如何配置 IBM MQ v9 以使用 Microsoft AD 进行用户认证

Question

我正在尝试为 IBM MQ v9 Queue Manager 设置类似 Microsoft AD 的用户存储库，但没有成功。我阅读了文档https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.0.0/com.ibm.mq.ref.adm.doc/q085490_.htm，但所有这些图表、破折号和箭头都不清楚。我的最终目标是能够授予或撤销基于 od AD 组的授权。有人可以给我完整的命令示例如何配置队列管理器以将 AD 用于用户存储库吗？

IBM MQ 是 v9.0.0.0，在 CentOS v7 上运行。 Active Directory 位于 Windows Server 2019 机器上。

我尝试使用 MQSC 命令设置 AUTHINFO。所有命令都执行没有问题。之后我刷新了安全性并尝试使用 setmqaut 命令授予授权，但没有成功。

我尝试使用以下 MQSC 命令：

DEFINE AUTHINFO(MY.AD.CONFIGURATION) AUTHTYPE(IDPWLDAP) AUTHORMD(SEARCHGRP) FINDGRP(member) CONNAME('192.168.100.100') BASEDNG('OU=Groups,OU=MyCompany,DC=mycompany,DC=us') SHORTUSR('sAMAccountName') LDAPUSER('mybinduser') LDAPPWD('mypassword')

ALTER QMGR CONNAUTH(MY.AD.CONFIGURATION)

REFRESH SECURITY TYPE(CONNAUTH)

setmqaut -m MY.QUEUE.MANAGER -t qmgr -g myadgroup +all

执行命令后： setmqaut -m MY.QUEUE.MANAGER -t qmgr -g myadgroup +all

此错误显示在控制台：AMQ7026: A principal or group name was invalid.

以下这些行记录在队列管理器日志中：

AMQ5531: Error locating user or group in LDAP

EXPLANATION:
The LDAP authentication and authorization service has failed in the ldap_search
call while trying to find user or group 'myadgroup '. Returned count is 0.
Additional context is 'rc = 87 (Bad search filter)
[(&(objectClass=groupOfNames)(=myadgroup ))]'.
ACTION:
Specify the correct name, or fix the directory configuration. There may be
additional information in the LDAP server error logs.
----- amqzfula.c : 2489 -------------------------------------------------------

在 Active Directory 端，这些行记录在日志中：

An account failed to log on.
Subject:
    Security ID:        SYSTEM
    Account Name:       MYADSERVER$
    Account Domain:     MYDOMAINNAME
    Logon ID:       0x3E7
Logon Type:         3
Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:       mybinduser
    Account Domain:     MYDOMAINNAME
Failure Information:
    Failure Reason:     Unknown user name or bad password.
    Status:         0xC000006D
    Sub Status:     0xC000006A
Process Information:
    Caller Process ID:  0x280
    Caller Process Name:    C:\Windows\System32\lsass.exe
Network Information:
    Workstation Name:   MYADSERVER
    Source Network Address: 192.168.100.101
    Source Port:        55592
Detailed Authentication Information:
    Logon Process:      Advapi  
    Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    Transited Services: -
    Package Name (NTLM only):   -
    Key Length:     0

下面是命令DIS AUTHINFO(MY.AD.CONFIGURATION) ALL的输出

AMQ8566: Display authentication information details.
   AUTHINFO(MY.AD.CONFIGURATION)          AUTHTYPE(IDPWLDAP)
   ADOPTCTX(NO)                            DESCR( )
   CONNAME(192.168.100.100)                CHCKCLNT(REQUIRED)
   CHCKLOCL(OPTIONAL)                      CLASSGRP( )
   CLASSUSR( )                             FAILDLAY(1)
   FINDGRP(MEMBER)                         BASEDNG(OU=Groups,OU=MyCompany,DC=mycompany,DC=us)
   BASEDNU( )
   LDAPUSER(CN=mybinduser,OU=System,OU=Users,OU=MyCompany,DC=mycompany,DC=us)
   LDAPPWD( )                              SHORTUSR(sAMAccountName)
   GRPFIELD( )                             USRFIELD( )
   AUTHORMD(SEARCHGRP)                     NESTGRP(NO)
   SECCOMM(NO)                             ALTDATE(2019-07-25)
   ALTTIME(08.14.20)

下面是 LdapAuthentication.jar 工具的输出：

java -jar LdapAuthentication.jar ldap://192.168.100.100:389 CN=mybinduser,OU=System,OU=Users,OU=MyCompany,DC=mycompany,DC=us mybinduserpassword OU=MyCompany,DC=mycompany,DC=us sAMAccountName adminusername adminpassword

@WMBL3: successful bind
@WMBL3: successfull search Starting Authentication Found the user, DN is CN=adminusername,OU=MyCompany,OU=Users,OU=MyCompany,DC=mycompany,DC=us
@WMBL3 : check if the password is correct
@WMBL3: successful authentication
@WMBL3 : Commands for WebUI ldap authentication :

1. mqsisetdbparms <INodeName> -n ldap::LDAP -u "CN=mybinduser,OU=System,OU=Users,OU=MyCompany,DC=mycompany,DC=us" -p mybinduserpassword

                                 Or

 mqsisetdbparms <INodeName> -n ldap::192.168.100.100 -u "CN=mybinduser,OU=System,OU=Users,OU=MyCompany,DC=mycompany,DC=us" -p mybinduserpassword

2. mqsichangeproperties <INodeName> -b webadmin -o server -n ldapAuthenticationUri -v \"ldap://192.168.100.100:389/OU=MyCompany,DC=mycompany,DC=us?sAMAccountName\"

3. mqsiwebuseradmin <INodeName> -c -u adminusername -x -r <sysrole  for eg: local userid >

以下是我在 AUTHINFO 中应用您在 7 月 25 日建议的更改后的 qmanager 日志。

AMQ5531: Error locating user or group in LDAP

EXPLANATION:
The LDAP authentication and authorization service has failed in the ldap_search
call while trying to find user or group 'wasadmin'. Returned count is 0.
Additional context is 'rc = 1 (Operations error)
[(&(objectClass=GROUP)(SAMACCOUNTNAME=wasadmin))]'.
ACTION: Specify the correct name, or fix the directory configuration. There may be
additional information in the LDAP server error logs.

