WLS 8.1 MDBs, Websphere MQ QMs and Security Exits....

Question

          Hi:
          I am testing an MDB that is listening on a Websphere MQ 5.3 Queue. For security,
          I have secured the Server Connection Channel of the Queue Manager (to which the
          Queue belongs to) with a Security Exit.
          Using the Foreign JMS Servers section in the Admin console, I defined a 'Foreign
          JMS Connection Factory' that has the userid & password that is supposed to be
          passed to Websphere MQ.
          When the MDB comes up, it throws a SecurityException. In the background, the Security
          Exit log indicates that the MDB tried to make multiple connections to the Server
          Channel. The Deployment descriptor has the 'MAX BEANS IN FREE POOL' set to 1.
          My issues are:
          1. When the MDB comes up the Server Connection Channel shows multiple connections.
          I know there is only one MDB, so I am curious why there would be multiple connections
          to the same Channel.
          2. The Security Exit log shows that the userid and passord was passed on to MQ
          certain times and other times it was not. The net result is the Security Exit
          rejected the MDB Connections (when the userid and pwd was blanks) and the Bean
          did not come up properly.
          I am concerned with Issue 2. Because, all I am able to control is giving the userid
          and pwd in the Foreign JMS Server section. WLS 8.1 is supposed to pass on the
          credentials properly to MQ when needed. Is WLS 8.1 NOT doing what is expected
          or am I missing something?
          What is the procedure to deploy a WLS 81 MDB that is listening on a queue whose
          QM is secured by an MQ Security Exit.
          Please help!
          

Answer 1

When you deploy any EJB or servlet that uses the "resource-reference", the
          container (after a short delay) tries to make a connection to get the
          XAResource for that JMS provider. It then registers that with JTA. That way,
          JTA can perform transaction recovery on the JMS provider sooner rather than
          later. (If we waited to register the MQSeries resource with JTA until you
          used it, then if MQ had prepared transactions, they wouldn't be resolved
          until you actually tried to send a message.)
          As for the "multiple connections", I believe that the MQSeries JMS library
          uses a single MQ "connection handle" for every JMS session. (That's because
          MQ connection handles aren't thread-safe.) In our pool of the JMS Session
          objects, we open more than one session initially, so that might be why
          you're seeing multiple connections.
          You can monitor the pooling of the JMS sessions using the console. Click on
          your server in the "servers" tab in the left-hand tree view, then on
          "Monitoring", then on "JMS", and then on "Monitor Pooled JMS Connections".
          greg
          "Sridhar Krishnaswamy" <[email protected]> wrote in message
          news:[email protected]...
          >
          > I tried the steps you have mentioned. But the userid still does not come
          across
          > to MQSeries. So, I will follow up with Support. The MDB is passing on the
          credentials
          > fine when using the same QCF to put the messages to.
          >
          > On the issue of multiple connections, you are right. The connections are
          because
          > of the resource-ref entries. Though I am not sure why the MDB is actually
          trying
          > to establish multiple connections for every resource-ref entry (because
          the pooling
          > mechanism kicks in?). Also, in my design, some of the resource-ref are
          actually
          > 'stand-bys' to be used only if the MDB fails to put the message using the
          primary
          > resource-ref entry. I would have thought that the physical connections
          will actually
          > be made when the call for looking up the QCF is made by the bean or
          createQueueConnection
          > called. Just for my knowledge, I would like to know why the Container is
          establishing
          > the connections upfront.
          >
          > As always, I really appreciate your help, Greg.
          >
          > Thanks,
          > Sridhar
          >
          > "Greg Brail" <[email protected]> wrote:
          > >At the moment, the username and password used to receive messages come
          > >from
          > >a differenct place, and not from the "Foreign JMS Connection Factory"
          > >screen. (Yes, I realize that this is confusing.) To do what you want,
          > >you
          > >need to define a "credential mapping":
          > >
          > >-- Create a WebLogic Server user using the "security" section of the
          > >console, and assign the password that you will need to connect to MQ.
          > >
          > >-- Right-click on your MDB in the left-hand tree view, and select "Define
          > >Roles and Policies for Individual Beans"
          > >
          > >-- You should see a list of MDBs on the screen. Click on "define
          credential
          > >mapping". (I forget the exact wording, but it's something like that.)
          > >
          > >-- On this screen, you enter the MQSeries username that you'll need to
          > >set,
          > >and the WebLogic user that you created in the first step. It then uses
          > >the
          > >password from this WebLogic username.
          > >
          > >If you have trouble with this, please call support. I know that some
          > >people
          > >have had trouble with this particular feature.
          > >
          > >I'm not sure about the multiple connections. Is it possible that you
          > >have a
          > >"resource-reference" declared for MQ somewhere?
          > >
          > > greg
          > >
          > >"Sridhar Krishnaswamy" <[email protected]> wrote in message
          > >news:[email protected]...
          > >>
          > >> Hi:
          > >> I am testing an MDB that is listening on a Websphere MQ 5.3 Queue.
          > >For
          > >security,
          > >> I have secured the Server Connection Channel of the Queue Manager (to
          > >which the
          > >> Queue belongs to) with a Security Exit.
          > >>
          > >> Using the Foreign JMS Servers section in the Admin console, I defined
          > >a
          > >'Foreign
          > >> JMS Connection Factory' that has the userid & password that is supposed
          > >to
          > >be
          > >> passed to Websphere MQ.
          > >>
          > >> When the MDB comes up, it throws a SecurityException. In the
          background,
          > >the Security
          > >> Exit log indicates that the MDB tried to make multiple connections
          > >to the
          > >Server
          > >> Channel. The Deployment descriptor has the 'MAX BEANS IN FREE POOL'
          > >set to
          > >1.
          > >> My issues are:
          > >>
          > >> 1. When the MDB comes up the Server Connection Channel shows multiple
          > >connections.
          > >> I know there is only one MDB, so I am curious why there would be
          multiple
          > >connections
          > >> to the same Channel.
          > >> 2. The Security Exit log shows that the userid and passord was passed
          > >on
          > >to MQ
          > >> certain times and other times it was not. The net result is the
          Security
          > >Exit
          > >> rejected the MDB Connections (when the userid and pwd was blanks) and
          > >the
          > >Bean
          > >> did not come up properly.
          > >>
          > >> I am concerned with Issue 2. Because, all I am able to control is
          giving
          > >the userid
          > >> and pwd in the Foreign JMS Server section. WLS 8.1 is supposed to pass
          > >on
          > >the
          > >> credentials properly to MQ when needed. Is WLS 8.1 NOT doing what is
          > >expected
          > >> or am I missing something?
          > >>
          > >> What is the procedure to deploy a WLS 81 MDB that is listening on a
          > >queue
          > >whose
          > >> QM is secured by an MQ Security Exit.
          > >>
          > >> Please help!
          > >
          > >
          >