LDAP Authentication

Enterprise IBM MQ estates rarely maintain a separate password file per queue manager. Instead ALTER QMGR CONNAUTH references an AUTHINFO object of AUTHTYPE(IDPWLDAP) that points at Active Directory, OpenLDAP, or other LDAP-compatible directories. When a client application calls MQCONNX with a userid and password, the queue manager uses its LDAPUSER service bind to search the directory and validate credentials—or perform a direct user bind depending on attribute configuration documented for your release. Lockout after failed attempts, password expiry, and group membership remain directory concerns, which centralizes identity lifecycle for HR joiners and leavers. This tutorial walks through DEFINE AUTHINFO IDPWLDAP attributes—CONNAME, BASEDN, CLASSUSR, LDAPUSER, LDAPPWD, SECCOMM for TLS to directory—network and certificate requirements, userid format pitfalls between platforms, high availability for directory replicas, monitoring and troubleshooting connection storms during directory outages, and pairing LDAP authentication with OAM grants on service accounts versus human users.

IDPWLDAP AUTHINFO Attributes

CONNAME specifies host and port of the LDAP server—often ldap.corp.example.com(636) for LDAPS. BASEDN sets the search base such as ou=users,dc=corp,dc=com. CLASSUSR identifies the object class filter for user entries. LDAPUSER and LDAPPWD are the queue manager's bind identity with read permission to locate users—protect LDAPPWD rotation in secrets management. CHCKCLNT on the same or related AUTHINFO may still require TLS client certificates for MQ connections even when passwords go to LDAP. Mis-set BASEDN produces “user not found” for valid employees who exist in a different organizational unit.

Example DEFINE and CONNAUTH

1
2
3
4
5
6
7
DEFINE AUTHINFO('CORP.LDAP') AUTHTYPE(IDPWLDAP) +
  CONNAME('ldap.corp.example.com(636)') SECCOMM(YES) +
  LDAPUSER('cn=mqbind,ou=svc,dc=corp,dc=com') +
  LDAPPWD('secret') BASEDN('ou=apps,dc=corp,dc=com') +
  CLASSUSR('user')
ALTER QMGR CONNAUTH(CORP.LDAP)
DISPLAY AUTHINFO('CORP.LDAP') CONNAME LDAPUSER BASEDN

Replace example DN syntax with your directory team's standards. LDAPPWD in MQSC commands enters the repository—use secure command channels and rotate after bootstrap. Many sites define AUTHINFO once in automation and never type passwords in interactive runmqsc. Test ldap connectivity from the MQ host with vendor tools before blaming MQ.

Active Directory Considerations

Applications may present DOMAIN\user, user@domain.com, or sAMAccountName. MQ and AUTHINFO must align with the format the directory expects for bind. Directory teams often provide a dedicated OU for MQ application accounts separate from interactive users. Group-based authorization still requires OAM grants to groups mirrored from LDAP groups or manual group objects on the MQ host. Single sign-on with certificates may replace password LDAP for some channels while LDAP remains for others.

High Availability and Performance

Point CONNAME at a directory VIP or DNS round robin with health checks. Directory outage during peak batch windows can stall thousands of MQCONNX attempts—implement connection retry in apps with backoff, and monitor directory latency from MQ hosts. Read-only domain controller placement near data centers reduces cross-WAN LDAP. Firewall deny rules between DMZ MQ and corporate LDAP are a frequent go-live blocker discovered on Friday evening.

Troubleshooting LDAP Auth Failures

1. From MQ host, test TCP to CONNAME port with openssl or ldapsearch.
2. Verify LDAPUSER bind still valid—not expired service password.
3. Confirm user exists under BASEDN with directory browser.
4. Match client userid format to directory expectation.
5. Read queue manager AMQ errors for authentication service failures.
6. After LDAP success, if put fails, switch to OAM and 2035 tutorials.

LDAP Versus Certificates

Many B2B integrations drop passwords entirely: mutual TLS, CHLAUTH SSLPEERMAP to MCAUSER, OAM grants on MCAUSER. LDAP remains valuable for internal fat clients and legacy APIs that already use directory passwords. Hybrid estates use LDAP CONNAUTH on internal SVRCONN and certificates on external listeners—document per listener and channel.

Explainer: Calling HR to Verify Badge

LDAP authentication is the guard calling the central employee database to confirm your password before you enter. IDPWOS was the guard's local notebook instead.

Explain Like I'm Five: LDAP Authentication

Before you climb into the treehouse, the guard calls mom's phone list in the kitchen to check your secret word is right.

Practice Exercises

Exercise 1

List five AUTHINFO attributes to document in a connection spec.

Exercise 2

Directory up but MQ fails—three format or BASEDN checks.

Exercise 3

Design DR when LDAP is unavailable: break-glass options.

Frequently Asked Questions

Test Your Knowledge