ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum IndexIBM MQ File Transfer EditionMQMFT Agent transfers sometimes failing auth

Post new topicReply to topic
MQMFT Agent transfers sometimes failing auth View previous topic :: View next topic
Author Message
stevenstevensod
PostPosted: Thu Nov 14, 2019 6:52 am Post subject: MQMFT Agent transfers sometimes failing auth Reply with quote

Newbie

Joined: 14 Nov 2019
Posts: 3

I've recently starting working with MQ and MQMFT and we've noticed some odd auth failures when some transfers are triggering.

Agents connect to using MQMFTCredentials which hold a ciphered user/pass. I've double checked the user/pass by re fteObfuscate'ing them and they are as expected.

We have a transfer which invoke an antscript to manage the transfer of a number of wildcarded source paths, and as part of the antscript it also archives the file. Essentially, the parent job invokes 6 transfer tasks, and then invokes 6 archive tasks.

Now, sometimes this processes perfectly fine. Other times the agent shutdown half way through due to auth failure. Note that the auth or other config hasn't changed, it is just running the same job again.

Code:

[14/11/2019 11:40:20:040 GMT] 0000008c TransferSende E   BFGTR0022E: The agent has received a reason code of '2035' from the message queue interface (MQI). The agent cannot continue processing and will now end.
[14/11/2019 11:40:30:119 GMT] 00000097 AgentRuntime  I   BFGAG0139I: The agent has suspended its current transfers and is now stopping.


after reviewing the qm error logs you can see that there has been an auth failure, but what is weird is it thinks it was passed the user "iple.37^Amftuser". For reference, the user is "mftuser" and the password ends in iple.37.

Code:

11/14/2019 11:27:34 AM - Process(35039.1643987) User(mqm) Program(amqzlaa0)
                    Host(euukteialdev04) Installation(Installation1)
                    VRMF(9.0.5.0) QMgr(QMSMFT01)
                    Time(2019-11-14T11:27:34.586Z)
                    CommentInsert1(iple.37^Amftuser)
                    CommentInsert2(SYSTEM.DEFAULT.AUTHINFO.IDPWOS)
                    CommentInsert3(CHCKCLNT(OPTIONAL))

AMQ5542I: The failed authentication check was caused by the queue manager
CONNAUTH CHCKCLNT(OPTIONAL) configuration.

EXPLANATION:
The user ID 'iple.37^Amftuser' and its password were checked because the queue
manager connection authority (CONNAUTH) configuration refers to an
authentication information (AUTHINFO) object named
'SYSTEM.DEFAULT.AUTHINFO.IDPWOS' with CHCKCLNT(OPTIONAL).

This message accompanies a previous error to clarify the reason for the user ID
and password check.
ACTION:
Refer to the previous error for more information.

Ensure that a password is specified by the client application and that the
password is correct for the user ID. The authentication configuration of the
queue manager connection determines the user ID repository. For example, the
local operating system user database or an LDAP server.

If the CHCKCLNT setting is OPTIONAL, the authentication check can be avoided by
not passing a user ID across the channel. For example, by omitting the MQCSP
structure from the client MQCONNX API call.

To avoid the authentication check, you can amend the authentication
configuration of the queue manager connection, but you should generally not
allow unauthenticated remote access.


Remember that this job works the majority of the time but then does this occasionally. I'm unsure on where to look or what to try to debug this issue, so any suggestions would be great!

Cheers
Back to top
View user's profile Send private message
gbaddeley
PostPosted: Thu Nov 14, 2019 2:49 pm Post subject: Reply with quote

Jedi

Joined: 25 Mar 2003
Posts: 2149
Location: Melbourne, Australia

I suggest raising a Service Request with IBM.
_________________
Glenn
Back to top
View user's profile Send private message
Display posts from previous:
Post new topicReply to topic Page 1 of 1

MQSeries.net Forum IndexIBM MQ File Transfer EditionMQMFT Agent transfers sometimes failing auth
Jump to:



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP


Theme by Dustin Baccetti
Powered by phpBB 2001, 2002 phpBB Group

Copyright MQSeries.net. All rights reserved.