# MQRC 2063: Security error Source: https://wndsoftware.com/mainframe-errors/mqrc-2063 ### MQRC 2063: Security error MQRC 2063 (MQRC_SECURITY_ERROR, hex 080F) means an MQ call failed because the security check could not be completed. The security manager, the LDAP server or Advanced Message Security returned an error, which is different from a plain refusal (that is 2035). #### Other names for this code Also written as `RC2063`, `reason code 2063`, `MQ 2063`, `MQ error 2063`, `MQRC_SECURITY_ERROR`, `080F`, `0x080F`, `security error`, `MQJE001 Reason 2063`, `JMSCMQ0001 2063`. ### What it means MQCONN, MQCONNX, MQOPEN, MQSUB, MQPUT1 and MQCLOSE can all return 2063 with MQCC_FAILED. The queue manager asked something to decide whether the request is allowed, and that something failed. The application gets 2063 whether or not the user would have had access. The causes are platform-specific. On distributed MQ with LDAP connection authentication, the queue manager couldn't reach the LDAP server, or LDAP returned an error. On z/OS, the external security manager (RACF or another product) returned an error. A z/OS bindings connection from a JMS application in WebSphere Application Server or Liberty also gets 2063 when the user name or password is too long. IBM gives limits of 8 characters for the user name and 100 for the password. Advanced Message Security causes it when a certificate or policy is missing or wrong. From MQ 9.4.0, a problem with the queue manager's token authentication setup can return it for applications that send a token. Because the real reason is outside MQ, the useful detail is in the queue manager error log, the AMS log or, on z/OS, the job log. ### Common causes - The LDAP server used for connection authentication (AUTHTYPE(IDPWLDAP)) is down, unreachable, or rejects the queue manager's own bind. - On z/OS, RACF or another security product returned an error to the queue manager. - On z/OS, a JMS application in WebSphere Application Server or Liberty connects in bindings mode with a user name longer than 8 characters or a password longer than IBM's limit of 100. - Advanced Message Security can't find a valid certificate for the user, or the security policy for the queue is wrong. AMS can move messages it can't process to SYSTEM.PROTECTION.ERROR.QUEUE. - With MQ 9.4.0 and later, the queue manager's token authentication configuration has a problem and the application sent a token on MQCONNX. ### How to find the problem - Read the queue manager error log at the time of the failure. Security errors are logged with the underlying cause, and token errors include an error code. - For LDAP, run `DISPLAY QMSTATUS LDAPCONN` to see whether the queue manager is connected to the LDAP server, and check the AUTHINFO object with `DISPLAY AUTHINFO(...) ALL`. - On z/OS, look in the queue manager and AMS job logs for messages from the security manager around the failure time. - For AMS, browse SYSTEM.PROTECTION.ERROR.QUEUE and list the policy with `dspmqspl -m QM1` on distributed MQ. - On IBM i, check the FFST records for the error details. ### How to fix it - Restore the LDAP connection. Check the server, the network path, the bind user and password, and any TLS settings in the AUTHINFO object. Then run `REFRESH SECURITY TYPE(CONNAUTH)`. - On z/OS, give the security administrator the error from the job log so they can fix the RACF side. - For z/OS bindings JMS connections, use a user name of 8 characters or fewer and a password of no more than 100. - For AMS, install or renew the user's certificate in its keystore and correct the policy with `setmqspl`. Then reprocess any messages on SYSTEM.PROTECTION.ERROR.QUEUE. - Retrying won't help until the underlying problem is fixed, because every check will fail the same way. ### IBM documentation [IBM documentation: MQRC 2063](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=codes-2063-080f-rc2063-mqrc-security-error). Use the documentation for your installed release. [Report a correction to WND Software](https://wndsoftware.com/contact#message). Technical reviewer: [Albert Joseph](https://wndsoftware.com/authors/albert-joseph), WND Software. Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s MQ documentation for your version. ### Related codes [MQRC 2035 MQRC_NOT_AUTHORIZED Read →](https://wndsoftware.com/mainframe-errors/mqrc-2035) [MQRC 2393 MQRC_SSL_INITIALIZATION_ERROR Read →](https://wndsoftware.com/mainframe-errors/mqrc-2393) [MQRC 2397 MQRC_JSSE_ERROR Read →](https://wndsoftware.com/mainframe-errors/mqrc-2397) [MQRC 2059 MQRC_Q_MGR_NOT_AVAILABLE Read →](https://wndsoftware.com/mainframe-errors/mqrc-2059) [ICH408I RACF denied access Read →](https://wndsoftware.com/mainframe-errors/ich408i) ### Questions #### What is the difference between 2063 and 2035? 2035 means the check ran and access was refused. 2063 means the check itself failed, so MQ couldn't decide. Fixing user permissions won't help with 2063. #### Why do all clients get 2063 at the same time? A shared dependency failed. On distributed MQ with LDAP authentication this is most often the LDAP server or the network path to it. #### Does 2063 come with an ICH408I message on z/OS? Not usually. ICH408I reports a refusal, which leads to 2035. With 2063 look for an error from the security product itself in the job log. [IBM MQ reason codes](https://wndsoftware.com/mainframe-errors/mq-reason-codes) · [MQRC 2059](https://wndsoftware.com/mainframe-errors/mqrc-2059) · [MQRC 2071](https://wndsoftware.com/mainframe-errors/mqrc-2071) [← All error codes](https://wndsoftware.com/mainframe-errors/)