在 C# Windows 应用程序中覆盖 Websphere MQ 客户端发送的用户 ID

Question

我正在尝试使用完整的 MQ 客户端安装从 C# 应用程序连接到 Websphere MQ 7.5 服务器（在 Windows 域上）的测试实例，但我没有成功。我一直从 MQ 服务器收到错误代码 2035 MQRC_NOT_AUTHORIZED。最初我尝试了下面的代码：

string QueueManagerName = "myNewQManager";
MQEnvironment.Hostname = "tst-mqsvr";
MQEnvironment.Channel = "test.channel";
MQEnvironment.Port = 1414;
MQEnvironment.UserId = "domainUser";
MQEnvironment.Password = "********";
//set transport properties.
MQEnvironment.properties[MQC.TRANSPORT_PROPERTY] = MQC.TRANSPORT_MQSERIES_CLIENT;
try
{
    queueManager = new MQQueueManager(QueueManagerName);
}
catch(MQException mqexp)
{
    //I get the error code 2035
    log.Error(mqexp)
}

改成这个也不行：

string QueueManagerName = "myNewQManager";
var queueProperties = new Hashtable();
queueProperties[MQC.TRANSPORT_PROPERTY] = MQC.TRANSPORT_MQSERIES_CLIENT;
queueProperties[MQC.HOST_NAME_PROPERTY] = "tst-mqsvr";
queueProperties[MQC.PORT_PROPERTY] = "1414";
queueProperties[MQC.CHANNEL_PROPERTY] = "test.channel";
queueProperties[MQC.USER_ID_PROPERTY] = "domainUser";
queueProperties[MQC.PASSWORD_PROPERTY] = "*********"; 
try
{
    queueManager = new MQQueueManager(QueueManagerName, queueProperties);
}
catch(MQException mqexp)
{
    //I still get the error code 2035
    log.Error(mqexp)
}

此错误消失，如果

，我可以从我的队列中 connect/put/get 消息

我在我的频道上手动设置了 MCAUSER，或者
我运行应用程序作为设置MQ服务器的域用户（使用RunAs）

但是，我将无法对生产设置使用这两种解决方法中的任何一种。我假设我收到错误代码 2035，因为 MQ 客户端发送了错误的用户 ID。我需要能够在服务器连接期间覆盖（或至少确定）流动的用户标识。我该怎么做？

编辑：我的 AMQERR01.log 文件中出现以下错误

-------------------------------------------------------------------------------
7/6/2016 13:06:14 - Process(1380.10) User(MUSR_MQADMIN) Program(amqzlaa0.exe)
                      Host(TST-MQSVR) Installation(DefaultInstall)
                      VRMF(7.5.0.2) QMgr(MYNEWQMANAGER)

AMQ8075: Authorization failed because the SID for entity 'sinistrian' cannot be
obtained.

EXPLANATION:
The Object Authority Manager was unable to obtain a SID for the specified
entity. This could be because the local machine is not in the domain to locate
the entity, or because the entity does not exist.
ACTION:
Ensure that the entity is valid, and that all necessary domain controllers are
available. This might mean creating the entity on the local machine. 
----- amqzfubn.c : 2273 -------------------------------------------------------
7/6/2016 13:06:14 - Process(1380.10) User(MUSR_MQADMIN) Program(amqzlaa0.exe)
                      Host(TST-MQSVR) Installation(DefaultInstall)
                      VRMF(7.5.0.2) QMgr(MYNEWQMANAGER)

AMQ8073: Authorization failed because SID: ((None)) could not be resolved.

EXPLANATION:
The Object Authority Manager was unable to resolve the specified SID into
entity and domain information.
ACTION:
Ensure that the application provides a SID that is recognized on this system,
that all necessary domain controllers are available, and that the security
policy is set as you required. 
----- amqzfubn.c : 4397 -------------------------------------------------------
7/6/2016 13:06:14 - Process(3008.3) User(MUSR_MQADMIN) Program(amqrmppa.exe)
                      Host(TST-MQSVR) Installation(DefaultInstall)
                      VRMF(7.5.0.2) QMgr(MYNEWQMANAGER)

AMQ9557: Queue Manager User ID initialization failed.

EXPLANATION:
The call to initialize the User ID failed with CompCode 2 and Reason 2035.
ACTION:
Correct the error and try again. 
----- cmqxrsrv.c : 1975 -------------------------------------------------------
7/6/2016 13:06:14 - Process(3008.3) User(MUSR_MQADMIN) Program(amqrmppa.exe)
                      Host(TST-MQSVR) Installation(DefaultInstall)
                      VRMF(7.5.0.2) QMgr(MYNEWQMANAGER)

AMQ9999: Channel 'TEST.CHANNEL' to host 'WKS-L450 (192.168.10.23)' ended
abnormally.

EXPLANATION:
The channel program running under process ID 3008(2192) for channel
'TEST.CHANNEL' ended abnormally. The host name is 'WKS-L450 (192.168.10.23)';
in some cases the host name cannot be determined and so is shown as '????'.
ACTION:
Look at previous error messages for the channel program in the error logs to
determine the cause of the failure. Note that this message can be excluded
completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
found in the System Administration Guide.

Answer 1

您可以使用 MQS_REPORT_NOAUTH or MQSAUTHERRORS 设置来获取有关权限失败的更多信息。

Answer 2

在版本 7.5 之前，MQ 客户端始终将登录的 UserId 而不是应用程序指定的 UserId 流向队列管理器以进行授权。对于这种情况，您将需要一个安全出口。

这在 MQ v8 中发生了变化，其中应用程序指定的 UserId 流向队列管理器以进行授权检查。此处有更多详细信息：https://www.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.sec.doc/q113260_.htm

在 C# Windows 应用程序中覆盖 Websphere MQ 客户端发送的用户 ID

Override the userid send by Websphere MQ Client in C# Windows application

c#

ibm-mq

windows-applications