<a id="ibmmq-source-connector-config"></a>

# Configuration Reference for IBM MQ Source Connector for Confluent Platform

To use this connector, specify the name of the connector class in the `connector.class` configuration property.

```properties
connector.class=io.confluent.connect.ibm.mq.IbmMQSourceConnector
```

Connector-specific configuration properties are described below.

#### NOTE
These are properties for the self-managed connector. If you are using
Confluent Cloud, see [IBM MQ Source Connector for Confluent
Cloud](/cloud/current/connectors/cc-ibmmq-source.html).

## IBM MQ Connection

`mq.hostname`
: The hostname of the IBM MQ broker.
  <br/>
  * Type: string
  * Importance: high

`mq.port`
: The port of the IBM MQ broker.
  <br/>
  * Type: int
  * Default: 1414
  * Importance: high

`mq.connection.list`
: A list of hostnames and ports of multiple IBM MQ brokers, allowing the use of IBM MQ’s high availability and disaster recovery (HA/DR) support. With this parameter, the connector attempts to connect to the first available instance in the list. If it fails, the connector then tries the next instance in the list, and so on. Ensure that the `max.retry.time` configuration is not set to a low value. This gives the connector enough time to switch over to another instance before it fails on a retry timeout.
  <br/>
  * Type : string (comma-separated values. For example, host1:port1,host2:port2)
  * Importance: high

`mq.transport.type`
: The type of transport to use when connecting to IBM MQ.
  <br/>
  * Type: string
  * Default: client
  * Valid Values: [bindings, client, direct_tcpip, direct_http]
  * Importance: high
  * Dependents: `mq.channel`

`mq.queue.manager`
: The name of the queue manager.
  <br/>
  * Type: string
  * Importance: high

`mq.channel`
: The channel for client connections. This is only required when `mq.transport.type` is set to client (the default); in other cases, it is ignored and can be set to an empty value.
  <br/>
  * Type: string
  * Importance: high

`mq.ssl.cipher.suite`
: The CipherSuite for SSL (Secure Sockets Layer) connections.
  <br/>
  * Type: string
  * Default: “”
  * Importance: high

`mq.ssl.fips.required`
: Whether the connector requires FIPS (Federal Information Processing Standards)
  approved cryptography for SSL connections.
  <br/>
  * Type: boolean
  * Default: false
  * Importance: high

`mq.ssl.peer.name`
: Sets a distinguished name (DN) pattern. If `mq.ssl.cipher.suite` is set, this pattern can ensure that the correct queue manager is used. The connection attempt fails if the distinguished name provided by the queue manager does not match this pattern.
  <br/>
  * Type: string
  * Default: “”
  * Importance: high

`mq.username`
: The username to use when connecting to IBM MQ.
  <br/>
  * Type: string
  * Default: “”
  * Importance: high

`mq.password`
: The password to use when connecting to IBM MQ.
  <br/>
  * Type: password
  * Default: [hidden]
  * Importance: high

`security.exit.classpath`
: Full classpath location of the IBM MQ Security Exit implementation class. This should be the complete Java class name (e.g., `com.example.CustomSecurityExit`) of your custom security exit that implements the `com.ibm.mq.exits.WMQSecurityExit interface`. The Security Exit is called during connection establishment to perform custom authentication and authorization logic beyond standard IBM MQ security mechanisms.
  <br/>
  * Type: string
  * Default: “”
  * Importance: medium

`security.exit.init.data`
: Initialization data string passed to the Security Exit class during setup. This data can contain configuration parameters, authentication tokens, or other context information that the Security Exit implementation needs to properly authenticate and authorize the connection to IBM MQ. Maximum length is **32 characters**.
  <br/>
  * Type: string
  * Default: “”
  * Importance: medium

`credentials.provider.classpath`
: Fully qualified class name of the credentials provider implementation. This class must implement the `io.confluent.connect.ibm.mq.creds.IbmMqCredentialsProvider` interface. If the class also implements `org.apache.kafka.common.Configurable`, the connector will pass it a map of configuration properties prefixed with `credentials.provider.`. If not specified, the connector will not use a credentials provider.
  <br/>
  * Type: string
  * Default: “”
  * Importance: medium