这是 myadgroup 的完整 DN： CN=myadgroup,OU=System,OU=Groups,OU=MyCompany,DC=mycompany,DC=us

这是带有完整组 DN 的 setmqaut 命令的输出：

setmqaut -m MY.QUEUE.MANAGER -t qmgr -g 'CN=myadgroup,OU=System,OU=Groups,OU=MyCompany,DC=mycompany,DC=us' +all
AMQ7047: An unexpected error was encountered by a command. Reason code is 2063.

这是执行该命令后的 qmanager 日志：

AMQ5531: Error locating user or group in LDAP

EXPLANATION: The LDAP authentication and authorization service has failed in the ldap_search call while trying to find user or group 'CN=myadgroup,OU=System,OU=Groups,OU=MyCompany,DC=mycompany,DC=us'.
Returned count is 0.
Additional context is 'rc = 1 (Operations error) [(objectClass=groupOfNames)]'. 
ACTION:
Specify the correct name, or fix the directory configuration. There may be
additional information in the LDAP server error logs.

如果我尝试使用CLASSGRP(GROUP) 的setmqaut 输出是：

AMQ7047: An unexpected error was encountered by a command. Reason code is 2063.

而qmqnager的日志是：

AMQ5531: Error locating user or group in LDAP

EXPLANATION: The LDAP authentication and authorization service has failed in the
ldap_search call while trying to find user or group
'CN=myadgroup,OU=System,OU=Groups,OU=MyCompany,DC=mycompany,DC=us'.
Returned count is 0.
Additional context is 'rc = 1 (Operations error) [(objectClass=GROUP)]'.

ACTION:
Specify the correct name, or fix the directory configuration. There may be
additional information in the LDAP server error logs.

下面是我最后配置的 authinfo 对象：

AMQ8566: Display authentication information details.   
AUTHINFO(MY.AD.CONFIGURATION)           AUTHTYPE(IDPWLDAP)   
ADOPTCTX(YES)                           DESCR( )   
CONNAME(192.168.100.100)                CHCKCLNT(OPTIONAL)   
CHCKLOCL(OPTIONAL)                      CLASSGRP(group)   
CLASSUSR(USER)                          FAILDLAY(1)
FINDGRP(member)
BASEDNG(OU=Groups,OU=MyCompany,DC=mycompany,DC=us)   
BASEDNU(OU=Users,OU=MyCompany,DC=mycompany,DC=us)   
LDAPUSER(CN=mybinduser,OU=System,OU=Users,OU=MyCompany,DC=mycompany,DC=us)
LDAPPWD( )                              SHORTUSR(sAMAccountName)   
GRPFIELD(sAMAccountName)                USRFIELD(sAMAccountName)   
AUTHORMD(SEARCHGRP)                     NESTGRP(NO)
SECCOMM(NO)                             ALTDATE(2019-08-07)
ALTTIME(08.44.40)

Answer 1

根据您的输出，我注意到您没有设置 MQ 使用的 LDAPPWD 来验证您指定的 LDAPUSER。

您提供的 windows 错误支持这一点：

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:       mybinduser
    Account Domain:     MYDOMAINNAME
Failure Information:
    Failure Reason:     Unknown user name or bad password.

在LdapAuthentication.jar 的输出中，您似乎拥有正确的可用密码：

CN=mybinduser,OU=System,OU=Users,OU=MyCompany,DC=mycompany,DC=us mybinduserpassword

您可以指定LDAPPWD，也可以将LDAPUSER 置空，看看您的AD 是否允许匿名绑定（这种情况很少见）。

我注意到您可能需要填写其他一些空白字段。我还建议您始终使用ADOPTCTX(YES)。

以下是我对您的 AUTHINFO 对象的建议更新：

ALTER AUTHINFO(MY.AD.CONFIGURATION) +
      AUTHTYPE(IDPWLDAP) +
      AUTHORMD(SEARCHGRP) +
      FINDGRP('member') +
      ADOPTCTX(YES) +
      CONNAME(192.168.100.100) +
      CHCKCLNT(REQUIRED) +
      CHCKLOCL(OPTIONAL) +
      CLASSGRP(GROUP) +
      CLASSUSR(USER) +
      FAILDLAY(1) +
      BASEDNG('OU=MyCompany,DC=mycompany,DC=us') +
      BASEDNU('OU=MyCompany,DC=mycompany,DC=us') +
      LDAPUSER('CN=mybinduser,OU=System,OU=Users,OU=MyCompany,DC=mycompany,DC=us') +
      LDAPPWD(mybinduserpassword) +
      SHORTUSR(sAMAccountName) +
      GRPFIELD(sAMAccountName) +
      USRFIELD(sAMAccountName) +
      NESTGRP(NO) +
      SECCOMM(NO)

*注意，我没有针对 AD 进行过测试，但我已经设置 IIB 来验证针对 AD 的 WebUI/REST 调用，并且还从 IBM 的 Mark Taylor 的两篇演示文稿/文章中获得灵感：

• MQ Integration with Directory Services - Presented at MQTC v2.0.1.6
• MQdev Blog: IBM MQ - Using Active Directory for authorisation in Unix queue managers