IBM Cloud MQ JMSWMQ2013认证失败问题求助

问题背景 #

使用IBM Cloud MQ尝试从队列获取消息，已核对队列管理器名称、队列名、用户名、密码、通道、端口及主机等配置项，未发现明显错误，但始终触发JMSWMQ2013认证失败错误，底层错误码为MQRC_NOT_AUTHORIZED(2035)。

报错堆栈 #

com.ibm.msg.client.jms.DetailedJMSSecurityException: JMSWMQ2013: 为队列管理器'xxx'提供的安全认证无效，连接模式为'Client'，主机名'xxxx(yyyy)'。
请检查提供的用户名和密码在目标队列管理器上是否正确。如需更多信息，请查看队列管理器错误日志及IBM知识中心中的"Securing IBM MQ"主题。
    at com.ibm.msg.client.wmq.common.internal.Reason.reasonToException(Reason.java:531)
    at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:215)
    at com.ibm.msg.client.wmq.internal.WMQConnection.<init>(WMQConnection.java:450)
    at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createV7ProviderConnection(WMQConnectionFactory.java:8475)
    at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createProviderConnection(WMQConnectionFactory.java:7815)
    at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl._createConnection(JmsConnectionFactoryImpl.java:322)
    at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createConnection(JmsConnectionFactoryImpl.java:242)
    at com.ibm.mq.jms.MQConnectionFactory.createCommonConnection(MQConnectionFactory.java:6026)
    at com.ibm.mq.jms.MQQueueConnectionFactory.createQueueConnection(MQQueueConnectionFactory.java:111)
    at com.ibm.mq.jms.MQQueueConnectionFactory.createConnection(MQQueueConnectionFactory.java:200)
    at com.ibm.wce.scbn.api2api.api2apijobs.service.MQMessageChecker.init(MQMessageChecker.java:37)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:90)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)
    at java.lang.reflect.Method.invoke(Method.java:508)
    at org.springframework.beans.factory.annotation.InitDestroyAnnotationBeanPostProcessor$LifecycleElement.invoke(InitDestroyAnnotationBeanPostProcessor.java:389)
    at org.springframework.beans.factory.annotation.InitDestroyAnnotationBeanPostProcessor$LifecycleMetadata.invokeInitMethods(InitDestroyAnnotationBeanPostProcessor.java:333)
    at org.springframework.beans.factory.annotation.InitDestroyAnnotationBeanPostProcessor.postProcessBeforeInitialization(InitDestroyAnnotationBeanPostProcessor.java:157)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyBeanPostProcessorsBeforeInitialization(AbstractAutowireCapableBeanFactory.java:440)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1796)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:620)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:542)
    at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:335)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:333)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:955)
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:920)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:583)
    at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:147)
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:731)
    at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:408)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:307)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1303)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1292)
    at com.ibm.wce.scbn.api2api.api2apijobs.Api2apiJobsApplication.main(Api2apiJobsApplication.java:30)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:90)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)
    at java.lang.reflect.Method.invoke(Method.java:508)
    at org.springframework.boot.devtools.restart.RestartLauncher.run(RestartLauncher.java:50)
Caused by: com.ibm.mq.MQException: JMSCMQ0001: IBM MQ调用失败，compcode为'2'('MQCC_FAILED')，reason为'2035'('MQRC_NOT_AUTHORIZED')。
    at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:203)
    ... 39 more

客户端Java代码 #

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.scheduling.annotation.Scheduled;
import org.springframework.stereotype.Component;

import com.ibm.mq.jms.MQQueueConnectionFactory;
import com.ibm.msg.client.wmq.WMQConstants;
import com.ibm.msg.client.wmq.common.CommonConstants;

import javax.annotation.PostConstruct;
import javax.jms.*;

@Component
public class MQMessageChecker {
    
    private final String queueName;
    private Connection connection;
    private Session session;

