Lightstream jms extender with IBM MQ

klevi

Hi everybody,

jms extender works perfectly with my example using node.js and ActiveMQ.
Great work.

But I cannot get the same example to work using IBM-MQ.

I've got following exception when loading the adapter:
4.Feb.22 10:28:29,895 <ERROR> JMS Extender exception caught while waiting for features autodiscovery:
com.lightstreamer.jms_extender.k: Connection to JMS broker timed out
at com.lightstreamer.jms_extender.d.a.b.a(b.java) ~[ls-jms-adapters.jar:na]
at com.lightstreamer.jms_extender.JmsExtenderDataAdapter.init(JmsExtenderDataAdapter.java) [ls-jms-adapters.jar:na]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_202]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_202]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_202]
at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_202]
at com.lightstreamer.init.l.invoke(l.java) [ls-bootstrap.jar:na]
at com.sun.proxy.$Proxy3.init(Unknown Source) [na:na]
at com.lightstreamer.f.b.ae.a(ae.java) [lightstreamer.jar:na]
at com.lightstreamer.f.b.x.a(x.java) [lightstreamer.jar:na]
at com.lightstreamer.f.b.g.a(g.java) [lightstreamer.jar:na]
at com.lightstreamer.f.b.e.b(e.java) [lightstreamer.jar:na]
at com.lightstreamer.b.c.ar.run(ar.java) [lightstreamer.jar:na]

I assume the error is a bit misleading as the JMS-Broker is definitely available by network and working.
But the network shows no traffic leaving the client.

Configuration I have used:
<jms_connector name="IBM">
<param name="disabled">false</param>

<install_dir>IBM-MQ</install_dir>


<param name="jndi_factory">com.sun.jndi.fscontext.RefFSContextFactory</param>
<param name="jms_url">file:/C:/JNDI-Directory</param>
<param name="conn_factory_name">CF.TEST</param>
<param name="connect_timeout_millis">5000</param>
<param name="retry_delay_millis">2000</param>

</jms_connector>

The libraries used in the IBM-MQ Install Directory:
com.ibm.mq.allclient-9.1.0.3.jar
fscontext-4.6.b01.jar
javax.jms-api-2.0.1.jar
providerutil-1.2.1.jar

Environment:
Windows 10/Server 2016
Node.js 10.16..3
Java 1.8.0_202

What am I doing wrong?
What does the exception mean?
Is there a working example available using IBM-MQ 9.1 or similar?

Any help would be appreciated.

Klevi

Dario Crivelli

Hello,

We will try to replicate the case.

In the meantime, you can look for more information.
The error message in the server log is indeed generic, but details should be available in the connector log.
The connector log configuration is in "Lightstreamer_JMS_Extender/jms_connectors/jms_connectors_log_conf.xml".
With the factory configuration you should find a "JMS_Extender.log" file in the "Lightstreamer_JMS_Extender/logs" folder.
You can also extend the configuration by setting TRACE level on the main "JMSExtenderLogger" logger.

Further information can be achieved by getting a stack dump of the whole server while it is waiting;
for instance with: jcmd <pid> Thread.print
Then, look for "Autodiscovery Thread".
You could increase the "connect_timeout_millis" property to simplify this operation.

klevi

Hi,
thank you for your quick reply.

I have extended the configuration to log on level debug.
It gave me the hint:

Caused by: com.ibm.mq.MQException: JMSCMQ0001: IBM MQ call failed with compcode '2' ('MQCC_FAILED') reason '2400' ('MQRC_UNSUPPORTED_CIPHER_SUITE').
at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:203) ~[com.ibm.mq.allclient-9.1.0.3.jar:9.1.0.3 - p910-003-190717]

I deactivated the cipher mapping by using:
-Dcom.ibm.mq.cfg.useIBMCipherMappings=false

That solved the problem and I got:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested.

So I had to provide a trust store with a valid certificate for the SSL handshake as the IBM-MQ I used is set up with certificates based security in contrast to my ActiveMQ Server.

Setting the following properties will do it.
-Djavax.net.ssl.trustStore=path/to/truststore -Djavax.net.ssl.trustStorePassword=...

So, it was definietly a java security issue, not a JMS extender issue at all.
Keep up your good work.

Dario Crivelli

Thank you for the update and the feedback.

klevi

Hi together, unfortunately it is still not possible to estasblish a certificate based connection to IBM MQ:

Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2397;AMQ9204: Connection to host 'P2012-A9090.tcb.xxx.de(1541)' rejected. [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2397;AMQ9641: Remote CipherSpec error for channel 'P1.FT.PMS.xxx' to host ''. [3=P1.FT.PMS.INPFRADMD1]],3=P2012-A9090.tcb.xxx.de(1541),5=RemoteConnection.analyseErrorSegment]

Is there any possibility to pass the correct cipher suite as connection parameter or something similar? The server side is expecting TLS_RSA_WITH_AES_256_CBC_SHA256.

Right now this cipher suite value is only mentioned in our java.security file (parameter: jdk.tls.legacyAlgorithms), but this does not seem to be enough.

Thanks and best regards,
klevi

Dario Crivelli

Sorry, but we are not familiar with these details. The connection should be entirely managed by the IBM MQ client library (with the help of the JDK).
As far as we know, TLS_RSA_WITH_AES_256_CBC_SHA256 is among the cipher suites currently enabled by Java, still in Java 17.
Can you see other Java clients that connect successfully?

BTW, your previous problem was about the certification path.
This new problem seems a step backward, because the cipher suites are negotiated before.
What evidence do you have that the issue is that the TLS_RSA_WITH_AES_256_CBC_SHA256 cipher suite is missing on the client side?