## IBM MQ Secure Connection

`mq.tls.protocol`
: The TLS (Transport Layer Security) protocol version for secure connections to IBM MQ. The default is `TLSv1.2`, which should be fine for most cases, though the actual set of allowed values depends on the Java Virtual Machine (JVM). The following table shows which values each JVM generation supports.
  <br/>
  | JVM generation   | Supported protocol values                                                       |
  |------------------|---------------------------------------------------------------------------------|
  | Recent JVMs      | `TLSv1.3`, `TLSv1.2`, `TLSv1.1`, `TLS`                                          |
  | Older JVMs       | `SSL`, `SSLv2`, `SSLv3` (discouraged due to known security<br/>vulnerabilities) |
  * Type: string
  * Default: TLSv1.2
  * Valid Values: [TLSv1.3, TLSv1.2, TLSv1.1, TLS, SSL, SSLv2, SSLv3]
  * Importance: medium

`mq.tls.keystore.type`
: The file format of the key store file. This is required only when using secure TLS communication with IBM MQ.
  <br/>
  * Type: string
  * Default: JKS
  * Importance: medium

`mq.tls.keystore.location`
: The location of the key store file. This is required only when using secure TLS communication with IBM MQ.
  <br/>
  * Type: string
  * Default: null
  * Importance: high

`mq.tls.keystore.password`
: The store password for the key store file. This is optional for client and only needed if `mq.tls.keystore.location` is configured.
  <br/>
  * Type: password
  * Default: [hidden]
  * Importance: high

`mq.tls.key.password`
: The password of the private key used for secure TLS communication with IBM MQ.
  <br/>
  * Type: password
  * Default: [hidden]
  * Importance: high

`mq.tls.truststore.type`
: The file format of the trust store file. This is required when using TLS and secure communication with IBM MQ.
  <br/>
  * Type: string
  * Default: JKS
  * Importance: medium

`mq.tls.truststore.location`
: The location of the trust store file. This is required only when using secure TLS communication with IBM MQ.
  <br/>
  * Type: string
  * Default: null
  * Importance: high

`mq.tls.truststore.password`
: The password for the trust store file. If a password is not set access to the truststore is still available, but integrity checking is disabled. This is required only when using secure TLS communication with IBM MQ.
  <br/>
  * Type: password
  * Default: [hidden]
  * Importance: high

`mq.tls.keymanager.algorithm`
: The algorithm used by key manager factory for SSL connections. Default value is the key manager factory algorithm configured for the Java Virtual Machine. This is required only when using secure TLS communication with IBM MQ.
  <br/>
  * Type: string
  * Default: SunX509
  * Valid Values: [PKIX, SunX509]
  * Importance: low

`mq.tls.trustmanager.algorithm`
: The algorithm used by trust manager factory for SSL connections. Default value is the trust manager factory algorithm configured for the Java Virtual Machine. This is required only when using secure TLS communication with IBM MQ.
  <br/>
  * Type: string
  * Default: PKIX
  * Valid Values: [PKIX, SunX509]
  * Importance: low

`mq.tls.secure.random.implementation`
: The SecureRandom PRNG (pseudo-random number generator) implementation to use
  for SSL cryptography operations. By default, tries PKCS11 implementation
  first. If PKCS11 is not supported, iterates through the provider and returns
  the first working implementation. This is required only when using secure
  TLS communication with IBM MQ.
  <br/>
  * Type: string
  * Default: null
  * Valid Values: [PKCS11, NativePRNG, SHA1PRNG, NativePRNGBlocking, NativePRNGNonBlocking, Windows-PRNG]
  * Importance: low

<a id="ibmmq-source-session-configs"></a>

## IBM MQ Session

`jms.destination.name`
: The name of the JMS (Java Message Service) destination (queue or topic) to read from.
  <br/>
  * Type: string
  * Importance: high

