What's the default password for keystore and truststore file ?

[DanielTamil]

Hi,

I want to use the default keystore and truststore from /run/runmqserver/tls for MQWebconsole ssl authentication. What's the default passowrd ? I tried passw0rd , it didn't work.

[arthurbarr]

The automatically generated key store is already used by the web server, by default. The password is automatically generated, and (currently) supplied to the web server via an environment variable (though that may change in the future).

[DanielTamil]

is the automatic keystore from this path /mnt/mqm/data/web/installations/Installation1/servers/mqweb/resources/security/key.jks ?

I don't know what's the content of this file. I want the webconsole to use key.kdb file from /run/runmqserver/tls

[arthurbarr]

The Go code generates a .kdb (CMS key store for the queue manager), and two .p12 files (PKCS#12 key store and trust store for use with the web server). The container code generates a file called tls.xml in the web configuration directory, using this template. The tls.xml file is automatically included in the MQ web server configuration, so you don't have to do anything to use it.

[DanielTamil]

Okay Got it now!

I have all valid ldap configuraiton in webuser.xml , but I get CWWKS3005E: A configuration exception has occurred. No UserRegistry implementation service is available. Ensure that you have a user registry configured.

here is my webuser.xml, masked the actual vlaues for security.

  mqwebuser.xml: |-
    <server>    
        <featureManager>
            <feature>ldapRegistry-3.0</feature>
            <feature>transportSecurity-1.0</feature>
            <feature>appSecurity-2.0</feature>
        </featureManager>
        <ldapRegistry id="ldap" realm="MyOrganizationRealm" 
        host="xxxxx.xxxxxxxxxx.com" port="636" ignoreCase="true"
        baseDN="OU=xxx,DC=xxx,DC=xxx,DC=xxx,DC=com" 
        bindDN="CN=xxxx,OU=xxx,OU=xxx,OU=xxx,DC=xxx,DC=xxx,DC=xxx,DC=com" 
        bindPassword="xxxxxxxxxxxxxxxxxxxxxxxx"
        ldapType="Microsoft Active Directory" 
        sslEnabled="true"
        recursiveSearch="true"
        reuseConnection="true"
        searchTimeout="120s">
            <activedFilters userFilter="(&amp;(sAMAccountName=%v)(objectcategory=user))" groupFilter="(&amp;(cn=%v)(objectcategory=group))" userIdMap="user:sAMAccountName" groupIdMap="*:cn" groupMemberIdMap="*:member" />
        </ldapRegistry>
        <enterpriseApplication id="com.ibm.mq.console">
            <application-bnd>
                <security-role name="MQWebAdmin">
                    <group name="CN=test_a,OU=Application,OU=Groups,OU=xxx,DC=xxx,DC=xxxx,DC=xxx,DC=com" realm="MyOrganizationRealm"/>
                </security-role>
                <security-role name="MQWebUser">
                            <group name="CN=test_x,OU=Application,OU=Groups,OU=xxx,DC=xxx,DC=xxxx,DC=xxx,DC=com" realm="MyOrganizationRealm"/>
                </security-role>
            </application-bnd>
        </enterpriseApplication>
    </server>  

[arthurbarr]

Are there any other errors earlier in the web server log? As you clearly do have a registry configured, I wonder whether it's failed to initialize due to some other error.

I'm not a Liberty expert though, I'm afraid, and you might need to seek one out (e.g. via a support case or the IBM community pages)