SSL Java Client for WebSphere MQ - spring

Question

I try to develop a test client (Java web application) for WebSphere MQ via Spring.
I've enabled the SSL security mechanism for the channel, queue manager and connection factory, using the NULL_MD5 cipher spec.
This is my Spring configuration file:
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context-2.5.xsd
http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd">
<context:annotation-config/>
<context:property-placeholder location="classpath:jms.properties"/>
<bean id="jmsFactory" class="com.ibm.mq.jms.MQQueueConnectionFactory">
<property name="hostName" value="${queue_hostname}"/>
<property name="queueManager" value="${queue_manager}"/>
<property name="channel" value="${queue_channel}"/>
<property name="port" value="${queue_port}"/>
<property name="transportType" value="1"/>
<property name="SSLCipherSuite" value="SSL_RSA_WITH_NULL_MD5"/>
</bean>
<bean id="sendDestination" class="com.ibm.mq.jms.MQQueue">
<property name="baseQueueName">
<value>queue.inbound</value>
</property>
</bean>
<bean id="jmsTemplate" class="org.springframework.jms.core.JmsTemplate">
<property name="connectionFactory">
<bean class="org.springframework.jms.connection.SingleConnectionFactory">
<property name="targetConnectionFactory">
<ref local="jmsFactory" />
</property>
</bean>
</property>
<property name="defaultDestination">
<ref bean="sendDestination" />
</property>
</bean>
<bean id="messageListener" class="com.test.MessageListener" />
<bean id="jmsContainer" class="org.springframework.jms.listener.DefaultMessageListenerContainer">
<property name="connectionFactory">
<bean class="org.springframework.jms.connection.SingleConnectionFactory">
<property name="targetConnectionFactory">
<ref local="jmsFactory" />
</property>
</bean>
</property>
<property name="destination" ref="sendDestination" />
<property name="messageListener" ref="messageListener" />
</bean>
</beans>
The problem is when I try to connect to the WebSphere MQ an exception raises:
Caused by: org.springframework.context.ApplicationContextException: Failed to start bean 'jmsContainer'; nested exception is java.lang.AssertionError
at org.springframework.context.support.DefaultLifecycleProcessor.doStart(DefaultLifecycleProcessor.java:170)
at org.springframework.context.support.DefaultLifecycleProcessor.access$1(DefaultLifecycleProcessor.java:154)
at org.springframework.context.support.DefaultLifecycleProcessor$LifecycleGroup.start(DefaultLifecycleProcessor.java:339)
at org.springframework.context.support.DefaultLifecycleProcessor.startBeans(DefaultLifecycleProcessor.java:143)
at org.springframework.context.support.DefaultLifecycleProcessor.onRefresh(DefaultLifecycleProcessor.java:108)
at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:926)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:467)
at org.springframework.test.context.support.AbstractGenericContextLoader.loadContext(AbstractGenericContextLoader.java:103)
at org.springframework.test.context.support.AbstractGenericContextLoader.loadContext(AbstractGenericContextLoader.java:1)
at org.springframework.test.context.support.DelegatingSmartContextLoader.loadContext(DelegatingSmartContextLoader.java:228)
at org.springframework.test.context.TestContext.loadApplicationContext(TestContext.java:124)
at org.springframework.test.context.TestContext.getApplicationContext(TestContext.java:148)
... 27 more
Caused by: java.lang.AssertionError
at com.ibm.mq.jmqi.internal.CipherSpec.<init>(CipherSpec.java:53)
at com.ibm.mq.jmqi.JmqiUtils.toCipherSuite(JmqiUtils.java:325)
at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.parseCipherSpec(RemoteTCPConnection.java:1984)
at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.makeSocketSecure(RemoteTCPConnection.java:1838)
at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.connnectUsingLocalAddress(RemoteTCPConnection.java:810)
at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.protocolConnect(RemoteTCPConnection.java:1130)
