Subscriber authorisation in WebSphere MQ with MDB

I have an MDB that looks like this:

@MessageDriven(mappedName = "jms/TestJeremyTopic ", activationConfig =  {
        @ActivationConfigProperty(propertyName = "acknowledgeMode", propertyValue = "Auto-acknowledge"),
        @ActivationConfigProperty(propertyName = "destinationType", propertyValue = "javax.jms.Topic"),
        @ActivationConfigProperty(propertyName = "subscriptionDurability", propertyValue = "Durable"),
        @ActivationConfigProperty(propertyName = "clientId", propertyValue = "TopicReaderBeanClientId"),
        @ActivationConfigProperty(propertyName = "subscriptionName", propertyValue = "TopicReaderBeanSubscriptionName")
    })
public class TopicReaderBean implements MessageListener {
    public void onMessage(Message message) {
        ...
    }
}

I have set up a topic in WebSphere MQ 7. Using MQ Explorer both pub and sub operations seem to be OK.

I have set up a Listener Port in WebSphere. The Listener Port can be started successfully.

When I deploy and start my app the MDB fails to read any message. The exception given is:

[1/19/11 10:57:06:569 EST] 00000009 MDBListenerIm W   WMSG0019E: Unable to start MDB Listener TopicReaderBean, JMSDestination jms/TestJeremyTopic :     com.ibm.msg.client.jms.DetailedJMSSecurityException: JMSWMQ0026: Failed to subscribe to topic 'TEST_JEREMY' using MQSUB. There may have been a problem creating the subscription due to it being used by another message consumer. Make sure any message consumers using this subscription are closed before trying to create a new subscription under the same name. Please see the linked exception for more information.
at com.ibm.msg.client.wmq.common.internal.Reason.reasonToException(Reason.java:540)
at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:236)
at com.ibm.msg.client.wmq.internal.WMQMessageConsumer.checkJmqiCallSuccess(WMQMessageConsumer.java:123)
at com.ibm.msg.client.wmq.internal.WMQConsumerShadow.initialize(WMQConsumerShadow.java:689)
at com.ibm.msg.client.wmq.internal.WMQAsyncConsumerShadow.initialize(WMQAsyncConsumerShadow.java:714)
at com.ibm.msg.client.wmq.internal.WMQConnectionBrowser.<init>(WMQConnectionBrowser.java:1223)
at com.ibm.msg.client.wmq.internal.WMQConnection.createDurableConnectionBrowser(WMQConnection.java:892)
at com.ibm.msg.client.jms.internal.JmsConnectionImpl.createDurableConnectionBrowser(JmsConnectionImpl.java:1035)
at com.ibm.msg.client.jms.internal.JmsConnectionConsumerImpl.createConnectionBrowser(JmsConnectionConsumerImpl.java:236)
at com.ibm.msg.client.jms.internal.JmsConnectionConsumerImpl.<init>(JmsConnectionConsumerImpl.java:163)
at com.ibm.msg.client.jms.internal.JmsConnectionImpl.createDurableConnectionConsumer(开发者_如何学CJmsConnectionImpl.java:502)
at com.ibm.msg.client.jms.internal.JmsXAConnectionImpl.createDurableConnectionConsumer(JmsXAConnectionImpl.java:222)
at com.ibm.mq.jms.MQConnection.createDurableConnectionConsumer(MQConnection.java:300)
at com.ibm.ejs.jms.JMSTopicConnectionHandle.createDurableConnectionConsumer(JMSTopicConnectionHandle.java:228)
at com.ibm.ejs.jms.listener.MDBListenerImpl.createResources(MDBListenerImpl.java:597)
at com.ibm.ejs.jms.listener.MDBListenerImpl.internalStart(MDBListenerImpl.java:756)
at com.ibm.ejs.jms.listener.MDBListenerImpl.restart(MDBListenerImpl.java:729)
at com.ibm.ejs.jms.listener.MDBListenerImpl.alarm(MDBListenerImpl.java:1151)
at com.ibm.ejs.util.am._Alarm.run(_Alarm.java:127)
at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1550)
Caused by: com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2035' ('MQRC_NOT_AUTHORIZED').
at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:223)
... 18 more

I suspect that whilst the listener port is able to start, it doesn't actively connect until an attached application attempts to use it. At this time it is authenticated, but not authorised.

Q: Where are the authentication credentials configured in WebSphere? I have no idea who I am authenticating as. Is it the client ID set in the @ActivationConfigProperty in the MDB?

Q: Where are the authorisation settings in MQ Explorer? I don't see any way to grant pub or sub rights to groups or individuals. Currently it is set to allow/allow, presumably for everyone.

The authentication and authorisation is controlled at the OS level. Stand user/group management is key here. Don't forget to do the following in MQ Explorer: QueueManager -> Security -> Refresh Authorization Service.