PI61361: MFT migration job is failing with error BFGCL0502E.

APAR status

• Closed as program error.

Error description

• The fteMigrateAgent command is failing on z/OS with error
  BFGCL0502E.
  .
  BPXM023I (xxxxxx) BFGCL0502E: You are not authorized to
  perform the requested operation.
  
  The command did not check whether the user was a member of the
  group named in the BFG_GROUP_NAME environment variable;
  
  When trace was activated no trace files were written.
  
  Additional Symptom(s) Search Keyword(s):
  

Local fix

• The problem can be avoided by adding the user into the mqm group
  or (if practical) removing the mqm group from the system.
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  This issue affects users of IBM MQ Managed File Transfer (MFT)
  V8.0 on z/OS who are migrating from an installation of MQ
  WebSphere MQ File Transfer Edition (FTE) V7.0.4 or earlier in
  the circumstance where a group named mqm (or MQM) is defined on
  the system, and the user who is running the fteMigrateAgent
  command is not a member of the mqm group.
  
  
  Platforms affected:
  z/OS
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  There were two parts to the problem.
  
  First: Trace was not initialised until after the fteMigrateAgent
  command had checked to see if the user was an administrator,
  which meant the check was not traced.
  
  Second: When the fteMigrateAgent command checked to see if the
  user was an administrator it detected that the mqm group existed
  and because the user was not a member of the group the command
  incorrectly issued error BFGCL0502E and terminated.
  
  The problem was caused by a logic error which prevented the
  command from going on to check whether the user was a member of
  the group named in the BFG_GROUP_NAME environment variable and
  then proceeding with the migration.
  
  There is no requirement to have a mqm group for MFT on z/OS so
  this checking was unnecessarily strict.
  

Problem conclusion

• Firstly the command has been updated to ensure that the check to
  see if the user is an administrator is traced.
  
  The command has also been updated so that if the user is not a
  member of the mqm group (or if there is no mqm group) then the
  command will go on to check to whether a group has been named in
  the BFG_GROUP_NAME environment variable, and whether the user is
  a member of that group.
  
  In summary, after applying this fix the user must satisfy (at
  least) one of these conditions in order to run the migrate
  command on z/OS:
  
  - Be a member of the mqm group (if the mqm group exists);
  - Be a member of the group named in the BFG_GROUP_NAME
  environment variable (if one is named);
  - Have no value set in the BFG_GROUP_NAME environment variable.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v8.0       8.0.0.6
  v9.0 CD    9.0.1
  v9.0 LTS   9.0.0.1
  
  The latest available FTE maintenance can be obtained from
  'Fix List for WebSphere MQ File Transfer Edition 7.0'
  http://www-01.ibm.com/support/docview.wss?uid=swg27015313
  
  The latest available MQ maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WMQ MFT Z/OS

• Fixed component ID

  5655MFT00

Applicable component levels

• R800 PSY

     UP