SSL Java Client for WebSphere MQ

Question

I try to develop a test client (Java web application) for WebSphere MQ via Spring.

I've enabled the SSL security mechanism for the channel, queue manager and connection factory, using the NULL_MD5 cipher spec.

This is my Spring configuration file:

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/context
 http://www.springframework.org/schema/context/spring-context-2.5.xsd
 http://www.springframework.org/schema/beans
 http://www.springframework.org/schema/beans/spring-beans-3.0.xsd">

    <context:annotation-config/>

    <context:property-placeholder location="classpath:jms.properties"/>

    <bean id="jmsFactory" class="com.ibm.mq.jms.MQQueueConnectionFactory">
        <property name="hostName" value="${queue_hostname}"/>
        <property name="queueManager" value="${queue_manager}"/>
        <property name="channel" value="${queue_channel}"/>
        <property name="port" value="${queue_port}"/>
        <property name="transportType" value="1"/>
        <property name="SSLCipherSuite" value="SSL_RSA_WITH_NULL_MD5"/>
    </bean>

    <bean id="sendDestination" class="com.ibm.mq.jms.MQQueue">
        <property name="baseQueueName">
            <value>queue.inbound</value>
        </property>
    </bean>

    <bean id="jmsTemplate" class="org.springframework.jms.core.JmsTemplate">
        <property name="connectionFactory">
            <bean class="org.springframework.jms.connection.SingleConnectionFactory">
                <property name="targetConnectionFactory">
                    <ref local="jmsFactory" />
                </property>
            </bean>
        </property>
        <property name="defaultDestination">
            <ref bean="sendDestination" />
        </property>
    </bean>


    <bean id="messageListener" class="com.test.MessageListener" />

    <bean id="jmsContainer" class="org.springframework.jms.listener.DefaultMessageListenerContainer">
        <property name="connectionFactory">
            <bean class="org.springframework.jms.connection.SingleConnectionFactory">
                <property name="targetConnectionFactory">
                    <ref local="jmsFactory" />
                </property>
            </bean>
        </property>
        <property name="destination" ref="sendDestination" />
        <property name="messageListener" ref="messageListener" />
    </bean>

</beans>

The problem is when I try to connect to the WebSphere MQ an exception raises:

Caused by: org.springframework.context.ApplicationContextException: Failed to start bean 'jmsContainer'; nested exception is java.lang.AssertionError
    at org.springframework.context.support.DefaultLifecycleProcessor.doStart(DefaultLifecycleProcessor.java:170)
    at org.springframework.context.support.DefaultLifecycleProcessor.access$1(DefaultLifecycleProcessor.java:154)
    at org.springframework.context.support.DefaultLifecycleProcessor$LifecycleGroup.start(DefaultLifecycleProcessor.java:339)
    at org.springframework.context.support.DefaultLifecycleProcessor.startBeans(DefaultLifecycleProcessor.java:143)
    at org.springframework.context.support.DefaultLifecycleProcessor.onRefresh(DefaultLifecycleProcessor.java:108)
    at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:926)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:467)
    at org.springframework.test.context.support.AbstractGenericContextLoader.loadContext(AbstractGenericContextLoader.java:103)
    at org.springframework.test.context.support.AbstractGenericContextLoader.loadContext(AbstractGenericContextLoader.java:1)
    at org.springframework.test.context.support.DelegatingSmartContextLoader.loadContext(DelegatingSmartContextLoader.java:228)
    at org.springframework.test.context.TestContext.loadApplicationContext(TestContext.java:124)
    at org.springframework.test.context.TestContext.getApplicationContext(TestContext.java:148)
    ... 27 more
Caused by: java.lang.AssertionError
    at com.ibm.mq.jmqi.internal.CipherSpec.<init>(CipherSpec.java:53)
    at com.ibm.mq.jmqi.JmqiUtils.toCipherSuite(JmqiUtils.java:325)
    at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.parseCipherSpec(RemoteTCPConnection.java:1984)
    at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.makeSocketSecure(RemoteTCPConnection.java:1838)
    at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.connnectUsingLocalAddress(RemoteTCPConnection.java:810)
    at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.protocolConnect(RemoteTCPConnection.java:1130)
    at com.ibm.mq.jmqi.remote.impl.RemoteConnection.connect(RemoteConnection.java:710)
    at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSessionFromNewConnection(RemoteConnectionSpecification.java:400)
    at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSession(RemoteConnectionSpecification.java:299)
    at com.ibm.mq.jmqi.remote.impl.RemoteConnectionPool.getSession(RemoteConnectionPool.java:164)
    at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1595)
    at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1223)
    at com.ibm.mq.ese.jmqi.InterceptedJmqiImpl.jmqiConnect(InterceptedJmqiImpl.java:311)
    at com.ibm.mq.ese.jmqi.ESEJMQI.jmqiConnect(ESEJMQI.java:337)
    at com.ibm.msg.client.wmq.internal.WMQConnection.<init>(WMQConnection.java:346)
    at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createV7ProviderConnection(WMQConnectionFactory.java:6876)
    at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createProviderConnection(WMQConnectionFactory.java:6254)
    at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createConnection(JmsConnectionFactoryImpl.java:285)
    at com.ibm.mq.jms.MQConnectionFactory.createCommonConnection(MQConnectionFactory.java:6189)
    at com.ibm.mq.jms.MQQueueConnectionFactory.createQueueConnection(MQQueueConnectionFactory.java:120)
    at com.ibm.mq.jms.MQQueueConnectionFactory.createConnection(MQQueueConnectionFactory.java:203)
    at org.springframework.jms.connection.SingleConnectionFactory.doCreateConnection(SingleConnectionFactory.java:342)
    at org.springframework.jms.connection.SingleConnectionFactory.initConnection(SingleConnectionFactory.java:288)
    at org.springframework.jms.connection.SingleConnectionFactory.createConnection(SingleConnectionFactory.java:225)
    at org.springframework.jms.support.JmsAccessor.createConnection(JmsAccessor.java:184)
    at org.springframework.jms.listener.AbstractJmsListeningContainer.createSharedConnection(AbstractJmsListeningContainer.java:403)
    at org.springframework.jms.listener.AbstractJmsListeningContainer.establishSharedConnection(AbstractJmsListeningContainer.java:371)
    at org.springframework.jms.listener.DefaultMessageListenerContainer.establishSharedConnection(DefaultMessageListenerContainer.java:750)
    at org.springframework.jms.listener.AbstractJmsListeningContainer.doStart(AbstractJmsListeningContainer.java:278)
    at org.springframework.jms.listener.AbstractJmsListeningContainer.start(AbstractJmsListeningContainer.java:263)
    at org.springframework.jms.listener.DefaultMessageListenerContainer.start(DefaultMessageListenerContainer.java:556)
    at org.springframework.context.support.DefaultLifecycleProcessor.doStart(DefaultLifecycleProcessor.java:167)
    ... 38 more

It is strange that even though I set the SSLCipherSuite property it tries to get the cipher suite by the cipher spec...

Can someone please suggest how to fix this?

Answer 1

This bug is acknowledged here: http://www-01.ibm.com/support/docview.wss?uid=swg1IV36662

And marked as fixed in Websphere MQ fix pack 7.1.0.3.

The recommended (but not entirely satisfactory) workaround is to disable assertions in the JRE command line, with either "-disableassertions" or "-da".

Answer 2

Well, after some research it appeared that the problem is in the assertion mechanism. If assertions are disabled everything works fine. It is strange that you can have a completely working code even if assertions fail... And it is rather pity that I can't find a way to set the cipher spec - only the cipher suite setter is provided by the MQQueueConnectionFactory class.

In case of the weblogic server, there is a parameter named 'debugFlag' that is verified in the WLS_HOME/user_projects/domains/local-domain-name/bin/setDomainEnv.cmd (.sh). If you have it set to 'true' the application would fail. Or you can add the following JAVA_OPTION: -da:com.ibm.mq... at the end of the setDomainEnv.cmd (.sh) file. This way you can leave the debug enabled.

Of cource, it is not a preferrable way to fix the problem, but for now it is the only way I could fix it.