    @Autowired
    public MQMessageChecker() {
        this.queueName = "xxx";
    }

    @PostConstruct
    public void init() {
        try {
            MQQueueConnectionFactory connectionFactory = new MQQueueConnectionFactory();
            connectionFactory.setHostName("xxxx");
            connectionFactory.setPort(32607);
            connectionFactory.setQueueManager("xxxx");
            connectionFactory.setChannel("xxxx");
            connectionFactory.setStringProperty(WMQConstants.USERID, "config");
            connectionFactory.setStringProperty(WMQConstants.PASSWORD, "xxxxx");
            connectionFactory.setIntProperty(CommonConstants.WMQ_CONNECTION_MODE, CommonConstants.WMQ_CM_CLIENT);
            connection = connectionFactory.createConnection();
            session = connection.createSession(false, Session.AUTO_ACKNOWLEDGE);
            System.out.println("Connection: " + connection);
            System.out.println("Session: " + session);
        } catch (JMSException e) {
            e.printStackTrace();
        }
    }


    @Scheduled(fixedRate = 60000) // 每分钟执行一次
    public void checkMQForMessages() {
        try {
            if (connection == null || session == null) {
                System.out.println("进入空连接重建逻辑");
                init();
            }
            System.out.println("Session: " + session );
            System.out.println("queueName: " + queueName );
            Queue queue = session.createQueue(queueName);

            MessageConsumer consumer = session.createConsumer(queue, "timestamp <= " + System.currentTimeMillis());

            connection.start();
            Message message;
            while ((message = consumer.receive()) != null) {
                if (message instanceof TextMessage) {
                    TextMessage textMessage = (TextMessage) message;
                    System.out.println("线程 " + Thread.currentThread().getName() + " 处理消息 " + textMessage.getText());
                    System.out.println("收到文本消息: " + textMessage.getText());
                }
            }
            consumer.close();

        } catch (Exception e) {
            e.printStackTrace();
        }
    }

}

依赖配置（pom.xml） #

最初使用的依赖：

<dependency>
  <groupId>com.ibm.mq</groupId>
  <artifactId>mq-jms-spring-boot-starter</artifactId>
  <version>2.5.3</version>
</dependency>

也曾尝试过以下依赖，报错情况一致：

<dependency>
  <groupId>com.ibm.mq</groupId>
  <artifactId>com.ibm.mq.allclient</artifactId>
  <version>9.3.4.0</version>
</dependency>

排查与解决思路 #

1. 确认用户权限配置 #

MQ的2035错误不一定是密码错误，更多是权限不足：

• 检查队列管理器上是否给config用户配置了连接权限（CONNECT权限）
• 检查该用户是否拥有目标队列的读取权限（INQ+GET权限）
• 如果使用IBM Cloud MQ，需确认实例的访问策略是否允许该用户连接并读取队列

2. 检查认证方式配置 #

• 确认队列管理器的认证方式是否为USERID/PASSWORD，部分环境可能启用了SSL证书认证或操作系统用户认证，此时密码配置会失效
• 若使用客户端连接，需确认通道是否允许密码传递（通道的MCAUSER配置是否正确，是否开启了CHLAUTH规则限制）

3. 修正客户端代码的认证参数设置 #

当前代码使用setStringProperty设置用户名密码，更规范可靠的方式是直接在createConnection时传入：

// 替换原有的setStringProperty调用
connection = connectionFactory.createConnection("config", "xxxxx");

部分MQ客户端版本对通过属性设置的用户名密码兼容性不佳，直接传入参数更稳定。

4. 查看队列管理器错误日志 #

登录MQ管理控制台或查看队列管理器的错误日志（如AMQERR01.LOG），里面会有更详细的2035错误原因，比如是用户不存在、权限不足还是认证方式不匹配。

5. 验证连接参数的正确性 #

• 使用MQ自带的客户端工具（如MQ Explorer或runmqsc命令行）测试连接，确认用户名密码和权限是否正常
• 检查端口是否正确，IBM Cloud MQ的端口通常带有SSL，若环境要求SSL则需添加connectionFactory.setSSLCipherSuite("xxx")配置

内容的提问来源于stack exchange，提问作者vijay