JMS Modular Input and IBM MQ - What is minimum permission to be granted?

[rahul927]

Unless the splunk user is added to mqm group the TA does not seem work. 2035 unauthorised error appears in the log.
But we are not allowed to add splunk user to mqm group. What are the minimum permissions on MQ that needs to be granted to this user, pl mention. (Like QMgr Connect, Inquire, ) Also we are using MQ Topic to subscribe to not Queue.
Thank you

[rahul927 · Accepted solution]

Solved- The parent topic had to be given access as well.
SYSTEM.BASE.TOPIC

dspmqaut -m QMG01 -n SYSTEM.BASE.TOPIC -t topic -p "splunk"
Entity splunk has the following authorizations for object SYSTEM.BASE.TOPIC:
pub
sub
resume

[aaraneta_splunk]

Hi @rahul927 - Glad to hear that you've found the answer to your own question. Please don't forget to resolve the post by clicking "Accept" below your answer. Thanks!

[rahul927]

spunk user is granted +all on the Qmgr, Topic and Topic string. Still we get a 2035. Are there any explicit permissions that need to be granted on the JMS objects (TCF, Topic) too?

[rahul927]

on the topic connection factory - tcf(TCF_QTIIB01)
transport is set to BIND.
Qmgr is on the same machine as JMS TA.
at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)
09-20-2016 09:35:18.319 +0200 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/jms_ta/bin/jms.py" Caused by: com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2035' ('MQRC_NOT_AUTHORIZED').
09-20-2016 09:35:18.319 +0200 ERROR ExecProcessor - message from "python /opt/splunkforwarder/etc/apps/jms_ta/bin/jms.py" at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:209)

User splunk is created on the local machine and granted the below access:
setmqaut -m QMG01-t qmgr -p splunk +all
setmqaut -m QMG01 -n COMMONEVENT.TOPIC -t topic -p splunk +all
setmqaut -m QMG01 -n $SYS/Broker/QMG01/Monitoring/# -t topic -p splunk +all

When splunk is added to mqm group it works, 2035 is not shown. However cannot have splunk added to mqm, we are allowed to only grant minimum required permissions to just connect to QMGr and subscribe to the topic.