IBM MQ - I can't subscribe to topic using wildcard syntax - ibm-mq

Question

I have the following topics which are created on IBM MQ docker version:
dev/test/sys1 dev/test/sys2
I am trying to create subscriber from XMS .NET APIs using the following code:
destination = sessionWMQ.CreateTopic("dev/test/#");
The following exception appears, it is related to permissions based "Reason: 2035", but I am not able to figure out what is the permission I have to grant and from where
XMSException caught: IBM.XMS.IllegalStateException: Failed to
subscribe to topic dev/# using MQSUB. There may have been a problem
creating the subscription due to it being used by another message
consumer. Make sure any message consumers using this subscription are
closed before trying to create a new subscription under the same name.
Please see the linked exception for more information.

Answer 1

If you receive an error 2035 (MQRC_NOT_AUTHORIZED) there will be a corresponding message in the queue manager error log AMQERR01.LOG. It will say something like this:-
AMQ8009: Entity 'mqgusr1' has insufficient authority to access topic string
'dev/test/#'.
EXPLANATION:
The specified entity is not authorized to access the required topic. The
following requested permissions are unauthorized: sub
ACTION:
Ensure that the correct level of authority has been set for this entity against
appropriate topic objects, or ensure that the entity is a member of a privileged
group.
Specifically this error message will tell you the user id, the object name, and the missing authorization. Using this information, you can almost construct the command you need. You do need one more peice of information and that is the group name that the user is in that you wish to grant the authority on. It is always recommended that you use group names and not user names when granting authorities or you may end up with too many authorities to manage, or perhaps worse, more users than you expected gaining the authority you granted as a result of the primary group of the user being something like 'staff'.
Here's the command, assuming that 'mqgusr1' in my error message, is in the group 'mqgapp' and that group is suitable for being granted authority to subscribe to a topic.
SET AUTHREC PROFILE(SYSTEM.BASE.TOPIC) OBJTYPE(TOPIC) GROUP('mqgapp') AUTHADD(SUB)
It is worth mentioning at this point that adding topic related authorities to the SYSTEM.BASE.TOPIC results in the group in question being able to use any topic available - this object represents the root of the topic tree. If you wish to restrict access to only certain parts of the topic tree (recommended), then you should instead create a topic object for the section of the topic tree you want to use, and then grant authority there instead, thus the following commands:
SET AUTHREC PROFILE(SYSTEM.BASE.TOPIC) OBJTYPE(TOPIC) GROUP('mqgapp') AUTHRMV(SUB)
DEFINE TOPIC(DEV.TEST) TOPICSTR('dev/test')
SET AUTHREC PROFILE(DEV.TEST) OBJTYPE(TOPIC) GROUP('mqgapp') AUTHADD(SUB)