Question

我正在尝试使用完整的MQ客户端安装从C＃应用程序连接到Websphere MQ 7.5服务器的测试实例（在Windows域上），但我没有运气。我一直从MQ服务器获取错误代码 2035 MQRC_NOT_AUTHORIZED 。最初我尝试了以下代码：

string QueueManagerName = "myNewQManager";
MQEnvironment.Hostname = "tst-mqsvr";
MQEnvironment.Channel = "test.channel";
MQEnvironment.Port = 1414;
MQEnvironment.UserId = "domainUser";
MQEnvironment.Password = "********";
//set transport properties.
MQEnvironment.properties[MQC.TRANSPORT_PROPERTY] = MQC.TRANSPORT_MQSERIES_CLIENT;
try
{
    queueManager = new MQQueueManager(QueueManagerName);
}
catch(MQException mqexp)
{
    //I get the error code 2035
    log.Error(mqexp)
}

更改为此功能也不起作用：

string QueueManagerName = "myNewQManager";
var queueProperties = new Hashtable();
queueProperties[MQC.TRANSPORT_PROPERTY] = MQC.TRANSPORT_MQSERIES_CLIENT;
queueProperties[MQC.HOST_NAME_PROPERTY] = "tst-mqsvr";
queueProperties[MQC.PORT_PROPERTY] = "1414";
queueProperties[MQC.CHANNEL_PROPERTY] = "test.channel";
queueProperties[MQC.USER_ID_PROPERTY] = "domainUser";
queueProperties[MQC.PASSWORD_PROPERTY] = "*********"; 
try
{
    queueManager = new MQQueueManager(QueueManagerName, queueProperties);
}
catch(MQException mqexp)
{
    //I still get the error code 2035
    log.Error(mqexp)
}

此错误消失了，如果

，我可以从队列中连接/发送/获取消息

我在我的频道上手动设置MCAUSER，或
我以设置MQ服务器的域用户（使用RunAs）

但是，我无法使用这两种解决方法中的任何一种进行生产设置。我假设我收到错误代码2035，因为MQ客户端发送了错误的用户ID。我需要能够在服务器连接期间覆盖（或至少确定）流动的用户ID。我该怎么做？

编辑：我在AMQERR01.log文件中收到了以下错误

-------------------------------------------------------------------------------
7/6/2016 13:06:14 - Process(1380.10) User(MUSR_MQADMIN) Program(amqzlaa0.exe)
                      Host(TST-MQSVR) Installation(DefaultInstall)
                      VRMF(7.5.0.2) QMgr(MYNEWQMANAGER)

AMQ8075: Authorization failed because the SID for entity 'sinistrian' cannot be
obtained.

EXPLANATION:
The Object Authority Manager was unable to obtain a SID for the specified
entity. This could be because the local machine is not in the domain to locate
the entity, or because the entity does not exist.
ACTION:
Ensure that the entity is valid, and that all necessary domain controllers are
available. This might mean creating the entity on the local machine. 
----- amqzfubn.c : 2273 -------------------------------------------------------
7/6/2016 13:06:14 - Process(1380.10) User(MUSR_MQADMIN) Program(amqzlaa0.exe)
                      Host(TST-MQSVR) Installation(DefaultInstall)
                      VRMF(7.5.0.2) QMgr(MYNEWQMANAGER)

AMQ8073: Authorization failed because SID: ((None)) could not be resolved.

EXPLANATION:
The Object Authority Manager was unable to resolve the specified SID into
entity and domain information.
ACTION:
Ensure that the application provides a SID that is recognized on this system,
that all necessary domain controllers are available, and that the security
policy is set as you required. 
----- amqzfubn.c : 4397 -------------------------------------------------------
7/6/2016 13:06:14 - Process(3008.3) User(MUSR_MQADMIN) Program(amqrmppa.exe)
                      Host(TST-MQSVR) Installation(DefaultInstall)
                      VRMF(7.5.0.2) QMgr(MYNEWQMANAGER)

AMQ9557: Queue Manager User ID initialization failed.

EXPLANATION:
The call to initialize the User ID failed with CompCode 2 and Reason 2035.
ACTION:
Correct the error and try again. 
----- cmqxrsrv.c : 1975 -------------------------------------------------------
7/6/2016 13:06:14 - Process(3008.3) User(MUSR_MQADMIN) Program(amqrmppa.exe)
                      Host(TST-MQSVR) Installation(DefaultInstall)
                      VRMF(7.5.0.2) QMgr(MYNEWQMANAGER)

AMQ9999: Channel 'TEST.CHANNEL' to host 'WKS-L450 (192.168.10.23)' ended
abnormally.

EXPLANATION:
The channel program running under process ID 3008(2192) for channel
'TEST.CHANNEL' ended abnormally. The host name is 'WKS-L450 (192.168.10.23)';
in some cases the host name cannot be determined and so is shown as '????'.
ACTION:
Look at previous error messages for the channel program in the error logs to
determine the cause of the failure. Note that this message can be excluded
completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
found in the System Administration Guide.

Answer 1

在7.5版之前，MQ客户端始终将登录的UserId而不是应用程序指定的UserId流向队列管理器以进行授权。您将需要此方案的安全出口。

这在MQ v8中发生了变化，其中应用程序指定的UserId流向队列管理器以进行授权检查。更多详情：https://www.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.sec.doc/q113260_.htm

Answer 2

您可以使用MQS_REPORT_NOAUTH或MQSAUTHERRORS设置获取有关权限失败的更多信息。

覆盖C＃Windows应用程序中Websphere MQ Client发送的用户标识

2 个答案: