| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
| query about CLNTUSER & MCAUSER |
« View previous topic :: View next topic » |
| Author |
Message
|
| PeterPotkay |
 Posted: Thu Dec 11, 2014 9:39 am Post subject: |
 |
|
Poobah
Joined: 15 May 2001
Posts: 7723
|
Can you show the entries from your MQ error log when you had the rules that blocked everything? What you displayed above doesn't look like the MQ error log. It looks like some tool's display of the MQ Events, which may or may not have the same info the MQ error log does when the CHLAUTH rule records there. It was different in my case and was the only thing that allowed me to figure it out.
Review the thread I linked to above and look for the posts where I claimed "Success!!!!"
_________________
Peter Potkay
Keep Calm and MQ On |
|
| Back to top |
|
 |
| hklbj |
| Posted: Thu Dec 11, 2014 5:30 pm Post subject: |
|
|
Apprentice
Joined: 20 Jun 2007
Posts: 34
Location: HK
|
| PeterPotkay wrote: |
Can you show the entries from your MQ error log when you had the rules that blocked everything? What you displayed above doesn't look like the MQ error log. It looks like some tool's display of the MQ Events, which may or may not have the same info the MQ error log does when the CHLAUTH rule records there. It was different in my case and was the only thing that allowed me to figure it out.
Review the thread I linked to above and look for the posts where I claimed "Success!!!!" |
Peter, those entries are Event message from SYSTEM.ADMIN.CHANNEL.EVENT queue. Error log show similar result.
| Code: |
----- amqrmrsa.c : 898 --------------------------------------------------------
12/11/2014 04:32:20 PM - Process(19269.151) User(mqm) Program(amqrmppa)
Host(rhmq1.glshk.com) Installation(Installation1)
VRMF(7.5.0.0) QMgr(GLS_CPA_D1)
AMQ9777: Channel was blocked
EXPLANATION:
The inbound channel 'CH.TEST.1' was blocked from address '10.145.1.11' because
the active values of the channel matched a record configured with
USERSRC(NOACCESS). The active values of the channel were 'CLNTUSER(wing)'.
ACTION:
Contact the systems administrator, who should examine the channel
authentication records to ensure that the correct settings have been
configured. The ALTER QMGR CHLAUTH switch is used to control whether channel
authentication records are used. The command DISPLAY CHLAUTH can be used to
query the channel authentication records.
----- cmqxrmsa.c : 910 --------------------------------------------------------
12/11/2014 04:32:20 PM - Process(19269.151) User(mqm) Program(amqrmppa)
Host(rhmq1.glshk.com) Installation(Installation1)
VRMF(7.5.0.0) QMgr(GLS_CPA_D1)
AMQ9999: Channel 'CH.TEST.1' to host '10.145.1.11 (10.145.1.11)' ended
abnormally.
EXPLANATION:
The channel program running under process ID 19269 for channel 'CH.TEST.1'
ended abnormally. The host name is '10.145.1.11 (10.145.1.11)'; in some cases
the host name cannot be determined and so is shown as '????'.
ACTION:
Look at previous error messages for the channel program in the error logs to
determine the cause of the failure. Note that this message can be excluded
completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
found in the System Administration Guide.
----- amqrmrsa.c : 898 --------------------------------------------------------
12/11/2014 04:32:26 PM - Process(19269.152) User(mqm) Program(amqrmppa)
Host(rhmq1.glshk.com) Installation(Installation1)
VRMF(7.5.0.0) QMgr(GLS_CPA_D1)
AMQ9777: Channel was blocked
EXPLANATION:
The inbound channel 'CH.TEST.1' was blocked from address '10.145.1.11' because
the active values of the channel matched a record configured with
USERSRC(NOACCESS). The active values of the channel were 'CLNTUSER(wing)'.
ACTION:
Contact the systems administrator, who should examine the channel
authentication records to ensure that the correct settings have been
configured. The ALTER QMGR CHLAUTH switch is used to control whether channel
authentication records are used. The command DISPLAY CHLAUTH can be used to
query the channel authentication records.
----- cmqxrmsa.c : 910 --------------------------------------------------------
12/11/2014 04:32:26 PM - Process(19269.152) User(mqm) Program(amqrmppa)
Host(rhmq1.glshk.com) Installation(Installation1)
VRMF(7.5.0.0) QMgr(GLS_CPA_D1)
AMQ9999: Channel 'CH.TEST.1' to host '10.145.1.11 (10.145.1.11)' ended
abnormally.
