MQ 9.1 - PAM [Ошибка аутентификации]

для аутентификации QMGR мы используем PAM (Websphere MQ 9.1 в Linux

CONNAUTH(USE.PAM)

все соответствующие пользователи находятся в локальной группе пользователей «mqm». Это отлично работает для всех, кроме одного пользователя.

Я получаю следующие ошибки для указанного пользователя, когда я пытаюсь подключиться к QMGR с помощью MQ Explorer 9:

----- cmqxrsrv.c : 2390 -------------------------------------------------------
03/27/19 14:01:03 - Process(10232.155) User(mqm) Program(amqzlaa0)
                    Host(velpke.th) Installation(Installation1)
                    VRMF(9.1.0.0) QMgr(QM.QMGRENT)
                    Time(2019-03-27T13:01:03.599Z)
                    CommentInsert1(testuser)
                    CommentInsert2(MQ Explorer 9.1.0)
                    CommentInsert3(Pipe returned 7 [Authentication failure])

AMQ5534E: User ID 'testuser' authentication failed

EXPLANATION:
The user ID and password supplied by the 'MQ Explorer 9.1.0' program could not
be authenticated. 
Additional information: 'Pipe returned 7 [Authentication failure]'.
ACTION:
Ensure that the correct user ID and password are provided by the application.
Ensure that the authentication repository is correctly configured. Look at
previous error messages for any additional information.
----- amqzfuca.c : 4504 -------------------------------------------------------
03/27/19 14:01:03 - Process(10232.155) User(mqm) Program(amqzlaa0)
                    Host(velpke.th) Installation(Installation1)
                    VRMF(9.1.0.0) QMgr(QM.QMGRENT)
                    Time(2019-03-27T13:01:03.599Z)
                    CommentInsert1(testuser)
                    CommentInsert2(USE.PAM)
                    CommentInsert3(CHCKCLNT(REQDADM))

AMQ5542I: The failed authentication check was caused by the queue manager
CONNAUTH CHCKCLNT(REQDADM) configuration.

EXPLANATION:
The user ID 'testuser' and its password were checked because the queue manager
connection authority (CONNAUTH) configuration refers to an authentication
information (AUTHINFO) object named 'USE.PAM' with CHCKCLNT(REQDADM). 

This message accompanies a previous error to clarify the reason for the user ID
and password check.
ACTION:
Refer to the previous error for more information. 

Ensure that a password is specified by the client application and that the
password is correct for the user ID. The authentication configuration of the
queue manager connection determines the user ID repository. For example, the
local operating system user database or an LDAP server. 

If the CHCKCLNT setting is OPTIONAL, the authentication check can be avoided by
not passing a user ID across the channel. For example, by omitting the MQCSP
structure from the client MQCONNX API call. 

To avoid the authentication check, you can amend the authentication
configuration of the queue manager connection, but you should generally not
allow unauthenticated remote access.
----- amqzfuca.c : 4527 -------------------------------------------------------
03/27/19 14:01:04 - Process(10380.163) User(mqm) Program(amqrmppa)
                    Host(velpke.th) Installation(Installation1)
                    VRMF(9.1.0.0) QMgr(QM.QMGRENT)
                    Time(2019-03-27T13:01:04.599Z)
                    ArithInsert1(2) ArithInsert2(2035)
                    CommentInsert1(mqm)
                    CommentInsert2(testuser)

AMQ9557E: Queue Manager User ID initialization failed for 'mqm'.

EXPLANATION:
The call to initialize the User ID 'mqm' failed with CompCode 2 and Reason
2035. If an MQCSP block was used, the User ID in the MQCSP block was 'testuser'.
ACTION:
Correct the error and try again.
----- cmqxrsrv.c : 2390 -------------------------------------------------------
(END)

Пользователь может подключиться по SSH к серверу (который также использует PAM). Он также попытался скопировать и вставить свой пароль и попытался изменить его.

Я также проверил с помощью "dspmqaut", который вернул правильные права.

Я не обнаружил никакой разницы между его пользователем и моим пользователем и пользователем другого коллеги (оба - мой и коллега-пользователь - работают).