`jms.destination.type`
: The type of JMS destination, which is either queue or topic.
  <br/>
  * Type: string
  * Default: queue
  * Valid Values: [queue, topic]
  * Importance: high

`jms.subscription.durable`
: Whether the subscription of the connector tasks to a JMS topic is durable or not.
  <br/>
  * Type: boolean
  * Default: false
  * Importance: medium

`jms.subscription.name`
: The name of the JMS subscription. Supported only in durable subscriptions and JMS topics.
  <br/>
  * Type: string
  * Default: null
  * Importance: medium

`batch.size`
: The maximum number of records that a connector task may read from the JMS broker before writing to Kafka. The task holds these records until they are acknowledged in Kafka, so this may affect memory usage. The maximum batch size allowed is 10K for the IBM MQ connector, because IBM MQ allows, at most, 10K messages without acknowledgement.
  <br/>
  * Type: int
  * Default: 1024
  * Valid Values: [1,…]
  * Importance: low

`max.pending.messages`
: The maximum number of messages per task that can be received from JMS brokers and produced to Kafka before the task acknowledges the JMS session/messages. If the task fails and is restarted, this is the maximum number of JMS messages the task may duplicate in Kafka. This is typically set larger than `batch.size`. A smaller value than `batch.size` limits the size of the batches. Note that this should always be greater or equal to the number of `receiver.threads`.
  <br/>
  This configuration directly impacts message acknowledgment timing in IBM MQ. A higher value allows more messages to be buffered before acknowledgment, which can improve throughput but increases the time to commit transactions on the IBM MQ side. If you experience `MQRC_BACKED_OUT` errors (IBM MQ reason code 2003), which indicate transaction rollbacks due to acknowledgment timeouts, reduce this value to decrease the acknowledgment interval. See [MQRC_BACKED_OUT (2003) Errors](overview.md#ibmmq-source-troubleshooting-backed-out) for troubleshooting guidance.
  <br/>
  * Type: int
  * Default: 4096
  * Valid Values: [1,…]
  * Importance: low

`receiver.threads`
: The number of threads each task should use to consume messages from IBM MQ.
  Using multiple threads and fewer tasks can be more efficient than using more
  tasks with one thread. Environments with high network latency between the
  connector and IBM MQ benefit most from this pattern, because the connector
  spends most of its time waiting for the IBM MQ response.
  The number of threads cannot be set to more than one when the exactly once settings is enabled for the connector.
  <br/>
  * Type: int
  * Default: 1
  * Valid Values: [1,…]
  * Importance: high

`character.encoding`
: The character encoding to use while receiving the message.
  <br/>
  * Type: string
  * Default: UTF-8
  * Valid Values: one of [ISO-8859-1, UTF-8, UTF-16, UTF-16LE, UTF-16BE, US-ASCII]
  * Importance: low

`jms.message.selector`
: The [message selector](https://docs.oracle.com/javaee/6/api/javax/jms/Session.html#createConsumer(javax.jms.Destination,java.lang.String,boolean)) that should be applied to messages in the destination.
  <br/>
  * Type: string
  * Default: “”
  * Importance: high

`jms.receive.block.duration`
: The maximum amount of time in milliseconds that a JMS receive call will be
  blocked. Setting the value helps in reducing the number of empty receive
  calls.
  <br/>
  * Type: long
  * Default: 5000
  * Valid Values: [10,…,1800000]
  * Importance: low

`initial.poll.wait.time.ms`
: The initial amount of time in milliseconds to wait when polling for new messages before switching to a shorter poll interval.
  This helps reduce the number of empty poll attempts during startup or when the queue is empty.
  <br/>
  * Type: int
  * Default: 5000
  * Importance: low

## Exactly once

`state.topic.name`
: The name of the topic to be used in the IBM MQ system for the connector to be able to guarantee exactly once delivery of messages.
  The connector will store some offsets data in this topic and makes use of the same to guarantee exactly once delivery
  in case of restarts. Configuring this configuration will enable the exactly once support in the connector
  provided the corresponding worker level setting `exactly.once.source.support` is also set to `enabled`.
  The topic should be created in IBM MQ before creating the connector and will not be auto created by the connector.
  The connector uses a durable subscriber to consume from the state topic. So, there should be no
  other connector or consumer using the same topic.
  <br/>
  * Type: string
  * Default: “”
  * Importance: high
  <br/>
  #### NOTE
  When configuring `state.topic.name`, use the MQ topic string value (for example, `/kafkaConnect/stateTopics/connector_name`).
  If you use the MQ topic name (administrative name), the connection fails.

`transaction.boundary`
: Controls when the connector commits Kafka transactions when
  `exactly.once.source.support` is `enabled` in the connect worker.
  This configuration is available only when exactly once support is enabled in the worker.
  `connector` is the only supported value for this config for this connector
  <br/>
  * Type: string
  * Default: “poll”
  * Importance: high
  * Valid Values: [connector]

## Retry

`max.retry.time`
: The maximum total time in milliseconds the connector will retry a retriable exception. This value must be at least 100 milliseconds for retry functionality to work. The default is 3600000 milliseconds (1 hour). Note that some retriable exceptions require establishing a new JMS session.
  <br/>
  * Type: long
  * Default: 3600000 (1 hour)
  * Importance: low

## Kafka

`kafka.topic`
: The name of the Kafka topic where the connector writes all records that were read from the JMS broker.
  <br/>
  * Type: string
  * Importance: high

## Auto topic creation

For more information about Auto topic creation, see [Configuring Auto Topic Creation for Source Connectors](/kafka-connectors/self-managed/userguide.html#connect-source-auto-topic-creation).

Configuration properties accept regular expressions (regex) that are defined as
[Java regex](https://docs.oracle.com/javase/8/docs/api/java/util/regex/Pattern.html).

`topic.creation.groups`
: A list of group aliases that are used to define per-group topic configurations for matching topics. A `default` group always exists and matches all topics.
  <br/>
  * Type: List of String types
  * Default: empty
  * Possible Values: The values of this property refer to any additional groups. A `default` group is always defined for topic configurations.

`topic.creation.$alias.replication.factor`
: The replication factor for new topics created by the connector. This value must not be larger than the number of brokers in the Kafka cluster. If this value is larger than the number of Kafka brokers, an error occurs when the connector attempts to create a topic. This is a **required property** for the `default` group. This property is optional for any other group defined in `topic.creation.groups`. Other groups use the Kafka broker default value.
  <br/>
  * Type: int
  * Default: n/a
  * Possible Values: `>= 1` for a specific valid value or `-1` to use the Kafka broker’s default value.

`topic.creation.$alias.partitions`
: The number of topic partitions created by this connector. This is a **required property** for the `default` group. This property is optional for any other group defined in `topic.creation.groups`. Other groups use the Kafka broker default value.
  <br/>
  * Type: int
  * Default: n/a
  * Possible Values: `>= 1` for a specific valid value or `-1` to use the Kafka broker’s default value.

`topic.creation.$alias.include`
: A list of strings that represent regular expressions that match topic names. This list is used to include topics with matching values, and apply this group’s specific configuration to the matching topics. `$alias` applies to any group defined in `topic.creation.groups`. This property does not apply to the `default` group.
  <br/>
  * Type: List of String types
  * Default: empty
  * Possible Values: Comma-separated list of exact topic names or regular expressions.

`topic.creation.$alias.exclude`
: A list of strings representing regular expressions that match topic names. This list is used to exclude topics with matching values from getting the group’s specfic configuration. `$alias` applies to any group defined in `topic.creation.groups`. This property does not apply to the `default` group. Note that exclusion rules override any inclusion rules for topics.
  <br/>
  * Type: List of String types
  * Default: empty
  * Possible Values: Comma-separated list of exact topic names or regular expressions.