EXPLANATION:
The channel program running under process ID 19269 for channel 'CH.TEST.1'
ended abnormally. The host name is '10.145.1.11 (10.145.1.11)'; in some cases
the host name cannot be determined and so is shown as '????'.
ACTION:
Look at previous error messages for the channel program in the error logs to
determine the cause of the failure. Note that this message can be excluded
completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
found in the System Administration Guide.
----- amqrmrsa.c : 898 --------------------------------------------------------
12/11/2014 04:33:03 PM - Process(19269.153) User(mqm) Program(amqrmppa)
Host(rhmq1.glshk.com) Installation(Installation1)
VRMF(7.5.0.0) QMgr(GLS_CPA_D1)
AMQ9777: Channel was blocked
EXPLANATION:
The inbound channel 'CH.TEST.1' was blocked from address '10.145.1.11' because
the active values of the channel matched a record configured with
USERSRC(NOACCESS). The active values of the channel were 'CLNTUSER(wing)'.
ACTION:
Contact the systems administrator, who should examine the channel
authentication records to ensure that the correct settings have been
configured. The ALTER QMGR CHLAUTH switch is used to control whether channel
authentication records are used. The command DISPLAY CHLAUTH can be used to
query the channel authentication records.
----- cmqxrmsa.c : 910 --------------------------------------------------------
12/11/2014 04:33:03 PM - Process(19269.153) User(mqm) Program(amqrmppa)
Host(rhmq1.glshk.com) Installation(Installation1)
VRMF(7.5.0.0) QMgr(GLS_CPA_D1)
AMQ9999: Channel 'CH.TEST.1' to host '10.145.1.11 (10.145.1.11)' ended
abnormally.
EXPLANATION:
The channel program running under process ID 19269 for channel 'CH.TEST.1'
ended abnormally. The host name is '10.145.1.11 (10.145.1.11)'; in some cases
the host name cannot be determined and so is shown as '????'.
ACTION:
Look at previous error messages for the channel program in the error logs to
determine the cause of the failure. Note that this message can be excluded
completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
found in the System Administration Guide.
----- amqrmrsa.c : 898 --------------------------------------------------------
12/11/2014 04:33:09 PM - Process(19269.154) User(mqm) Program(amqrmppa)
Host(rhmq1.glshk.com) Installation(Installation1)
VRMF(7.5.0.0) QMgr(GLS_CPA_D1)
AMQ9777: Channel was blocked
EXPLANATION:
The inbound channel 'CH.TEST.1' was blocked from address '10.145.1.11' because
the active values of the channel matched a record configured with
USERSRC(NOACCESS). The active values of the channel were 'CLNTUSER(wing)'.
ACTION:
Contact the systems administrator, who should examine the channel
authentication records to ensure that the correct settings have been
configured. The ALTER QMGR CHLAUTH switch is used to control whether channel
authentication records are used. The command DISPLAY CHLAUTH can be used to
query the channel authentication records.
----- cmqxrmsa.c : 910 --------------------------------------------------------
12/11/2014 04:33:09 PM - Process(19269.154) User(mqm) Program(amqrmppa)
Host(rhmq1.glshk.com) Installation(Installation1)
VRMF(7.5.0.0) QMgr(GLS_CPA_D1)
AMQ9999: Channel 'CH.TEST.1' to host '10.145.1.11 (10.145.1.11)' ended
abnormally.
EXPLANATION:
The channel program running under process ID 19269 for channel 'CH.TEST.1'
ended abnormally. The host name is '10.145.1.11 (10.145.1.11)'; in some cases
the host name cannot be determined and so is shown as '????'.
ACTION:
Look at previous error messages for the channel program in the error logs to
determine the cause of the failure. Note that this message can be excluded
completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
found in the System Administration Guide.
----- amqrmrsa.c : 898 --------------------------------------------------------
12/11/2014 04:33:14 PM - Process(19269.155) User(mqm) Program(amqrmppa)
Host(rhmq1.glshk.com) Installation(Installation1)
VRMF(7.5.0.0) QMgr(GLS_CPA_D1)
AMQ9777: Channel was blocked
EXPLANATION:
The inbound channel 'CH.TEST.1' was blocked from address '10.145.1.11' because
the active values of the channel matched a record configured with
USERSRC(NOACCESS). The active values of the channel were 'CLNTUSER(wing)'.
