title: IBM MQ call failed with compcode '2' ('MQCC_FAILED') reason '2035' ('MQRC_NOT_AUTHORIZED')
body: <p>I'm having a hard time trying to connect to my institution's MQ v9.</p>
  
  <p>I was provided connectivity info by the MQ team:-</p>
  
  <pre><code>String hostName = '...'
  int port = ...
  String queueManager = '...'
  String channel = '...'
  String userId = 'ABC123'
  String password = '...'
  </code></pre>
  
  <p>Given the following code...</p>
  
  <pre><code>JmsConnectionFactory cf = JmsFactoryFactory.
          getInstance(WMQConstants.WMQ_PROVIDER).
          createConnectionFactory()
  
  cf.setStringProperty(WMQConstants.WMQ_HOST_NAME, hostName)
  cf.setIntProperty(WMQConstants.WMQ_PORT, port)
  cf.setStringProperty(WMQConstants.WMQ_CHANNEL, channel)
  cf.setIntProperty(WMQConstants.WMQ_CONNECTION_MODE, WMQConstants.WMQ_CM_CLIENT)
  cf.setStringProperty(WMQConstants.WMQ_QUEUE_MANAGER, queueManager)
  cf.setStringProperty(WMQConstants.USERID, userId)
  cf.setStringProperty(WMQConstants.PASSWORD, password)
  // tried with both `true` and `false`... same error
  cf.setBooleanProperty(WMQConstants.USER_AUTHENTICATION_MQCSP, true)
  
  Connection connection = cf.createConnection()
  connection.start()
  connection.close()
  </code></pre>
  
  <p>... I'm getting this error:-</p>
  
  <pre><code>Exception in thread "main" com.ibm.msg.client.jms.DetailedJMSSecurityException: 
  JMSWMQ2013: The security authentication was not valid 
  that was supplied for queue manager '...' with connection 
  mode 'Client' and host name '...'.
  Please check if the supplied username and password 
  are correct on the queue manager to which you are 
  connecting.  
  Caused by: com.ibm.mq.MQException: JMSCMQ0001: IBM 
  MQ call failed with compcode '2' ('MQCC_FAILED') reason 
  '2035' ('MQRC_NOT_AUTHORIZED').
  </code></pre>
  
  <p>I was told by the MQ team that the log has something like this:-</p>
  
  <pre><code>----- amqzfuca.c : 4527 -------------------------------------------------------
  04/17/2019 10:32:20 AM - Process(10468.40757) User(...) Program(...)
                      Host(...) Installation(Installation1)
                      VRMF(9.1.0.1) QMgr(...)
                      Time(2019-04-17T15:32:20.542Z)
                      RemoteHost(...)
                      CommentInsert1(...)
                      CommentInsert2(...)
                      CommentInsert3(CLNTUSER(XYZ) ADDRESS(...))
  
  AMQ9777E: Channel was blocked
  
  EXPLANATION:
  The inbound channel '...' was blocked from address '...' 
  because the active values of the channel matched a record
  configured with USERSRC(NOACCESS). The active values of the channel were
  'CLNTUSER(XYZ) ADDRESS(...)'.
  </code></pre>
  
  <p>... and it fails because it's using the wrong credential to connect. </p>
  
  <p>While I passed in a different credential (user ID: ABC123), the MQ log sees the user ID I used to log into my machine (user ID: XYZ).</p>
  
  <p>Why does the credential I explicitly passed in get omitted? How do I fix this?</p>
  
  <p>I'm using this dependency:</p>
  
  <pre><code>&lt;dependency&gt;
      &lt;groupId&gt;com.ibm.mq&lt;/groupId&gt;
      &lt;artifactId&gt;com.ibm.mq.allclient&lt;/artifactId&gt;
      &lt;version&gt;9.1.2.0&lt;/version&gt;
  &lt;/dependency&gt;
  </code></pre>
  
  <p>I'm not using IBM JRE... more precisely, I'm using Oracle JDK 1.8 on my Mac, if that helps.</p>
  
  <p>Thank you.</p>
  
  <p><strong>UPDATE 2019-04-22</strong></p>
  
  <p>I was able to get more accurate logs from MQ team now since I'm trying too many things at the same time.</p>
  
  <p>If I set <code>USER_AUTHENTICATION_MQCSP</code> to <code>true</code>, then my machine's user ID (XYZ) is passed in.</p>
  
  <p>If I set <code>USER_AUTHENTICATION_MQCSP</code> to <code>false</code>, then I'm getting different error message now:-</p>
  
  <pre><code>04/22/2019 01:19:49 PM - Process(1147099.9759) User(...) Program(...)
              Host(rofesb911a) Installation(Installation1)
              VRMF(9.1.0.1) QMgr(...)
              Time(2019-04-22T18:19:49.323Z)
              RemoteHost(...)
              CommentInsert1(wa03598)
              CommentInsert2(REQUIRED)
              CommentInsert3(MCAUSER(ABC123) CLNTUSER(ABC123) ADDRESS(...))
  
  AMQ9790I: The failed authentication check was caused by a CHLAUTH record with
  CHCKCLNT(REQUIRED).
  
  EXPLANATION:
  The user ID 'ABC123' and its password were checked because the inbound
  connection matched a channel authentication record with CHCKCLNT(REQUIRED).
  
  The active values of the channel were 'MCAUSER(ABC123) CLNTUSER(ABC123)
  ADDRESS(...)'. The MATCH(RUNCHECK) mode of the DISPLAY CHLAUTH
  MQSC command can be used to identify the relevant CHLAUTH record.
  </code></pre>
  
  <p>The good news is it's seeing the correct user ID (ABC123), but I was told the password is invalid. I don't believe it was a password problem because I was able to use that same credential to access other protected web services. </p>