`topic.creation.$alias.${kafkaTopicSpecificConfigName}`
: Any of the [Changing Broker Configurations Dynamically](/platform/current/kafka/dynamic-config.html#changing-broker-configurations-dynamically) for the version of the Kafka broker where the records will be written. The broker’s topic-level configuration value is used if the configuration is not specified for the rule. `$alias` applies to the `default` group as well as any group defined in `topic.creation.groups`.
  <br/>
  * Type: property values
  * Default: Kafka broker value

<!-- WARNING: THIS IS A SHARED FILE AND THE SOURCE IS LOCATED IN DOCS-COMMON. DO NOT ADD TO ANY OTHER REPO. -->

## CSFLE and CSPE configurations

`csfle.enabled`

Accepts a boolean value. CSFLE is enabled for the connector if `csfle.enabled` is set to True.

* Type: boolean
* Default: False

`auto.register.schemas`

Specifies if the Serializer should attempt to register the Schema with Schema Registry.

* Type: boolean
* Default: true
* Importance: medium

`use.latest.version`

Only applies when `auto.register.schemas` is set to false. If `auto.register.schemas` is set to false and `use.latest.version` is set to true, then instead of deriving a schema for the object passed to the client for serialization, Schema Registry uses the latest version of the schema in the subject for serialization.

* Type: boolean
* Default: true
* Importance: medium

<a id="ibmmq-source-connector-license-config"></a>

## Confluent Platform license

`confluent.topic.bootstrap.servers`
: A list of host/port pairs to use for establishing the initial connection to
  the Kafka cluster used for licensing. All servers in the cluster will be
  discovered from the initial connection. This list should be in the form
  <br/>
  ```text
  host1:port1,host2:port2,...
  ```
  <br/>
  This list need not contain the full set of servers, since these servers are
  only used for the initial connection to discover the full cluster membership
  (which may change dynamically). You may want to include more than one,
  though, in case a server is down.
  <br/>
  * Type: list
  * Importance: high

`confluent.topic`
: Name of the Kafka topic used for Confluent Platform configuration, including licensing information.
  <br/>
  * Type: string
  * Default: \_confluent-command
  * Importance: low

`confluent.topic.replication.factor`
: The replication factor for the Kafka topic used for Confluent Platform configuration, including licensing information. This is used only if the topic does not already exist, and the default of 3 is appropriate for production use. If you are using a development environment with less than 3 brokers, you must set this to the number of brokers (often 1).
  <br/>
  * Type: int
  * Default: 3
  * Importance: low

### Confluent license properties

You can put license-related properties in the connector configuration, or in license-related properties in the
[Connect worker configuration](https://docs.confluent.io/kafka-connectors/self-managed/license.html#centralized-license-in-the-kconnect-long-worker) instead of in each connector configuration.

This connector is proprietary and requires a license. The license information is stored in the `_confluent-command`
topic. If the broker requires SSL for connections, you must include the security-related `confluent.topic.*` properties
as described below.

`confluent.license`
: Confluent issues enterprise license keys to each subscriber. The license key is text that you can copy and
  paste as the value for `confluent.license`. A trial license allows using the connector for a 30-day trial period. A developer license allows using the connector indefinitely for single-broker development environments.
  <br/>
  If you are a subscriber, contact Confluent Support for more information.
  <br/>
  * Type: string
  * Default: “”
  * Valid Values: Confluent Platform license
  * Importance: high

`confluent.topic.ssl.truststore.location`
: The location of the trust store file.
  <br/>
  * Type: string
  * Default: null
  * Importance: high

`confluent.topic.ssl.truststore.password`
: The password for the trust store file. If a password is not set access to the truststore is still available, but
  integrity checking is disabled.
  <br/>
  * Type: password
  * Default: null
  * Importance: high

`confluent.topic.ssl.keystore.location`
: The location of the key store file. This is optional for client and can be used for two-way authentication for client.
  <br/>
  * Type: string
  * Default: null
  * Importance: high

