在 C# Windows 应用程序中覆盖 Websphere MQ 客户端发送的用户 ID

Question

我正在尝试使用完整的 MQ 客户端安装从 C# 应用程序连接到 Websphere MQ 7.5 服务器（在 Windows 域上）的测试实例，但我没有运气。我不断从 MQ 服务器收到错误代码 2035 MQRC_NOT_AUTHORIZED。最初我尝试了以下代码：

string QueueManagerName = "myNewQManager";
MQEnvironment.Hostname = "tst-mqsvr";
MQEnvironment.Channel = "test.channel";
MQEnvironment.Port = 1414;
MQEnvironment.UserId = "domainUser";
MQEnvironment.Password = "********";
//set transport properties.
MQEnvironment.properties[MQC.TRANSPORT_PROPERTY] = MQC.TRANSPORT_MQSERIES_CLIENT;
try
{
    queueManager = new MQQueueManager(QueueManagerName);
}
catch(MQException mqexp)
{
    //I get the error code 2035
    log.Error(mqexp)
}

改成这个也不行：

string QueueManagerName = "myNewQManager";
var queueProperties = new Hashtable();
queueProperties[MQC.TRANSPORT_PROPERTY] = MQC.TRANSPORT_MQSERIES_CLIENT;
queueProperties[MQC.HOST_NAME_PROPERTY] = "tst-mqsvr";
queueProperties[MQC.PORT_PROPERTY] = "1414";
queueProperties[MQC.CHANNEL_PROPERTY] = "test.channel";
queueProperties[MQC.USER_ID_PROPERTY] = "domainUser";
queueProperties[MQC.PASSWORD_PROPERTY] = "*********"; 
try
{
    queueManager = new MQQueueManager(QueueManagerName, queueProperties);
}
catch(MQException mqexp)
{
    //I still get the error code 2035
    log.Error(mqexp)
}

这个错误消失了，我可以从我的队列中连接/放置/获取消息

• 我在我的频道上手动设置了 MCAUSER，或者
• 我以设置 MQ 服务器的域用户身份运行应用程序（使用 RunAs）

但是，我将无法将这两种解决方法中的任何一种用于生产设置。我假设我收到错误代码 2035，因为 MQ 客户端发送了错误的用户 ID。我需要能够在服务器连接期间覆盖（或至少确定）流动的用户 ID。我该怎么办？

编辑：我的 AMQERR01.log 文件中出现以下错误

-------------------------------------------------------------------------------
7/6/2016 13:06:14 - Process(1380.10) User(MUSR_MQADMIN) Program(amqzlaa0.exe)
                      Host(TST-MQSVR) Installation(DefaultInstall)
                      VRMF(7.5.0.2) QMgr(MYNEWQMANAGER)

AMQ8075: Authorization failed because the SID for entity 'sinistrian' cannot be
obtained.

EXPLANATION:
The Object Authority Manager was unable to obtain a SID for the specified
entity. This could be because the local machine is not in the domain to locate
the entity, or because the entity does not exist.
ACTION:
Ensure that the entity is valid, and that all necessary domain controllers are
available. This might mean creating the entity on the local machine. 
----- amqzfubn.c : 2273 -------------------------------------------------------
7/6/2016 13:06:14 - Process(1380.10) User(MUSR_MQADMIN) Program(amqzlaa0.exe)
                      Host(TST-MQSVR) Installation(DefaultInstall)
                      VRMF(7.5.0.2) QMgr(MYNEWQMANAGER)

AMQ8073: Authorization failed because SID: ((None)) could not be resolved.

EXPLANATION:
The Object Authority Manager was unable to resolve the specified SID into
entity and domain information.
ACTION:
Ensure that the application provides a SID that is recognized on this system,
that all necessary domain controllers are available, and that the security
policy is set as you required. 
----- amqzfubn.c : 4397 -------------------------------------------------------
7/6/2016 13:06:14 - Process(3008.3) User(MUSR_MQADMIN) Program(amqrmppa.exe)
                      Host(TST-MQSVR) Installation(DefaultInstall)
                      VRMF(7.5.0.2) QMgr(MYNEWQMANAGER)

AMQ9557: Queue Manager User ID initialization failed.

EXPLANATION:
The call to initialize the User ID failed with CompCode 2 and Reason 2035.
ACTION:
Correct the error and try again. 
----- cmqxrsrv.c : 1975 -------------------------------------------------------
7/6/2016 13:06:14 - Process(3008.3) User(MUSR_MQADMIN) Program(amqrmppa.exe)
                      Host(TST-MQSVR) Installation(DefaultInstall)
                      VRMF(7.5.0.2) QMgr(MYNEWQMANAGER)

AMQ9999: Channel 'TEST.CHANNEL' to host 'WKS-L450 (192.168.10.23)' ended
abnormally.

EXPLANATION:
The channel program running under process ID 3008(2192) for channel
'TEST.CHANNEL' ended abnormally. The host name is 'WKS-L450 (192.168.10.23)';
in some cases the host name cannot be determined and so is shown as '????'.
ACTION:
Look at previous error messages for the channel program in the error logs to
determine the cause of the failure. Note that this message can be excluded
completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
found in the System Administration Guide.

Answer 1

直到版本 7.5，MQ 客户端始终将登录的 UserId 而不是应用程序指定的 UserId 流向队列管理器进行授权。在这种情况下，您需要一个安全出口。

这在 MQ v8 中发生了变化，其中应用程序指定的 UserId 流向队列管理器以进行授权检查。更多细节在这里：https://www.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.sec.doc/q113260_.htm

Answer 2

您可以使用MQS_REPORT_NOAUTH 或MQSAUTHERRORS 设置来获取更多关于授权失败的信息。