ACTION:
Contact the systems administrator, who should examine the channel
authentication records to ensure that the correct settings have been
configured. The ALTER QMGR CHLAUTH switch is used to control whether channel
authentication records are used. The command DISPLAY CHLAUTH can be used to
query the channel authentication records.
----- cmqxrmsa.c : 910 --------------------------------------------------------
12/11/2014 04:33:14 PM - Process(19269.155) User(mqm) Program(amqrmppa)
Host(rhmq1.glshk.com) Installation(Installation1)
VRMF(7.5.0.0) QMgr(GLS_CPA_D1)
AMQ9999: Channel 'CH.TEST.1' to host '10.145.1.11 (10.145.1.11)' ended
abnormally.
EXPLANATION:
The channel program running under process ID 19269 for channel 'CH.TEST.1'
ended abnormally. The host name is '10.145.1.11 (10.145.1.11)'; in some cases
the host name cannot be determined and so is shown as '????'.
ACTION:
Look at previous error messages for the channel program in the error logs to
determine the cause of the failure. Note that this message can be excluded
completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
found in the System Administration Guide.
----- amqrmrsa.c : 898 --------------------------------------------------------
12/11/2014 04:33:21 PM - Process(19269.156) User(mqm) Program(amqrmppa)
Host(rhmq1.glshk.com) Installation(Installation1)
VRMF(7.5.0.0) QMgr(GLS_CPA_D1)
AMQ9777: Channel was blocked
EXPLANATION:
The inbound channel 'CH.TEST.1' was blocked from address '10.145.1.11' because
the active values of the channel matched a record configured with
USERSRC(NOACCESS). The active values of the channel were 'CLNTUSER(wing)'.
ACTION:
Contact the systems administrator, who should examine the channel
authentication records to ensure that the correct settings have been
configured. The ALTER QMGR CHLAUTH switch is used to control whether channel
authentication records are used. The command DISPLAY CHLAUTH can be used to
query the channel authentication records.
----- cmqxrmsa.c : 910 --------------------------------------------------------
12/11/2014 04:33:21 PM - Process(19269.156) User(mqm) Program(amqrmppa)
Host(rhmq1.glshk.com) Installation(Installation1)
VRMF(7.5.0.0) QMgr(GLS_CPA_D1)
AMQ9999: Channel 'CH.TEST.1' to host '10.145.1.11 (10.145.1.11)' ended
abnormally.
EXPLANATION:
The channel program running under process ID 19269 for channel 'CH.TEST.1'
ended abnormally. The host name is '10.145.1.11 (10.145.1.11)'; in some cases
the host name cannot be determined and so is shown as '????'.
ACTION:
Look at previous error messages for the channel program in the error logs to
determine the cause of the failure. Note that this message can be excluded
completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
found in the System Administration Guide.
----- amqrmrsa.c : 898 --------------------------------------------------------
[mqm@rhmq1 errors]$
|
|
|
| Back to top |
|
|
| fjb_saper |
| Posted: Sat Dec 13, 2014 6:01 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20768
Location: LI,NY
|
Well looks like everything is lower case wing...
Now you need to check your different chlauth setup.
You may have a hole somewhere in there and that lets wing through in the specific case...
Easy set the mcauser to 'nobody' or some user that don't exist or has no authority whatsoever...
Then positively map wing in chlauth...
Have fun 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| hklbj |
| Posted: Sun Dec 14, 2014 7:03 pm Post subject: |
|
|
Apprentice
Joined: 20 Jun 2007
Posts: 34
Location: HK
|
| fjb_saper wrote: |
Well looks like everything is lower case wing...
Now you need to check your different chlauth setup.
You may have a hole somewhere in there and that lets wing through in the specific case...
Easy set the mcauser to 'nobody' or some user that don't exist or has no authority whatsoever...
Then positively map wing in chlauth...
Have fun |
fjb, actually not much rule defined in this qmgr. You can have idea from screenshot. I just don't know why it always send 'wing' to QM from client application no matter what id I used, 'mqm', 'Wing' etc. I just thinking is it related to Windows MQ client (developed by dotnet framework) connected with Linux MQ server. 
 |
|
| Back to top |
|
|
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
