04-17T15:32:20.542Z)
                    RemoteHost(...)
                    CommentInsert1(...)
                    CommentInsert2(...)
                    CommentInsert3(CLNTUSER(XYZ) ADDRESS(...))

AMQ9777E: Channel was blocked

EXPLANATION:
The inbound channel '...' was blocked from address '...' 
because the active values of the channel matched a record
configured with USERSRC(NOACCESS). The active values of the channel were
'CLNTUSER(XYZ) ADDRESS(...)'.

...它失败了，因为它使用了错误的凭据来连接。

当我传入一个不同的凭据（用户ID:ABC123)时，MQ日志会看到我用来登录机器的用户ID（用户ID：XYZ）。

<dependency>
    <groupId>com.ibm.mq</groupId>
    <artifactId>com.ibm.mq.allclient</artifactId>
    <version>9.1.2.0</version>
</dependency>

如果我将user_authentication_mqcsp设置为false，那么现在我将得到不同的错误消息：-

04/22/2019 01:19:49 PM - Process(1147099.9759) User(...) Program(...)
            Host(rofesb911a) Installation(Installation1)
            VRMF(9.1.0.1) QMgr(...)
            Time(2019-04-22T18:19:49.323Z)
            RemoteHost(...)
            CommentInsert1(wa03598)
            CommentInsert2(REQUIRED)
            CommentInsert3(MCAUSER(ABC123) CLNTUSER(ABC123) ADDRESS(...))

AMQ9790I: The failed authentication check was caused by a CHLAUTH record with
CHCKCLNT(REQUIRED).

EXPLANATION:
The user ID 'ABC123' and its password were checked because the inbound
connection matched a channel authentication record with CHCKCLNT(REQUIRED).

The active values of the channel were 'MCAUSER(ABC123) CLNTUSER(ABC123)
ADDRESS(...)'. The MATCH(RUNCHECK) mode of the DISPLAY CHLAUTH
MQSC command can be used to identify the relevant CHLAUTH record.

好消息是它看到了正确的用户ID(ABC123)，但我被告知密码无效。我不认为这是密码问题，因为我能够使用相同的凭据访问其他受保护的web服务。

Answer 1

您的MQ团队已经给了您要使用的凭据（即用户id和密码），所以我假设他们已经在队列管理器上打开了用户id和密码检查。

ADOPTCTX(YES)是队列管理器上的一个设置，它指示一旦用户id和密码被验证为正确，用户id（在您的示例中为“ABC123”）就应该用于所有进一步的安全检查（例如，是否允许我使用此队列）。如果此设置为否，则在密码验证完成后，它实际上将使用客户端计算机登录的用户id，该用户id也被发送到队列管理器（在您的示例中为“XYZ”）。队列管理器上的情况似乎就是这样。

实际上有两种方式可以将用户id和密码从Java客户机应用程序发送到队列管理器。

null