Unable to connect to Websphere MQ using JNDI

Question

Hi StackOverflow community,

I am currently using Spring to connect to a queue. I would want to be able to configure which provider I can connect with in our Test VS our UAT environments. In UAT, we use IBM WMQ 7; in Test, we are using ActiveMQ.

We are also using an SSL connection in both cases.

Currently, we have the following configuration which works for connecting to WMQ 7:

<bean id="jmsFactory" name="jmsFactory" class="com.ibm.mq.jms.MQConnectionFactory">
    <property name="queueManager" value="${UM_MQ_QM}" />
    <property name="hostName" value="${UM_MQ_HOST}" />
    <property name="channel" value="${UM_MQ_CHANNEL}" />
    <property name="port" value="${UM_MQ_PORT}" />
    <property name="transportType" value="1" />
    <property name="SSLCipherSuite" value="${SSL_CIPHER_SUITE}" />
</bean>

Using JNDI, I am able to connect to ActiveMQ. But when switching the provider class, it gives me the following exception.

Spring JNDI Config:

<bean id="jmsFactory" class="org.springframework.jndi.JndiObjectFactoryBean">
  <property name="jndiName" value="QueueConnectionFactory" />
  <property name="jndiTemplate" ref="jndiTemplate" /> 
</bean>

<bean id="jndiTemplate" class="org.springframework.jndi.JndiTemplate">
  <property name="environment">
    <props>
      <prop key="java.naming.factory.initial">com.ibm.mq.jms.context.WMQInitialContextFactory</prop>
      <prop key="java.naming.provider.url">${UM_MQ_HOST}:${UM_MQ_PORT}/${UM_MQ_CHANNEL}</prop>
    </props>
  </property>
</bean>

Exception:

Caused by: javax.naming.NamingException: Caught an Exception trying to create the admin queue. Exception was: com.ibm.mq.pcf.PCFException: MQJE001: Completion Code '2', Reason '2035'. [Root exception is com.ibm.mq.pcf.PCFException: MQJE001: Completion Code '2', Reason '2035'.]
   at com.ibm.mq.jms.context.MQContext.<init>(MQContext.java:294)
   at com.ibm.mq.jms.context.WMQInitialContextFactory.getInitialContext(WMQInitialContextFactory.java:29)
   at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
   at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
   at javax.naming.InitialContext.init(InitialContext.java:223)
   at javax.naming.InitialContext.<init>(InitialContext.java:197)
   at org.springframework.jndi.JndiTemplate.createInitialContext(JndiTemplate.java:136)
   at org.springframework.jndi.JndiTemplate.getContext(JndiTemplate.java:103)
   at org.springframework.jndi.JndiTemplate.execute(JndiTemplate.java:85)
   at org.springframework.jndi.JndiTemplate.lookup(JndiTemplate.java:152)
   at org.springframework.jndi.JndiTemplate.lookup(JndiTemplate.java:178)
   at org.springframework.jndi.JndiLocatorSupport.lookup(JndiLocatorSupport.java:95)
   at org.springframework.jndi.JndiObjectLocator.lookup(JndiObjectLocator.java:105)
   at org.springframework.jndi.JndiObjectFactoryBean.lookupWithFallback(JndiObjectFactoryBean.java:201)
   at org.springframework.jndi.JndiObjectFactoryBean.afterPropertiesSet(JndiObjectFactoryBean.java:187)
   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1545)
   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1483)
   ... 109 more
Caused by: com.ibm.mq.pcf.PCFException: MQJE001: Completion Code '2', Reason '2035'.
   at com.ibm.mq.pcf.PCFMessageAgent.send(PCFMessageAgent.java:241)
   at com.ibm.mq.jms.context.MQContext.<init>(MQContext.java:273)
   ... 125 more

I suspect this is due to either 2 things:

1. We don't have explicit permissions set on the JMS Admin queue stated above
2. The Cipher setting is not working in the Spring config

Can anyone provide some guidance? If you have faced this issue before, what was the solution?

I am sure the answer is staring at me right in the face, just have some fog in my eyes :)

Thanks,

Jose

Answer 1

I would advise that you look into using a LDAP backed JNDI context here for full scale deployment. The File System Context is from Oracle and as AFAIK also not supported for production environments.

Move to use a simple file system context; does normal connectivity to the QM work for messaging? Is it just the WMQ Admin queue that is protected or normal connectivity to MQ?

Answer 2

You do not want to use WMQInitialContextFactory. Use File based JNDI or a real JNDI registry.

WMQInitialContextFactory is from SupportPac ME01 written by an IBM employee as a simple tool for development only - never, ever for production. SupportPac ME01 is NOT recommended for use beyond simple development. Most IBM MQ people say to never use it. Also, WMQInitialContextFactory is NOT supported by IBM.

Who ever told you to use WMQInitialContextFactory needs to refresh themselves on IBM MQ best practices.

Answer 3

You're getting an MQ reason code of 2035, which means: Problem(Abstract)

You are getting MQRC 2035, Not Authorized in your WebSphere MQ application or channel. You need to understand what causes this failure.

2035 0x000007f3 MQRC_NOT_AUTHORIZED

Cause MQRC 2035 (MQRC_NOT_AUTHORIZED) is returned when a user is not authorized to perform the function that is attempted.

Resolving the problem MQRC 2035 (MQRC_NOT_AUTHORIZED) is returned when a user is not authorized to perform the function. Determine which object the user cannot access and provide the user access to the object.

Debugging techniques: Use the dspmqaut (display authority command), to determine if the user has the authorization to access the intended object.

But, listen to the other guys regarding JNDI, they know what they're talking about.