IBM Support

PM80558: CIN NEEDS TO USE OTHER QUEUE OPTIONS TO OPEN QUEUES TO AVOID ALTER RIGHTS FOR NON-INPUT QUEUES

A fix is available

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • After installation of UK90261, some functionality doesn't work
    properly any more, when MQ security is enabled for the WBI-FN
    queues.
    This functionality is:
    MSIF
    RMA
    RM Import and ASP import
    Message Management printing
    
    Due to support of MQ 7.1 with WBI-FN PTF UK90261,
    input queues used by the CIN now need ALTER access rights
    instead of UPDATE. Moreover, due to a wrong open at MQOPEN, all
    queues used by the CIN currently require ALTER authorisation.
    
    Following needs to be changed:
    
    The authorisation definitions to change to ALTER authorisation
    for:
    DNIvQPFX.DNF_L_IMP (RMA- and ASP import input queue)
    DNIvQPFX.DNF_L_TR  (RMA Transfer input queue)
    DNIvQPFX.DNF_O_FT (MSIF input queue)
    DNIvQPFX.DNF_O_FTTMH (MSIF input queue)
    DNIvQPFX.DNF_O_FTTML (MSIF input queue)
    DNIvQPFX.DNF_O_FTUMH (MSIF input queue)
    DNIvQPFX.DNQ_P_PRT (Message Management Printing input queue).
    
    The above changes will require related PTFs for MSIF and MM.
    
    The CIN needs to change the MQOpen options for following queues,
    in order to achieve, that UPDATE authorisation for the following
    queues are again sufficient:
    
    DNIvINST.SYSOU.DNI_R_EVENT
    DNIvINST.DNFSYSOU.DNF_BACKOUT
    DNIvQPFX.DNI_SYSOP
    DNIvQPFX.DNF_L_IMP.CTRL
    DNIvQPFX.DNF_L_TRCMD
    DNIvQPFX.DNF_L_TRERR
    DNIvQPFX.DNF_O_FTRST
    DNIvQPFX.DNF_O_FTERR
    DNIvQPFX.DNQ_P_RST
    

Local fix

  • Change the access authorisations of all queues, which are
    mentioned in the APAR description to allow ALTER access rights.
    Customers using FIN only need to change:
    DNIvINST.SYSOU.DNI_R_EVENT
    DNIvINST.DNFSYSOU.DNF_BACKOUT
    DNIvQPFX.DNF_L_IMP.CTRL
    DNIvQPFX.DNF_L_IMP
    
    For use of DNI_SYSOP service:
    DNIvQPFX.DN_SYSOP
    
    Customers, using MSIF in addtion, need to change additionally:
    DNIvQPFX.DNF_O_FTRST
    DNIvQPFX.DNF_O_FTERR
    DNIvQPFX.DNF_O_FT
    DNIvQPFX.DNF_O_FTTMH
    DNIvQPFX.DNF_O_FTTML
    DNIvQPFX.DNF_O_FTUMH
    
    When the WBI-FN RM application is used, following queues need to
    be changed in addition:
    DNIvQPFX.DNF_L_TRCMD
    DNIvQPFX.DNF_L_TRERR
    DNIvQPFX.DNF_L_TR
    
    When MM pringing is used, these 2 queues require to be changed
    in addition:
    DNIvQPFX.DNQ_P_RST
    DNIvQPFX.DNQ_P_PRT
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED: All users                                    *
    ****************************************************************
    * PROBLEM DESCRIPTION: CIN NEEDS TO USE OTHER QUEUE OPTIONS    *
    *                      TO OPEN QUEUES TO AVOID ALTER RIGHTS    *
    *                      FOR NON-INPUT QUEUES                    *
    ****************************************************************
    * RECOMMENDATION:                                              *
    ****************************************************************
    Formerly, due to incorrect MQOpen options that were introduced
    with PTF UK90261, if PTF UK90261 was installed and if
    MQ security was enabled for the WebSphere BI for FN queues,
    the user ID of the message broker started task (UBRK1)
    required ALTER authorization for all of the queues used by the
    CIN.
    

Problem conclusion

  • Now, the CIN uses the correct MQOpen options and UBRK1
    requires ALTER authorization only for the following queues:
    - DNIvQPFX.DNF_L_IMP
    - DNIvQPFX.DNF_L_TR
    - DNIvQPFX.DNF_O_FT
    - DNIvQPFX.DNF_O_FTTMH
    - DNIvQPFX.DNF_O_FTTML
    - DNIvQPFX.DNF_O_FTUMH
    - DNIvQPFX.DNQ_P_PRT
    The WebSphere MQ security definitions have been corrected
    with PM80558 to grant ALTER authorization for DNFL_IMP and
    DNF_L_TR queues to group DNIvSGRP.
    If you also use one or more of the following extending
    features, you have to apply their corresponding PTFs:
    - for "MSIF" apply PTF for APAR PM83422
    - for "MM" apply PTF for APAR PM83420
    to grant ALTER authorization for the queues of that extending
    feature to group DNIvSGRP.
    

Temporary fix

Comments

APAR Information

  • APAR number

    PM80558

  • Reported component name

    WBI FOR FN ZOS

  • Reported component ID

    5655FIN00

  • Reported release

    11B

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2013-01-14

  • Closed date

    2013-02-25

  • Last modified date

    2013-03-04

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

    PM80603 UK91963

Modules/Macros

  • DNI00024 DNI00026 DNI00039 DNI00158 DNI00161
    DNI00186 DNI00188 DNI00195 DNI00198 DNI00215 DNI00401 DNI00412
    DNI00413 DNI00433 DNI00434 DNI00445 DNI00446 DNI00626 DNI00629
    DNI00630 DNI00739 DNI00740
    

Publications Referenced
SH12693713SH12693613   

Fix information

  • Fixed component name

    WBI FOR FN ZOS

  • Fixed component ID

    5655FIN00

Applicable component levels

  • R11B PSY UK91963

       UP13/02/28 P F302

Fix is available

  • Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"SG19M","label":"APARs - z\/OS environment"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"11B","Edition":"","Line of Business":{"code":"","label":""}}]

Document Information

Modified date:
04 March 2013