IBM Support

PM99650: Z/OS CREATEBROKER/MIGRATECOMPONENTS DOES NOT CREATE A REQUIRED MQ TOPIC DEFINITION FOR AUTHORIZATION

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • When a broker is first created, a set of MQ definitions are
    created for queues and other resources needed for the broker to
    work. These definitions are also updated when a broker is
    migrated using the migratecomponents comment. One of those
    definitions is an MQ TOPIC called SYSTEM.BROKER.MB.TOPIC, which
    maps to topic string $SYS/Broker. This is only required for
    operation when MQ security is enabled, and is required to use
    the record/replay and statistics components. On z/OS, the
    createbroker and migratecomponents command did not create this
    topic definition, and the documentation did not mention that you
    must authorise the broker's started-task ID to be able to
    publish and subscribe on that topic. Failure to authorise the
    broker on this topic will result in MQ security errors, and the
    resource statistics and record/replay functions will not work.
    

Local fix

  • It is possible to manually create the TOPIC definition on the
    broker's queue manager, either using CSQUTIL or using the MQ
    Explorer.
    The TOPIC should have:
     - topic name of SYSTEM.BROKER.MB.TOPIC
     - topic string of $SYS/Broker
    Once that TOPIC has been defined, you must authorise the
    broker's started-task ID to publish and subscribe on those
    topics. Use the following RACF commands to create profiles and
    authorize them:
    create a RACF profile to control publishing and subscribing for
    that topic:
    RDEFINE MXTOPIC .PUBLISH.SYSTEM.BROKER.MB.TOPIC
    UACC(NONE)
    RDEFINE MXTOPIC .SUBSCRIBE.SYSTEM.BROKER.MB.TOPIC
    UACC(NONE)
    Grant the broker's started task ID the ability to publish on
    that topic:
    PERMIT .PUBLISH.SYSTEM.BROKER.MB.TOPIC CLASS(MXTOPIC)
    ID(TASKID) ACCESS(UPDATE)
    Allow the broker to subscribe to its own topics:
    PERMIT .SUBSCRIBE.SYSTEM.BROKER.MB.TOPIC
    CLASS(MXTOPIC) ID(TASKID) ACCESS(ALTER)
    Optionally, allow additional users to subscribe to those topics
    (required for web users or for external consumers of events)
    using the PERMIT command as above for the additional user IDs.
    

Problem summary

  • ****************************************************************
    USERS AFFECTED:
    All users of WebSphere Message Broker V8.0 and IBM Integration
    Bus V9.0 on z/OS.
    
    
    Platforms affected:
    z/OS
    
    ****************************************************************
    PROBLEM SUMMARY:
    During installation, the product creates a number of MQ
    resources, but on z/OS platforms, the SYSTEM.BROKER.MB.TOPIC
    topic object is not created. This object defines a topic of
    $SYS/Broker and can be used in combination with WebSphere MQ
    topic security to control access to the pub-sub hierarchy.
    

Problem conclusion

  • The product now creates the required pub/sub topic definition on
    z/OS.
    
    The product security documentation will be updated to list the
    manual RACF security configuration steps required after the
    TOPIC is created.
    
    ---------------------------------------------------------------
    The fix is targeted for delivery in the following PTFs:
    
    Version    Maintenance Level
    v8.0       8.0.0.4
    v9.0       9.0.0.1
    
    The latest available maintenance can be obtained from:
    http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
    
    If the maintenance level is not yet available, information on
    its planned availability can be found on:
    http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
    ---------------------------------------------------------------
    

Temporary fix

Comments

APAR Information

  • APAR number

    PM99650

  • Reported component name

    WEB MB Z/OS

  • Reported component ID

    5697P4400

  • Reported release

    800

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2013-10-22

  • Closed date

    2014-02-05

  • Last modified date

    2014-06-05

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    WEB MB Z/OS

  • Fixed component ID

    5697P4400

Applicable component levels

  • R800 PSY

       UP

[{"Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"SG19M","label":"APARs - z\/OS environment"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.0","Edition":"","Line of Business":{"code":"","label":""}}]

Document Information

Modified date:
05 June 2014