`confluent.topic.ssl.keystore.password`
: The store password for the key store file. This is optional for client and only needed if ssl.keystore.location is configured.
  <br/>
  * Type: password
  * Default: null
  * Importance: high

`confluent.topic.ssl.key.password`
: The password of the private key in the key store file. This is optional for client.
  <br/>
  * Type: password
  * Default: null
  * Importance: high

`confluent.topic.security.protocol`
: Protocol used to communicate with brokers. Valid values are: PLAINTEXT, SSL, SASL_PLAINTEXT, SASL_SSL.
  <br/>
  * Type: string
  * Default: “PLAINTEXT”
  * Importance: medium

<a id="ibmmq-source-license-topic-configuration"></a>

### License topic configuration

A Confluent enterprise license is stored in the `_confluent-command` topic.
This topic is created by default and contains the license that corresponds to
the license key supplied through the `confluent.license` property. No public
keys are stored in Kafka topics.

The following describes how the default `_confluent-command` topic is
generated under different scenarios:

* A 30-day trial license is automatically generated for the `_confluent-command` topic if you do not add the `confluent.license` property or leave this property empty (for example, `confluent.license=`).
* Adding a valid license key (for example, `confluent.license=<valid-license-key>`) adds a valid license in the `_confluent-command` topic.

Here is an example of the minimal properties for development and testing.

You can change the name of the `_confluent-command` topic using the
`confluent.topic` property (for instance, if your environment has strict
naming conventions). The example below shows this change and the configured
Kafka bootstrap server.

```none
confluent.topic=foo_confluent-command
confluent.topic.bootstrap.servers=localhost:9092
```

The example above shows the minimally required bootstrap server property that
you can use for development and testing. For a production environment, you add
the normal producer, consumer, and topic configuration properties to the
connector properties, prefixed with `confluent.topic.`.

### License topic ACLs

The `_confluent-command` topic contains the license that corresponds to the
license key supplied through the `confluent.license` property. It is created
by default. Connectors that access this topic require the following ACLs
configured:

* CREATE and DESCRIBE on the resource cluster, if the connector needs to create the topic.
* DESCRIBE, READ, and WRITE on the `_confluent-command` topic.

  #### IMPORTANT
  You can also use DESCRIBE and READ without WRITE to restrict access to
  read-only for license topic ACLs. If a topic exists, the LicenseManager
  will not try to create the topic.

You can provide access either individually for each principal that will
use the license or use a [wildcard entry](/platform/current/kafka/authorization.html#acl-wildcard-principals) to
allow all clients. The following examples show commands that you can use to
configure ACLs for the resource cluster and `_confluent-command` topic.

1. Set a CREATE and DESCRIBE ACL on the resource cluster:
   ```none
   kafka-acls --bootstrap-server localhost:9092 --command-config adminclient-configs.conf \
   --add --allow-principal User:<principal> \
   --operation CREATE --operation DESCRIBE --cluster
   ```
2. Set a DESCRIBE, READ, and WRITE ACL on the `_confluent-command` topic:
   ```none
   kafka-acls --bootstrap-server localhost:9092 --command-config adminclient-configs.conf \
   --add --allow-principal User:<principal> \
   --operation DESCRIBE --operation READ --operation WRITE --topic _confluent-command
   ```

### Override Default Configuration Properties

You can override the replication factor using
`confluent.topic.replication.factor`. For example, when using a Kafka cluster
as a destination with less than three brokers (for development and testing) you
should set the `confluent.topic.replication.factor` property to `1`.

You can override producer-specific properties by using the
`producer.override.*` prefix (for source connectors) and consumer-specific
properties by using the `consumer.override.*` prefix (for sink connectors).

You can use the defaults or customize the other properties as well. For example,
the `confluent.topic.client.id` property defaults to the name of the connector
with `-licensing` suffix. You can specify the configuration settings for
brokers that require SSL or SASL for client connections using this prefix.

You cannot override the cleanup policy of a topic because the topic always has a
single partition and is compacted. Also, do not specify serializers and
deserializers using this prefix; they are ignored if added.