at com.ibm.mq.jmqi.remote.impl.RemoteConnection.connect(RemoteConnection.java:710)
at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSessionFromNewConnection(RemoteConnectionSpecification.java:400)
at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSession(RemoteConnectionSpecification.java:299)
at com.ibm.mq.jmqi.remote.impl.RemoteConnectionPool.getSession(RemoteConnectionPool.java:164)
at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1595)
at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1223)
at com.ibm.mq.ese.jmqi.InterceptedJmqiImpl.jmqiConnect(InterceptedJmqiImpl.java:311)
at com.ibm.mq.ese.jmqi.ESEJMQI.jmqiConnect(ESEJMQI.java:337)
at com.ibm.msg.client.wmq.internal.WMQConnection.<init>(WMQConnection.java:346)
at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createV7ProviderConnection(WMQConnectionFactory.java:6876)
at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createProviderConnection(WMQConnectionFactory.java:6254)
at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createConnection(JmsConnectionFactoryImpl.java:285)
at com.ibm.mq.jms.MQConnectionFactory.createCommonConnection(MQConnectionFactory.java:6189)
at com.ibm.mq.jms.MQQueueConnectionFactory.createQueueConnection(MQQueueConnectionFactory.java:120)
at com.ibm.mq.jms.MQQueueConnectionFactory.createConnection(MQQueueConnectionFactory.java:203)
at org.springframework.jms.connection.SingleConnectionFactory.doCreateConnection(SingleConnectionFactory.java:342)
at org.springframework.jms.connection.SingleConnectionFactory.initConnection(SingleConnectionFactory.java:288)
at org.springframework.jms.connection.SingleConnectionFactory.createConnection(SingleConnectionFactory.java:225)
at org.springframework.jms.support.JmsAccessor.createConnection(JmsAccessor.java:184)
at org.springframework.jms.listener.AbstractJmsListeningContainer.createSharedConnection(AbstractJmsListeningContainer.java:403)
at org.springframework.jms.listener.AbstractJmsListeningContainer.establishSharedConnection(AbstractJmsListeningContainer.java:371)
at org.springframework.jms.listener.DefaultMessageListenerContainer.establishSharedConnection(DefaultMessageListenerContainer.java:750)
at org.springframework.jms.listener.AbstractJmsListeningContainer.doStart(AbstractJmsListeningContainer.java:278)
at org.springframework.jms.listener.AbstractJmsListeningContainer.start(AbstractJmsListeningContainer.java:263)
at org.springframework.jms.listener.DefaultMessageListenerContainer.start(DefaultMessageListenerContainer.java:556)
at org.springframework.context.support.DefaultLifecycleProcessor.doStart(DefaultLifecycleProcessor.java:167)
... 38 more
It is strange that even though I set the SSLCipherSuite property it tries to get the cipher suite by the cipher spec...
Can someone please suggest how to fix this?

Answer 1

This bug is acknowledged here: http://www-01.ibm.com/support/docview.wss?uid=swg1IV36662
And marked as fixed in Websphere MQ fix pack 7.1.0.3.
The recommended (but not entirely satisfactory) workaround is to disable assertions in the JRE command line, with either "-disableassertions" or "-da".

Answer 2

Well, after some research it appeared that the problem is in the assertion mechanism. If assertions are disabled everything works fine. It is strange that you can have a completely working code even if assertions fail... And it is rather pity that I can't find a way to set the cipher spec - only the cipher suite setter is provided by the MQQueueConnectionFactory class.
In case of the weblogic server, there is a parameter named 'debugFlag' that is verified in the WLS_HOME/user_projects/domains/local-domain-name/bin/setDomainEnv.cmd (.sh). If you have it set to 'true' the application would fail. Or you can add the following JAVA_OPTION: -da:com.ibm.mq... at the end of the setDomainEnv.cmd (.sh) file. This way you can leave the debug enabled.
Of cource, it is not a preferrable way to fix the problem, but for now it is the only way I could fix it.